content, such as computer worms or viruses. A user whose computer has referenced the poisoned DNS server gets tricked into accepting content coming from a non-authentic server and unknowingly downloads the malicious content. This technique can also be used for phishing attacks, where a fake version of a genuine website is created to gather personal details such as bank and credit/debit card details. Variants In the following variants, the entries for the server would be poisoned and redirected to the attacker's name server at IP address . These attacks assume that the name server for is . To accomplish the attacks, the attacker must force the target DNS server to make a request for a domain controlled by one of the attacker's nameservers. Redirect the target domain's name server The first variant of DNS cache poisoning involves redirecting the name server of the attacker's domain to the name server of the target domain, then assigning that name server an IP address specified by the attacker. DNS server's request: what are the address records for ? subdomain.attacker.example. IN A Attacker's response: Answer: (no response) Authority section: attacker.example. 3600 IN NS ns.target.example. Additional section: ns.target.example. IN A w.x.y.z A vulnerable server would cache the additional A-record (IP address) for , allowing the attacker to resolve queries to the entire domain. Redirect the NS record to another target domain The second variant of DNS cache poisoning involves redirecting the nameserver of another domain unrelated to the original request to an IP address specified by the attacker. DNS server's request: what are the address records for ? subdomain.attacker.example. IN A Attacker's response: Answer: (no response) Authority section: target.example. 3600 IN NS ns.attacker.example. Additional section: ns.attacker.example. IN A w.x.y.z A vulnerable server would cache the unrelated authority information for 's NS-record (nameserver entry), allowing the attacker to resolve queries to the entire domain. Prevention and mitigation Many cache poisoning attacks against DNS servers can be prevented by being less trusting of the information passed to them by other DNS servers, and ignoring any DNS records passed back which are not directly relevant to the query. For example, versions of BIND 9.5.0-P1 and above perform these checks. Source port randomization for DNS requests, combined with the use of cryptographically secure random numbers for selecting both the source port and the 16-bit cryptographic nonce, can greatly reduce the probability of successful DNS race attacks. However, when routers,