Some clients of TPNQM SA were redirected to a malicious site when they tried to access the TPNQM main site. Bob, a system administrator at TPNQM SA, found that they were victims of DNS Cache…

Security agents on client machines cannot prevent DNS cache poisoning because the attack occurs at the DNS resolver or server level, before the client ever receives a response.

DNSSEC (DNS Security Extensions) uses public-key cryptography to digitally sign DNS records, allowing resolvers to verify the authenticity and integrity of DNS responses. This prevents an attacker from injecting forged DNS records into a resolver's cache. It directly addresses the attack vector of DNS Cache Poisoning at the protocol level.

Double-factor authentication protects user login credentials but has no mechanism to detect or prevent manipulation of DNS cache records.

Client awareness cannot stop DNS cache poisoning because the attack is transparent to users and occurs entirely within the DNS infrastructure, not through user action.