What is DNS poisoning and how does it work?

DNS poisoning, also called DNS spoofing, corrupts the Domain Name System cache so that a domain name resolves to a malicious IP address instead of the legitimate one. The attacker injects forged DNS responses that the DNS server caches as legitimate, redirecting all future queries for that domain to the attacker's server. Users who type the correct domain name are unknowingly sent to a fake site that may steal credentials or distribute malware.