What Is DNS Cache & DNS Cache Poisoning and How to Flush It

November 10, 2026 By Nancy William No Comments 5 minutes

What is DNS cache? Have you heard of DNS cache poisoning? How do you flush DNS cache? This guide highlights answers to all your queries and ways to successfully execute them. 

Your browser resolves a domain name in milliseconds, and you never notice. That speed depends on a small, temporary storage layer called the DNS cache. 

However, that same layer becomes a target for one of the internet’s older attack techniques, and that is called DNS cache poisoning. This guide explains both concepts in plain technical terms, then shows you exactly how to flush the cache on any system.

What Is a DNS Cache?

A DNS cache is a temporary database that stores domain-to-IP mappings. It’s so your system does not query authoritative servers every time you visit a website. 

When a resolver receives a query, it checks the cache first. If a valid record exists, the resolver returns it immediately. If not, it performs the full lookup and stores the answer for future use.

How Does Caching Happen?

It happens at two distinct layers. 

The client-side resolver cache sits on your operating system. Windows maintains it through the DNS Client service, and you can inspect it with ipconfig /displaydns. This cache holds records your device recently queried.

The recursive resolver cache sits on the DNS server your device points to, your ISP’s resolver, a public service like 1.1.1.1, or an internal corporate server. 

This cache serves every client that queries that resolver, which makes it larger and far more consequential for security.

How TTL Controls Cache Lifetime

Every DNS record carries a Time to Live (TTL) value in seconds. 

The TTL tells the resolver how long it may keep the record before discarding it and performing a fresh lookup. A TTL of 300 means the record stays cached for five minutes, and a TTL of 86400 means it stays for a full day.

Time to Live (TTL) creates a direct trade-off. Short TTLs propagate changes faster but generate more queries to authoritative servers. Long TTLs reduce load but slow down updates. 

When you flush your DNS cache manually, you force the resolver to discard everything and start fresh.

What Is DNS Cache Poisoning?

DNS cache poisoning, also called DNS spoofing, is an attack in which someone corrupts a resolver’s cache by injecting false DNS records.

 The resolver then returns the attacker’s IP address instead of the legitimate one. It redirects users to malicious infrastructure such as phishing pages or attacker-controlled proxies.

How Does a DNS Cache Poisoning Attack Work?

DNS queries typically travel over UDP, which has no handshake. Instead, the resolver validates a response by matching three values: 

• The source IP address. 
• The destination port. 
• A 16-bit transaction ID (TXID). 

If all three match, the resolver accepts the response as legitimate.

An attacker exploiting this weakness must guess the TXID and the source port before the real authoritative server responds. 

Older resolvers used predictable TXIDs and fixed source ports, making them easy to guess. Modern resolvers randomize both, so an attacker has far more entropy to overcome.

A more efficient variant is the birthday attack. Instead of guessing a single TXID, the attacker forces the resolver to open many simultaneous queries for the same domain. 

After this, it then floods it with spoofed responses. With enough queries and responses, the probability of a collision rises dramatically, and a forged response gets accepted.

Why Cache Poisoning Still Matters

If an attacker poisons one resolver, every user behind it is affected. In 2015, attackers poisoned resolvers at Brazilian ISPs to send Boleto payment users to fake sites that stole their credentials. 

The attackers couldn’t reach those resolvers from outside the ISP’s network. So, they broke into machines inside the network and used those to send the poisoning queries.

However, the defenses are simple but not always used. They only let trusted clients make recursive queries, randomize TXID and source port values. They also deployed DNSSEC to cryptographically verify responses.

 Without DNSSEC, a resolver can’t tell a forged record from a real one if the attacker wins the race.

How to Flush DNS Cache

Flushing the cache clears stale or corrupted records and forces the resolver to fetch fresh answers. 

CISA recommends flushing as a countermeasure against poisoned DNS lookups, though it notes that flushing destroys forensic artifacts. So, capture the cache first if you are investigating an incident. 

Here’s how to flush DNS cache: 

Flush DNS Cache on Windows

Here’s how to flush cache DNS on Windows:

• Open Command Prompt and run:

text

ipconfig /flushdns

• You should see: “Successfully flushed the DNS Resolver Cache.” 
• For a Windows DNS server, use PowerShell:

text

Clear-DnsServerCache

Flush DNS on macOS

The command depends on your macOS version: 

• For macOS 10.10.4 and later, run:

text

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

• Enter your password when prompted.

Linux

• Most modern distributions use systemd-resolved:

text

sudo resolvectl flush-caches

• If your system uses nscd instead, restart the service:

text

sudo systemctl restart nscd

For dnsmasq

text

sudo systemctl restart dnsmasq

• Confirm the cache cleared with sudo systemd-resolve –statistics
• Check that “Current Cache Size” reads 0.

Frequently Asked Questions

To Conclude

Coming towards the end of this guide on “What is DNS” you know everything about it and also how to flush DNS cache.

The DNS cache exists to make resolution fast, and it works. DNS cache poisoning exploits the trust the resolver places in cached records: if an attacker can inject a false mapping, every user behind that resolver connects to the wrong destination.

Flushing the cache clears the damage on your device, but it does not close the vulnerability. Restrict recursion, randomize query identifiers, and deploy DNSSEC. Those three steps remove the conditions poisoning requires.