What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?

The attacker begins the DNS cache poisoning attack by sending a query to a nameserver via the DNS resolver, which forces the resolver to initiate an outbound DNS lookup and enter a waiting state for the authoritative response. During this window, the attacker floods the resolver with forged responses containing a malicious IP address, attempting to match the transaction ID before the legitimate reply arrives. If successful, the poisoned record is cached and served to all subsequent users querying that domain.

Making a request to the DNS resolver describes what a legitimate end-user or victim does, not the attacker's initiating action in the poisoning sequence.

Forging a reply from the DNS resolver is a later step in the attack chain that occurs only after the attacker has already triggered a DNS resolution and is racing to respond.

DNS cache poisoning leverages UDP rather than TCP because UDP's stateless nature and predictable transaction IDs make forged responses feasible; TCP's three-way handshake makes IP spoofing and response injection far more difficult.