DNS Spoofing Detector

A DNS Spoofing Detector checks DNS responses from multiple trusted resolvers and flags inconsistencies that may indicate cache poisoning or man-in-the-middle manipulation.
It compares A-record answers across resolvers (e.g., Google, Cloudflare, Quad9) and highlights unexpected or differing IPs for the same hostname.
Use it as an early-warning tool—investigate mismatches, verify authoritative nameservers, and avoid trusting a single DNS source for security-critical decisions.

# Requires: pip install dnspython
import dns.resolver, sys
resolvers = ['8.8.8.8','1.1.1.1','9.9.9.9']
domain = sys.argv[1] if len(sys.argv)>1 else 'example.com'
answers = {}
for r in resolvers:
    res = dns.resolver.Resolver()
    res.nameservers = [r]
    try:
        resp = res.resolve(domain, 'A', lifetime=3)
        answers[r] = sorted({str(rr) for rr in resp})
    except Exception:
        answers[r] = ['ERR']
print('DNS responses for', domain)
for r, ips in answers.items():
    print(f'{r:>11} ->', ', '.join(ips))
unique = {tuple(v) for v in answers.values()}
if len(unique) > 1:
    print('WARNING: inconsistent A records — possible DNS spoofing or cache poisoning')
else:
    print('OK: consistent responses')

Real-time DNS Monitoring

Continuously monitor DNS responses for inconsistencies, unusual IP addresses, or suspicious TTL changes. Compare responses with trusted authoritative servers. Log every anomaly with timestamp, queried domain, and resolved IP. Alert administrators immediately upon detection. Helps prevent users from being redirected to malicious sites.

Anomaly Detection

Detect suspicious patterns like unexpected changes in DNS records, sudden shifts in resolved IP ranges, or frequent TTL variations. Flag repeated or rapid changes that could indicate spoofing attempts. Use historical baselines for each domain to identify anomalies. Integrate with SIEM systems for correlation with other network events. Reduce false positives through contextual filtering and thresholds.

Trusted Resolver Comparison

Validate DNS responses against multiple trusted DNS resolvers to detect discrepancies. Compare response IPs and other record types for each query. Flag mismatches that could indicate man-in-the-middle or cache poisoning attacks. Maintain logs for audits and troubleshooting. Ensure monitoring occurs from multiple network locations if possible.

Alerting and Reporting

Send alerts via email, dashboards, or messaging platforms when a potential spoofing event is detected. Include domain, resolved IP, timestamp, and type of anomaly. Provide historical trend reports for each monitored domain. Integrate alerts into incident response workflows for quick action. Allow configurable severity levels to prevent alert fatigue.

Automated Mitigation

Enable automatic or semi-automatic responses to DNS anomalies. Examples include blocking suspicious IPs, reverting to a cached trusted record, or triggering firewall rules. Maintain secure logs of mitigation actions for auditing. Ensure mitigation is safe and does not disrupt legitimate traffic. Include role-based access to prevent misuse.