You type your bank’s address correctly, the page looks right, and yet you have landed on an impostor. No typo, no shady link — the directory that turns a web address into a destination was tampered with. That is DNS spoofing, and it can quietly send you to a fake site while everything appears normal. Our GetMyPassword team explains what it is and how to stay protected.
What DNS spoofing is
Every website name, like a bank’s address, must be translated into a numeric address by the Domain Name System (DNS) — the internet’s phonebook. DNS spoofing, also called DNS cache poisoning, corrupts that lookup so a correct web address resolves to a server the attacker controls. You type the real name, but you are sent to a fake copy of the site. Because the address in your bar looks right, the deception is hard to notice. This is closely related to pharming, where victims are redirected to fraudulent sites to steal logins and payment details.
How it happens
- Poisoned DNS cache on a resolver, feeding wrong answers to many users.
- A compromised home router with its DNS settings quietly changed.
- Malware on a device that alters how it resolves addresses.
- Rogue networks that hand out malicious DNS to everyone who connects.
- Attacks on unsecured lookups that let answers be forged in transit.
How to tell something is wrong
Because the address looks correct, your strongest clue is the security certificate. A genuine bank or shop uses HTTPS with a valid certificate, so a certificate warning — or a sudden drop to plain “http” — on a site that should be secure is a serious red flag you must never click past. Be alert to unexpected login prompts, a site that looks subtly off, or pages that suddenly ask you to “re-verify” details. When something feels wrong on a site you reached by typing the real address, stop and do not enter credentials.
When the address is right but the page is wrong, the certificate is your last honest signal. A security warning on a site that should be encrypted is a door you never walk through.
How to protect yourself
Keep your router firmware updated and its admin password changed from the default, and consider a reputable, secure DNS provider. Never ignore certificate warnings, keep devices free of malware with updates, and use a trusted VPN on untrusted networks. Above all, rely on two-factor authentication and a unique password from our password generator for every account, so that even credentials captured on a spoofed page cannot quietly unlock the real one.
Frequently asked questions
What is DNS spoofing?
DNS spoofing, or DNS cache poisoning, corrupts the system that translates a web address into a destination, so a correct address resolves to a server the attacker controls. You are sent to a fake site even though the address looks right.
How can I tell if I have been redirected to a fake site?
The clearest clue is a certificate warning or a drop to plain http on a site that should use HTTPS. Unexpected login prompts, a subtly wrong-looking page, or sudden “re-verify your details” requests are also warning signs.
How do I protect myself from DNS spoofing?
Update your router and change its default admin password, consider a secure DNS provider, never ignore certificate warnings, keep devices malware-free, and use two-factor authentication with unique passwords so captured credentials cannot unlock the real account.