Intercept and Inject: DNS Response Manipulation in the Wild

Yevheniya Nosyk*, Qasim Lone, Yury Zhauniarovich, Carlos H. Gañán, Emile Aben, Giovane C.M. Moura, Samaneh Tajalizadehkhoob, Andrzej Duda, Maciej Korczyński

*Corresponding author for this work

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

620 Downloads (Pure)


DNS is a protocol responsible for translating human-readable domain names into IP addresses. Despite being essential for many Internet services to work properly, it is inherently vulnerable to manipulation. In November 2021, users from Mexico received bogus DNS responses when resolving It appeared that a BGP route leak diverged DNS queries to the local instance of the k-root located in China. Those queries, in turn, encountered middleboxes that injected fake DNS responses. In this paper, we analyze that event from the RIPE Atlas point of view and observe that its impact was more significant than initially thought—the Chinese root server instance was reachable from at least 15 countries several months before being reported. We then launch a nine-month longitudinal measurement campaign using RIPE Atlas probes and locate 11 probes outside China reaching the same instance, although this time over IPv6. More broadly, motivated by the November 2021 event, we study the extent of DNS response injection when contacting root servers. While only less than 1% of queries are impacted, they originate from 7% of RIPE Atlas probes in 66 countries. We conclude by discussing several countermeasures that limit the probability of DNS manipulation.
Original languageEnglish
Title of host publicationPassive and Active Measurement - 24th International Conference, PAM 2023, Proceedings
EditorsAnna Brunstrom, Marcel Flores, Marco Fiore
Number of pages18
ISBN (Print)9783031284854
Publication statusPublished - 2023
Event24th International Conference on Passive and Active Measurement, PAM 2023 - Virtual, Online
Duration: 21 Mar 202323 Mar 2023

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume13882 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference24th International Conference on Passive and Active Measurement, PAM 2023
CityVirtual, Online


  • BGP route leaks
  • DNS
  • DNS censorship
  • DNS manipulation
  • Root servers


Dive into the research topics of 'Intercept and Inject: DNS Response Manipulation in the Wild'. Together they form a unique fingerprint.

Cite this