According to this article, a DNS cache poisoning attack is performed the following way:

  1. Send a large number of resolution requests each spoofed with different source IP information for www.microsoft.com to ns1.sa.com. The logic of sending many requests is that each request will be assigned a unique transaction ID and even though all requests are for the same domain name, each will be processed independently.
  2. The ns1.sa.com will send each of these requests to the other DNS servers and eventually ns1.microsoft.com as highlighted at the top of this section. Hence the ns1.sa.com server is awaiting a large number of replies from ns1.microsoft.com.
  3. The attacker uses this wait stage to bombard ns1.sa.com with spoofed replies from ns1.microsoft.com stating that www.microsoft.com points to an IP address which is under the attacker’s control i.e. false information. Each spoofed reply has a different transaction ID. The attacker hopes to guess the correct transaction ID as used the two name servers.

But as I was referring to the DNS re-transmission protocol here, I found the following statement:

As a DDoS mitigation strategy, many DNS servers will drop duplicate queries coming from same IP to the same destination.

What I don't understand is that if at each DNS server a check is performed that a previous query to the same destination is made, irrespective of the source ip, the server can wait for the reply to the previous query and once it is received, send the answer to all the requests to the same destination, instead of re-transmitting them and expecting a large number of replies for the same destination.

Your Answer


Browse other questions tagged or ask your own question.