What is the primary function of a DNS Anti-spoofing installation?

• A. To accelerate DNS resolution.
• B. To block all outbound traffic from the network.
• C. To map internal hosts to external addresses.
• D. To protect against DNS spoofing attacks.

Answer: (D)

DNS anti-spoofing is about preventing forged DNS responses from compromising where users end up. It protects the DNS resolver by proving that every reply actually corresponds to the original query and comes from a legitimate source. Techniques like matching the transaction ID and port, validating the response origin, and DNSSEC signatures help discard bogus replies. By doing so, it stops cache poisoning and redirection attacks that rely on spoofed DNS data. The other ideas—speeding up resolution, blocking all outbound traffic, or mapping internal hosts to external addresses—aren't the primary purpose of anti-spoofing; they involve different mechanisms and goals.