Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS server to resolve its domain name?
The victim does not need to use the attackers name server, although this can make things easier. The main idea is, that the original DNS record is under the attackers control and thus also the TTL (time to live) of this record:
- Victim tries to access web site. To get the address it asks the companies DNS server. Because the record is not cached yet the DNS server recursively resolves the name and returns the record (from the attackers DNS server) to the victim.
- If the victim needs to look up the IP address again (which can often be triggered by connection failures on the first IP) it will again ask the companies DNS server. If the record is cached the TTL gets checked. If the record is still valid it will be returned to the victim (with the old address). If it is not valid the companies DNS server will again recursively resolve the name and at the end get the new record from the attackers DNS server.
Another option would be for the attacker to return an answer which contains already both IP addresses (the good and the bad one). The victim will first use the good address. Once this stops working (which can be triggered by the attacker) the victim will retry with the alternative (bad) IP address.