Editing DNS spoofing (section)

==Overview of the Domain Name System==
{{Main|Domain Name System}}

A [[Name server|Domain Name System server]] translates a human-readable [[domain name]] (such as <code>[[example.com]]</code>) into a numerical [[IP address]] that is used to [[Route (command)|route]] communications between [[Node (networking)|nodes]].<ref>{{Cite journal |last1=Wu |first1=Hao |last2=Dang |first2=Xianglei |last3=Wang |first3=Lidong |last4=He |first4=Longtao |date=2016 |title=Information fusion-based method for distributed domain name system cache poisoning attack detection and identification |url=https://onlinelibrary.wiley.com/doi/10.1049/iet-ifs.2014.0386 |journal=IET Information Security |language=en |volume=10 |issue=1 |pages=37–44 |doi=10.1049/iet-ifs.2014.0386 |s2cid=45091791 |issn=1751-8717|url-access=subscription }}</ref> Normally if the server does not know a requested translation it will ask another server, and the process continues [[Recursion|recursively]]. To increase performance, a server will typically remember (cache) these translations for a certain amount of time. This means if it receives another request for the same translation, it can reply without needing to ask any other servers, until that cache expires.

When a DNS server has received a false translation and caches it for performance optimization, it is considered ''poisoned'', and it supplies the false data to clients. If a DNS server is poisoned, it may return an incorrect IP address, diverting traffic to another computer (often an attacker's).<ref>{{cite news |url=https://www.cs.cornell.edu/~shmat/shmat_securecomm10.pdf |access-date=3 April 2017 |title=The Hitchhiker's Guide to DNS Cache Poisoning |publisher=[[Cornell University]] |first1=Sooel |last1=Son |first2=Vitaly |last2=Shmatikov |archive-date=14 August 2017 |archive-url=https://web.archive.org/web/20170814024945/http://www.cs.cornell.edu/~shmat/shmat_securecomm10.pdf |url-status=live }}</ref>