DNS poisoning primarily results in wrong responses from which component?

• A. The local DNS resolver cache
• B. Root DNS servers
• C. Authoritative DNS servers
• D. DNS forwarders

Answer: (A)

DNS poisoning works by tricking the local DNS resolver into storing a false mapping of a domain name to an IP address. When a user asks for a domain, the recursive resolver evaluates the request and caches the answer it receives. If an attacker can inject a spoofed, seemingly legitimate response during the query window, the resolver may store that malicious IP in its cache. Later requests for the same domain are answered from the resolver’s cache with the incorrect IP, sending the user to the attacker’s site instead of the legitimate one. The TTL controls how long that poisoned entry stays in the cache, so the incorrect result can persist until it expires.

Root DNS servers and authoritative servers hold source-of-truth data for domains, and poisoning them would require compromising those upstream systems themselves, which is far more difficult and would affect services globally. DNS forwarders simply relay queries to upstream resolvers; poisoning them is not the typical mechanism by which end users receive wrong answers—the user-facing impact most often comes from the poisoned cache in the local resolver.