DNS Cache Poisoning? Here's the Real Fix

You're not crazy — your traffic is being hijacked.

You type a site you've visited a hundred times and get a page that looks wrong. Maybe your bank login looks off. Maybe a download link leads somewhere unexpected. I've seen this exact thing — had a client last month whose entire office couldn't reach their CRM because DNS cache poisoning redirected every request to a phishing site. The fix isn't complicated. Let's rip it out.

Step 1: Flush Your Local DNS Cache — This Kills the Current Poison

Your computer stores DNS lookups locally so it doesn't have to ask the DNS server every time. If that cache got poisoned (say from a malicious site or a compromised router), you're getting bad addresses. Flush it. Do it now.

ipconfig /flushdns

Run that as Administrator. Open Command Prompt (right-click, "Run as administrator"), type it, hit Enter. You'll see "Successfully flushed the DNS Resolver Cache."

On macOS (Big Sur or newer):

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

On Linux (systemd-resolved):

sudo systemd-resolve --flush-caches

That clears the local copy. But if the poison came from your router or ISP's DNS server, we need to cut that off at the source.

Step 2: Switch Your DNS Resolver to a Secure One

Most people use whatever DNS server their ISP hands out. ISPs are not known for security — they're known for cheap hardware and minimal staffing. Poison can happen at their level. I tell every client: stop using ISP DNS. Switch to Cloudflare (1.1.1.1) or Google (8.8.8.8). Both support DNSSEC, which cryptographically signs DNS records so you can verify they're legit.

Change it on your router (kills it for your whole network):

1. Log into your router (typically 192.168.1.1 or 192.168.0.1).
2. Find the WAN or Internet settings page.
3. Look for DNS Server — change it from "Automatic" to "Manual".
4. Set Primary to 1.1.1.1, Secondary to 1.0.0.1 (Cloudflare). Or 8.8.8.8 / 8.8.4.4 (Google).
5. Save and reboot the router.

Change it on a single PC (if you can't touch the router):

1. Open Network & Internet Settings (Windows: right-click network icon).
2. Click "Change adapter options".
3. Right-click your active connection (Wi-Fi or Ethernet), choose Properties.
4. Select "Internet Protocol Version 4 (TCP/IPv4)", click Properties.
5. Choose "Use the following DNS server addresses". Enter 1.1.1.1 and 1.0.0.1.
6. Click OK, close everything.

Now flush DNS again to be sure:

ipconfig /flushdns

Why This Works

DNS cache poisoning works by feeding your computer a fake IP address for a real domain. That fake address points to a server controlled by an attacker. When you type bank.com, you get a page that looks like your bank but steals your credentials. Flushing the cache removes those fake entries. Changing your DNS resolver ensures that new lookups go to a server that checks DNSSEC signatures — so even if someone tries to poison the query between you and the resolver, the resolver rejects the bad answer.

I've seen this happen in the wild from a compromised Linksys router model WRT54G (yes, still out there) that was infected with DNSChanger malware. It changed the router's DNS settings silently. Switching to Cloudflare on the router fixed it instantly for every device on the network.

Less Common Variations

DNS poisoning at the router level

Your router itself can be compromised. The fix: factory reset the router, update firmware, then set DNS to 1.1.1.1 before connecting any devices. Some older routers have known vulnerabilities that allow remote change of DNS settings. If you see your router's admin interface open to the internet, close that port immediately.

Man-in-the-middle DNS poisoning on public Wi-Fi

Public Wi-Fi at coffee shops can be set up by an attacker who runs a rogue DHCP server that hands out a malicious DNS server. The fix: always use a VPN when on public Wi-Fi. VPNs encrypt your DNS traffic. Or set your device to use a secure DNS resolver over HTTPS (DoH). On Windows 10/11, go to Settings > Network & Internet > Wi-Fi > Hardware properties > DNS server assignment > Edit > choose Manual, then set IPv4 to 1.1.1.1 and toggle "DNS over HTTPS" On.

Browser-level DNS over HTTPS

Some browsers (Chrome, Firefox, Edge) have their own DNS-over-HTTPS settings. If your OS-level DNS is clean but your browser still shows suspicious pages, check your browser's DNS settings. In Chrome: Settings > Privacy and security > Security > Use secure DNS > choose Cloudflare. This bypasses the system DNS entirely for web traffic.

Prevention: Keep This From Happening Again

• Use a secure DNS resolver permanently. I don't care if your ISP's DNS is fast — it's not secure. Set 1.1.1.1 or 8.8.8.8 on your router and never look back.
• Enable DNSSEC validation on your router (if it supports it). Many modern routers (Asus, Ubiquiti, some TP-Link models) have a DNSSEC option in the WAN settings. Turn it on. It adds a layer of cryptographic verification.
• Keep router firmware updated. Most DNS poisoning attacks exploit known vulnerabilities in router firmware. Check for updates every few months or enable auto-update if available.
• Use a VPN on untrusted networks. This encrypts your entire DNS chain, not just lookups. Even if the DNS server is poisoned, the encrypted channel prevents tampering.
• Monitor for unusual traffic. If you suddenly can't reach a site you visit daily, or a page loads a different certificate error than usual, flush DNS and check your DNS settings immediately.

I've walked dozens of small business owners through this exact process. It's not sexy, but it works. The real fix is two steps: flush the poison, then cut off the source. Do both and you're safe.