Domain name DNS pollution is also DNS hijacking or DNS cache poisoning, which is a malicious act of tampering with DNS resolution records. When users access domain names, they will be redirected to the wrong IP address. This attack will disrupt the normal network and cause security risks such as data leakage and malware infection overseas. To eliminate DNS pollution, multiple means of long-term protection are required.

1. Replace authoritative public DNS servers

When suffering from DNS pollution, the first measure is to replace unreliable local or ISP-provided DNS servers. It is recommended to use public DNS services with security reinforcement mechanisms.

2. Thoroughly clear DNS caches at all levels

Contaminated records often reside in the cache and need to be cleaned up in layers:

1. Local operating system cache:

Windows: `cmd` executes `ipconfig /flushdns`

Linux (systemdresolved): `sudo systemdresolve flushcaches`

macOS: `sudo killall HUP mDNSResponder`

2. Browser cache: Chrome, Firefox, etc. need to clear DNS Cache and Cookies in the settings

3. Router cache: Restart the router or log in to the management interface to clear DNS records

4. Recursive server cache: If the enterprise builds its own DNS (such as Bind, Unbound), you need to restart the service or execute

rndc flush

3. Deploy DNS encryption protocol

Traditional DNS queries use plaintext UDP transmission, which is easy to be hijacked. Encryption protocols can ensure query integrity:

DNS over HTTPS (DoH): Encrypted transmission via port 443.

DNS over TLS (DoT): Use TLS encryption on port 853, suitable for global deployment of routers.

DNSCrypt: Establish an encrypted channel with a trusted resolver through `dnscryptproxy`, and support certificate verification.

Mainstream browsers (Chrome/Firefox) all have built-in DoH switches, and Windows 11 can enable encryption in "Network Settings> DNS Options".

4. Use network tunneling technology to bypass pollution

When regional DNS pollution is serious, it is necessary to circumvent it through tunnels:

Private network services: Encrypt all traffic (including DNS), and use clean DNS for exit nodes. Choose a service provider with a no-logging policy.

Proxy server: HTTP/SOCKS5 proxy can isolate DNS queries, and Shadowsocks/ and other services support anti-pollution mode.

Tor network: The query source is hidden through multiple layers of relays, but the latency is high, which is suitable for sensitive scenarios.

5. Directed resolution of Hosts files

Emergency correction for key domain names Get the correct IP: Execute `dig example.com @1.1.1.1` through an overseas VPS or use an online DNS checker. Edit Hosts file:

Windows: `C:\Windows\System32\drivers\etc\hosts`

Linux/macOS: `/etc/hosts`

Add record

192.0.2.1 example.com (requires administrator privileges to save)

This method is only suitable for a small number of domain name maintenance, and needs to be manually updated as the IP changes.

6. Enable HTTPS and certificate verification

Even if the DNS is polluted, HTTPS can block content tampering. Deploy HSTS policy, force browsers to establish TLS connections, and enable certificate pinning (HPKP) to prevent attackers from using forged certificates. When users visit, they need to confirm that the address bar is `https://` and the certificate is valid. Browser extensions (such as HTTPS Everywhere) can assist in encrypted access.

7. System and network security reinforcement

Eradicate the source of pollution and prevent recurrence:

Full disk antivirus scan using Malwarebytes, Kaspersky and other tools to remove DNS hijacking Trojans (such as DNSChanger). Update patches to fix DNS-related vulnerabilities in operating systems and router firmware (CVE202144228, etc.). Firewall rules block access requests to external malicious DNS servers (such as known IPs). Permission control includes limiting access to the router management interface and disabling vulnerable protocols such as WPS.

Regularly verify the resolution results through `nslookup` or online tools (such as BOCE); the business system recommends deploying a local recursive resolver (Unbound+DNSSEC verification) to reduce external dependence; enterprise-level scenarios can enable EDNS Client Subnet to improve resolution accuracy. When pollution involves force majeure such as national firewalls, the compliance of the tunnel solution needs to be evaluated. The comprehensive application of the above measures can systematically remove pollution and build an anti-pollution DNS architecture to ensure the authenticity and security of network access.