Skip to content

Read about DNS cache poisoning, want to know if the SMB setup is vulnerable

DNS cache poisoning tricks a resolver into caching a forged answer. Since the 2008 Kaminsky attack, modern resolvers are largely hardened with source-port randomization, but DNSSEC and modern transport (DoT, DoH) remain the real lock.

Try this first

  1. 1Do not run outdated DNS software in the office (old BIND, old Windows DNS). Patches close Kaminsky-class vulnerabilities.
  2. 2Enable DNSSEC for your own domain at the registrar, which protects clients with validating resolvers from forged answers about your zone.
  3. 3Have clients use a resolver that validates DNSSEC (1.1.1.1, 9.9.9.9, or your own Unbound), not just one that forwards.
  4. 4Consider DNS over HTTPS (DoH) or DNS over TLS (DoT) for laptops off the network, so a man-in-the-middle on Wi-Fi cannot intercept DNS.
  5. 5Disable open recursive resolvers on your firewall/router, those are both poisoning and DDoS-amplifier targets.

When to bring us in

If you want a review of your DNS chain from client to authoritative, with DNSSEC and DoH where it makes sense, we can plan it.

See also

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.

Who are you?

For the AI question we need your email and company, so we can follow up if the AI gets stuck, and to prevent abuse.

Limited to 2 questions per hour and 5 per day, kept lean so the AI stays useful. For more, contacting us directly works better for you and us.

Or skip the DIY entirely

Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.