# DNS Poisoning

The technique of injecting false records into a DNS resolver's cache so future lookups return a malicious address.

**DNS poisoning[↗](/dns-poisoning)** (also called DNS cache poisoning) is the technique behind DNS spoofing[↗](/dns-spoofing): an attacker injects false address records into a DNS resolver's cache, so that every subsequent user who queries that resolver for a given domain is handed the malicious address instead of the legitimate one, often without the attacker needing to compromise each individual victim.

Because a single poisoned resolver can affect many users at once, internet service providers and large organizations run defenses like DNSSEC validation and randomized query identifiers to make it much harder for an attacker to successfully inject a fake record before the real one arrives.