The address is correct — how can the site be fake?

Because the name and the destination are two different things. The name is translated into a server address by a directory, and it's that translation that's been tampered with. This is what makes this technique different from every case where simply reading the address carefully is enough: here, reading carefully isn't enough.

What's left to protect yourself, then?

The certificate. An impostor server cannot present a valid one for a name that isn't its own, so the browser's warning is the last effective safeguard. That's the concrete reason it should never be bypassed, and why you're sometimes pushed to install a certificate: doing so disarms it.

DNS Poisoning

In plain terms

You type the correct address and land on the wrong server. Nothing about what you typed is wrong — it's the directory that has been tampered with.

Definition

DNS poisoning consists of tampering with the translation of a site name into a server address, so that a correctly typed address leads to a server controlled by a third party. It differs from typosquatting, where it is the address itself that differs: here the address is correct, and it's the destination that has changed.

How it works

Every time you open a site, your device asks a translation service for the address of the corresponding server. That reply can be tampered with at several points: in the household's router, if its administration is compromised or its settings have been changed; on the local network, by a device answering in place of the service; or through the device's own configuration, since malicious software can point it to a controlled translation service. This is what makes the technique remarkable: the displayed address stays exact, what a reader has learned to check reveals nothing, and the page can be a faithful copy. One protection nonetheless remains, and it is the only one worth counting on: the certificate. An impostor server cannot present a valid certificate for a name it doesn't own, and the browser then shows a warning. This explains an otherwise abstract instruction — never bypass such a warning — and why techniques in this family often try to get a certificate installed on the device, which removes precisely that safeguard.

Warning signs

Certificate warning on a site you normally visit without any problem
Familiar site whose appearance has changed, or asking for an unexpected reconnection
Redirects to advertising pages from several different sites
The same site displays normally over mobile data but not on your network
DNS servers changed in your router's or device's settings without your involvement

How to verify

Compare two networks: open the site in question through your phone's mobile hotspot. If the problem disappears, it comes from the network or the router, not the site. Then check the DNS servers configured in your router's interface: a value you didn't choose is a clear signal.

What to do

Change your router's admin password — often still at its factory default — and keep its firmware up to date, since changing its settings is the most common route in. Never install a certificate requested by a site or a network. Never bypass a certificate warning; it's the protection still standing once everything else has been fooled.

If it already happened

Restore the router's network settings, change its admin password, and update it. From another network, change the credentials entered during the period concerned and close open sessions. Check that no unknown certificate has been added to your devices. Report the incident to the relevant authority.

Frequently asked questions

The address is correct — how can the site be fake?: Because the name and the destination are two different things. The name is translated into a server address by a directory, and it's that translation that's been tampered with. This is what makes this technique different from every case where simply reading the address carefully is enough: here, reading carefully isn't enough.
What's left to protect yourself, then?: The certificate. An impostor server cannot present a valid one for a name that isn't its own, so the browser's warning is the last effective safeguard. That's the concrete reason it should never be bypassed, and why you're sometimes pushed to install a certificate: doing so disarms it.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

Also known as: DNS spoofing, DNS hijacking, DNS cache poisoning, DNS spoofing attack.

This article is part of the Network and Wi-Fi attacks family. Last updated: 2026-09-03.