In theory it should be possible to change a MX record of site A (aspmx.exampleA.com) to site B (aspmx.exampleB.com) and send the mail back to site A (aspmx.exampleA.com) So you can intercept all the mails, without having to worry about SSl/HTTPS and cracking the users passwords.

EDIT: What about servers with TLS enabled? See https://www.rfc-editor.org/rfc/rfc3207#section-6

A man-in-the-middle attack can be launched by deleting the "250 STARTTLS" response from the server. (...) In order to defend against such attacks both clients and servers MUST be able to be configured to require successful TLS negotiation of an appropriate cipher suite for selected hosts before messages can be successfully transferred.

  • Ummm... I don't quite follow. Could you elaborate?
    – Iszi
    Jun 22, 2012 at 2:54
  • I believe he is saying you take over the DNS or poision the DNS so the mail is sent to your server rather than the intended one that mail would then be routed to your server. This is the same as poisoning DNS to redirect web pages to your evil server.
    – Eric G
    Jun 22, 2012 at 3:22

2 Answers 2


DNS poisoning and MiTM are not necessarily the same thing. You can poison DNS without then fowarding the traffic on to the real source. E-mail is a stateless transaction, you would just need to receive the transmission, in most cases there is no immediate reply. Now, of course if you forward the message to the real recipient they will respond and you can then capture the next reply back to the poisoned target.

In a basic setup this should work. Obviously this won't defeat messages encrypted with PGP or equivalent since those are at a higher layer. I need to check back after some research, but I think that there are some peer-to-peer trust protocols or similar which would detect that a rogue was in place, but those are not basic/standard.

Edit: Actually this could work both on the SMTP and POP/IMAP side. Obviously doesn't work if IP addresses are used without name resolution.

  • The basic idea behind it is that you can see all the mails to a @domain.com, without them noticing that there was something wrong.... The clue here, is that you can access the real DNS records. Are there any existing scripts for it already?
    – user101579
    Jun 22, 2012 at 8:49
  • If you have access to change the DNS records, you would just need vi or notepad to change the entry and redirect the output from your intercept via netcat, possibly strip out SSL, etc.
    – Eric G
    Jun 22, 2012 at 14:41
  • What about TLS?
    – user101579
    Jun 27, 2012 at 13:50
  • TLS is just a "better" version of SSL. It's just encryption. Unless you are configured to use certificates / pre-known keys, you can MitM.
    – Eric G
    Jun 28, 2012 at 2:04

Yes I believe the TS was asking and mixing about DNS cache poisoning and MiTM to sniff email messages. Web Design Hero is correct. Poisoning and MiTM are two different things. Just to add up, this is my explanation of things since these are two different attack types and there are many techniques to this.

With DNS cache poisoning, there are two (2) options you can consider:

  1. You can choose to exploit a flaw in the DNS server to access the records OR
  2. You can choose to access the DNS records in a different method (using MiTM) without the need to exploit a flaw in the DNS system. What you are up to are the credentials you need to access the DNS records.

Cache poisoning works when you fill-up invalid entries to the DNS in order that subsequent DNS requests will be resolved to the malicious DNS entries once a refresh has occurred. It means if you have sample.com as your domain, and you have:

    sample.com.        IN      MX  10   mail.sample.com.

The attacker can do:

    sample.com.        IN      MX  10   mail.smple.com.

Upon refresh, this will be propagated to other name servers acting authoritatively whether primary or secondary etc. for your domain. The malicious host of course mail.smple.com can relay every copy of the message to the real MX mail.sample.com so everything will look okay. The detection of course is harder because obviously you do not need to check every DNS records in your name server every day not unless you will do a reconfiguration or you had something suspicious.

With MiTM, you are dealing with the network layer. The attacker needs to patch himself with the network in order to conduct the attack. It means you do not specifically need to launch an attack with the name server, you just need to associate yourself with the network to sniff. This usually works as part of the internal network, by spoofing the IP of the gateway you can start listening traffic by conducting ARP poisoning, broadcasting to the internal network that you are the legitimate gateway and forwarding the traffic to you before it reaches the other end although it can also work public IP via a BGP MiTM. It can actually defeat transport layer security like SSL/TLS not because it breaks them but because the traffic can be routed to a different port.

  • Yes. You can use a combination of different penetration testing tools. Ettercap for ARP spoofing and SSLStrip for MiTM are some examples. If just in case you have gained access to the gateway itself, you may use dsniff. Most of these tools you can find in backtrack-linux.org as part of the penetration testing set. For SSLStrip you can check: thoughtcrime.org/software/sslstrip for the POC. Depending on the implementation in the gateway, conducting an MiTM may not always be effective especially if the gateway operates a network-stack layer3 protection. Jun 22, 2012 at 11:41
  • either you do not know what you're asking or you do not know what you're doing. stackexchange is not a site to provide you with scripts or 0days. Jun 22, 2012 at 12:59
  • @JohnSantos Good add, I think we should also mention things like a driveb-by attack of manipulating the hosts file so that you just need to compromise your target sender/receiver and not the actual DNS records. and I agree with the comment above and to the OP, DNS poisoning and MiTM are not necessarily script kiddie attacks in the real world with other precautions and trusts in place.
    – Eric G
    Jun 22, 2012 at 14:38
  • What about TLS?
    – user101579
    Jun 27, 2012 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .