DCPsolver: Enhancing DNS Cache Poisoning Defenses with Resolver-Based SmartNICs

The Domain Name System (DNS) is a critical component of the internet infrastructure, yet it remains vulnerable to DNS Cache Poisoning (DCP) attacks, which can mislead users by redirecting them to malicious websites. Although various countermeasures have been proposed to safeguard DNS infrastructure, they predominantly address off-path attacks, leaving DNS resolvers susceptible to on-path attacks, and often face challenges in widespread adoption due to impractical deployment requirements. To address these shortcomings, we present a novel solution leveraging Smart Network Interface Cards (SmartNICs) to detect and mitigate both on-path and off-path DCP attacks in real-time. Our approach operates exclusively within recursive DNS resolvers, independent of existing DNS protocols and infrastructure, thereby enhancing practicality and deployability. The proposed methodology was rigorously evaluated using a comprehensive, recently-released dataset of DCP attacks. Results demonstrate that the SmartNIC-based solution accurately identifies and mitigates both attack types while efficiently leveraging hardware resources. Indeed, the approach detailed herein offers a practical, effective, and efficient solution for enhancing DNS security without the need for a widespread infrastructure overhaul.