DNS spoofing is the act of sending forged Domain Name System answers so a host resolves a domain name to the wrong IP address. Instead of reaching the intended service, the victim is quietly redirected to an attacker-controlled destination or a fake gateway that can observe, modify, or block traffic.
This matters because DNS is often the first step in connecting to web, mail, VPN, and update services. If a client trusts a false reply, an attacker can steer users to phishing sites, intercept credentials, or deliver malware from a lookalike server. In real attacks, spoofed answers may be injected on the network, produced by a compromised resolver, or enabled when routing and state-handling systems are manipulated. Defenses include DNSSEC validation, secure resolvers, cache and port randomization, encrypted DNS where appropriate, and application-layer checks such as TLS certificate verification.