# DNS spoofing and cache poisoning

Records from unverified zones, censored-keyword queries, or sibling-zone NS in cache that hijack resolution

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-04-30. Updated 2026-10-24._

## How it works
DNS answers are trusted because the resolver assumes the name it asked about is the name it gets records for, and that the zone answering owns that name. Three assumptions break: (1) a hosting provider assumes a tenant registering a zone name won't collide with the provider's own infrastructure names; (2) a resolver assumes an authoritative server returns records for the queried name rather than spoofed answers triggered by query content; (3) a recursor assumes cached records belong to the queried zone's bailiwick. When any assumption fails, attacker-chosen records are served to victims who never contacted the attacker.

## Where it shows up
- Multi-tenant DNS/SaaS platforms that let tenants register arbitrary zone names without verifying ownership against provider infrastructure hostnames [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain.md)
- Resolvers that key cache entries by each record's own (name,type) instead of the originating query [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-83hf-93m4-rgwq.md)
- Bailiwick checks that use a pool's zone context (parent zone) rather than the queried name [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-83hf-93m4-rgwq.md)
- Authoritative nameservers returning rotating or inconsistent A records for the same name [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall.md)
- Answers that change based on a substring anywhere in the query, not just the label [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall.md)
- Dynamic DNS clients that fall back to unverified nameservers [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain.md)

## How to review
For each record served or cached, ask: does the record's name fall inside the zone that legitimately owns it, and is the cache key derived from the originating query? The invariant: a record may only be accepted if its owner name is within the bailiwick of the zone that answered, and cache entries must be scoped to the query that produced them. On hosting platforms, verify that tenant-registered names cannot equal provider infrastructure identifiers. On resolvers, confirm bailiwick uses the queried zone, not the pool's context [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-83hf-93m4-rgwq.md). Treat inconsistent authoritative answers as a signal to test whether query content triggers spoofing [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall.md).

## Variants seen
- Registering a hosted zone named after a shared nameserver to hijack dynamic DNS updates across tenants [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain.md)
- Censorship middlebox returning spoofed A records for keyword-containing subdomains, pointing at takeover-able hosts [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall.md)
- Sibling-zone NS records cached under parent-zone bailiwick, poisoning a victim zone's resolution [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-83hf-93m4-rgwq.md)

## Impact and severity
Leaked internal IPs, hostnames and employee data across 15,000 orgs [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain.md); domain takeover and XSS on any affected domain [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall.md); resolution hijack of a victim zone [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-83hf-93m4-rgwq.md). Severity rises with shared infrastructure and broad tenant fan-out; silent, pre-auth, and hard to attribute.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-83hf-93m4-rgwq.md