Secure DNS Against Cache Poisoning and Hijacking

DNS is the connective tissue of the internet, translating domain names into the addresses used by browsers, applications and cloud services. Securing your DNS infrastructure therefore protects more than name resolution: it safeguards customer access, email delivery, software updates and the services that sustain revenue.

Attackers exploit both trust and convenience. They may insert false answers into a resolver cache, redirect traffic through compromised infrastructure, or abuse weakly protected domain administration. The result can be credential theft, malware delivery, service interruption and reputational damage extending well beyond an outage.

Why DNS failures create business risk

For Australian organisations, DNS is a high-impact control that supports banking platforms, e-commerce stores, government services and healthcare systems. Because the .au and .com.au domain namespaces are central to local operations, attackers may target registrars, authoritative nameservers, hosting providers and the routers connecting corporate offices in Sydney, Melbourne, Brisbane and regional locations.

A hijacked domain can redirect staff and customers to convincing phishing sites, intercept email, expose API traffic or disable essential services. The Australian Signals Directorate’s Essential Eight highlights the need for application control, patching, MFA and continuous monitoring, while the Australian Cyber Security Centre and Joint Cyber Security Centre provide relevant guidance for detecting and responding to threats.

How poisoning and hijacking differ

Cache poisoning involves returning a fraudulent DNS response before the legitimate record is cached. Older attacks relied on predictable transaction identifiers and source ports, while more sophisticated campaigns exploit resolver behaviour, vulnerable software and traffic interception. Users then connect to an attacker-controlled IP address without understanding why the destination changed.

DNS hijacking operates at a different layer. It may involve altering authoritative records, compromising a registrar account, exploiting vulnerable network equipment, redirecting domain traffic through BGP manipulation, or changing DNS configuration on a router. Poisoning can affect individual recursive resolvers; hijacking may redirect traffic globally and remain active until the underlying compromise is removed.

Design a resilient DNS architecture

Build redundancy by using at least two authoritative nameservers on separate networks, ideally through providers with Anycast addresses and independent infrastructure. Place recursive DNS services behind secure network boundaries or use contracted enterprise resolver services. Redundant resolvers reduce dependence on an internet service provider’s default DNS and limit the impact of a regional outage.

Encrypt the path between endpoints and recursive resolvers using DNS over TLS or DNS over HTTPS. Direct users and servers towards approved resolvers through endpoint management, mobile-device policy and network controls. These protocols protect queries from casual interception, although they do not make fraudulent authoritative records trustworthy by themselves.

Separate administrative duties and eliminate shared credentials. Enforce MFA on registrar, DNS hosting and cloud administration accounts, then apply least-privilege access to zone changes, dynamic updates and audit-log exports. Restrict management to known IP ranges, use privileged access workstations and retain an offline inventory of legitimate nameservers and DNS records.

Harden authoritative and recursive services

Deploy DNSSEC on authoritative zones and validate it at recursive resolvers. It authenticates signed records and helps identify spoofed or modified responses, but it does not prevent a registrar takeover. Protect signing keys with hardware-backed key management, maintain a tested key-rotation process and use TSIG authentication for dynamic updates and zone transfers.

Apply the same caution to recursive infrastructure. Disable open recursion, apply query-rate controls, monitor unusual response patterns and prevent untrusted systems from reaching management interfaces. Remove default accounts, patch resolver software promptly and restrict zone transfers to authorised secondary servers. Lock domain names at the registrar where supported and monitor the lock status for unexpected removal.

Monitor DNS for signs of compromise

Centralise DNS, registrar, certificate and endpoint logs in a SIEM or equivalent monitoring platform. Alert on changes to A, AAAA, CNAME, MX and nameserver records, new zone transfers, DNSSEC validation failures, disabled domain locks and resolver configuration changes. Compare expected answers with results obtained through multiple public DNS vantage points in Australia and overseas.

Treat unusual redirection as an incident rather than a simple availability problem. Preserve logs, contact the registrar through a trusted channel, suspend affected domains where necessary and prepare to restore records from offline backups. Where permitted, purge recursive caches, revoke active sessions, rotate credentials and replace compromised DNSSEC keys before normal service resumes.

DNS security recommendations for Australian teams

Use this checklist as a practical baseline, then adapt it to the systems supporting each critical service.

• Validate DNSSEC and investigate any chain-of-trust failure.
• Require MFA and phishing-resistant authentication for registrar access.
• Restrict zone transfers and dynamic update permissions.
• Monitor authoritative records and domain lock status continuously.
• Use redundant authoritative and recursive DNS providers.
• Encrypt resolver traffic and define approved DoH or DoT endpoints.

Teams operating across Australian offices and hybrid workforces should also account for staff connecting through mobile networks, home routers and café Wi-Fi. Under the Privacy Act 1988, exposure of personal information through a compromised service may trigger notification obligations, including the Notifiable Data Breaches scheme where applicable.

Put DNS defence into action

A DNS-focused vulnerability assessment and penetration test can reveal hijacking paths, exposed resolver services, weak registrar controls and gaps between documented records and live responses. This is particularly valuable for organisations that depend on .com.au domains, cloud services and high-volume customer applications.

Infoziant Security offers tailored DNS security testing, managed monitoring, threat intelligence and incident support for Australian enterprises, government organisations, financial institutions, retailers and healthcare providers. Request a free VAPT report or begin with a trial-based engagement to identify priority DNS weaknesses and build a practical remediation plan.