There are several obstacles an attacker like Eve must overcome to issue a fake DNS response that will be accepted. First, an attacker must issue a response to her own DNS query before the authoritative name server is given a chance to respond. This obstacle is easily overcome, however, because if the attacker forces the target name server to query external authoritative name servers, she can expect that her immediate, direct response will be received before these external name servers have a chance to perform a lookup and issue a reply.

Source: Introduction to computer security(Michael_Goodrich,_Roberto_Tamassia under Network Security chapter 6 (DNS Cache Poisoning))

What is an external authoritative name server? How does it help the attacker to poison the DNS?

closed as unclear what you're asking by schroeder Feb 11 at 10:37

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • do you know what an "authoritative name server" is? – schroeder Feb 11 at 10:36
  • Again, the quote explains how the attack happens. That's literally what the quote is explaining. Your question then boils down to understanding what "authoritative name servers" are and how DNS queries are performed. – schroeder Feb 11 at 10:38

Browse other questions tagged or ask your own question.