A stub client asks its recursive resolver to resolve secure-bank.example. The resolver has no answer cached, so it forwards the query to the domain's authoritative server and waits — tagging the query with a 16-bit transaction ID (QID) that the real answer must echo back.
An off-path attacker who can't see that QID races the real answer: it floods the resolver with forged UDP responses, each guessing a different QID and source port, spoofing the authoritative server's IP (the classic Kaminsky attack). If a forged packet's QID happens to match before the genuine reply arrives, the resolver accepts it and caches the attacker's IP for the record's TTL — every user asking that resolver is now sent to the attacker (pharming), including anyone trying to reach the bank.
DNSSEC closes this hole cryptographically, not by hiding the QID better. Each zone signs its records (RRSIG) with a key whose authenticity is vouched for by the parent zone, forming a chain of trust: root → .example TLD → secure-bank.example. A validating resolver checks that chain on every answer; a forged response has no valid signature for the zone's key, so it fails verification and is discarded, no matter how fast the attacker races the real reply.
- DNSSEC toggle — off: the resolver trusts the first response whose QID matches. On: every response must carry a signature that verifies against the root→TLD→domain chain.
- Launch spoofing attack — fires a burst of forged responses from the attacker at the resolver at the same moment the real query goes out to the authoritative server.