How DNSSEC validation stops forged answers
Spoofed replies rejected. A forged reply must carry a valid cryptographic signature to be accepted. Attackers cannot produce one, so a spoofed answer is dropped before it ever reaches your device.
Poisoned caches detected. A bogus record planted in a cache fails signature verification too, so it is never served — the honest record from the real source is used instead.
Tampering in transit blocked. Encrypted DoH, DoT and DoQ transport seals the answer in transit, so no one on the network can read or rewrite it between the server and your device.
Authentic answers, end to end. You receive an answer that is both unmodified (DNSSEC) and unreadable to outsiders (encryption) — two independent layers that close the spoofing attack surface.
Spoofing vs cache poisoning — two faces of the same threat
The two are often lumped together, but they are distinct attacks. AEU DNS defends against both.
DNS spoofing = a forged reply. The attacker races your real server: a fake answer arrives before the legitimate one, and your browser trusts it. It is a race against the reply.
Cache poisoning = a planted lie. The attacker tricks a DNS cache into storing a wrong record, so every later user of that cache is silently redirected until the entry expires.
DNSSEC defeats both. Because every record carries a signature, neither a forged reply nor a planted record can pass validation — the attack fails before it can redirect anyone.
Validation and encryption — on by default
AEU DNS validates DNSSEC signatures and carries every query over encrypted DoH/DoT/DoQ transport from the moment you connect, with no setting to toggle. It is a privacy-first European filtering forwarder: it filters ads, trackers and malware, then forwards your query upstream — and never stores logs by design.
Stop DNS spoofing in two minutes
Create a free account, get your DNS profile and a personal certificate, and copy-paste one configuration onto any device.
Create your accountKeep exploring
Start from the AEU DNS home page, or read how encrypted DNS works for a plain-language walk-through of how encrypted DNS protects you. See how GDPR-compliant DNS adds a privacy-first European DNS layer.
Frequently asked questions
What is DNS spoofing?
DNS spoofing is when an attacker forges a fake DNS reply and gets it to your device before the real one arrives. Your browser trusts the fake answer and connects to a phishing page or a malware server, even though the address you typed looks correct.
What is DNS cache poisoning?
Cache poisoning is when an attacker plants a bogus DNS record inside a DNS cache. Every device using that cache then receives the wrong address for a domain until the poisoned entry expires, silently redirecting many users at once.
How does DNSSEC stop these attacks?
DNSSEC adds a cryptographic signature to every DNS record. A forged reply or a planted record cannot produce a valid signature, so it fails verification and is rejected. Only an authentic, unmodified answer is accepted.
Is AEU DNS a DNS resolver?
No. AEU DNS is a privacy-first filtering forwarder: it filters ads, trackers and malware, validates DNSSEC, then forwards each query to an upstream resolver over encrypted transport. It never stores logs by design.
Does DNSSEC alone stop someone from tampering with my queries?
DNSSEC proves an answer is authentic, but it does not encrypt the query. To stop tampering and eavesdropping in transit you also need encrypted transport — exactly what AEU DNS provides via DoH, DoT and DoQ alongside DNSSEC validation.