DNS Spoofing Attempt Detected – Real Fix for Windows

Quick answer

Run ipconfig /flushdns as admin, then arp -a to spot duplicate IPs, then change your router's DNS to 1.1.1.1 and 8.8.8.8 manually.

Why this happens

DNS spoofing – also called DNS poisoning – is when a bad actor sends a fake DNS response before the real one arrives. Your browser or antivirus sees this mismatch and throws the warning. What's actually happening here is that someone on your local network, or malware on your machine, is intercepting DNS requests and sending you to a malicious site. This usually happens on public Wi-Fi, or when a neighbor's infected PC does ARP spoofing on your home network. I've seen this on Windows 10 and 11 after installing sketchy software that modifies the hosts file or network adapter settings.

Fix steps

1. Flush DNS cache. Open Command Prompt as admin (right-click Start, choose 'Terminal (Admin)'). Run: ipconfig /flushdns. This clears any poisoned entries stored locally. The reason step 3 works is because stale bad data gets thrown out.
2. Reset Winsock and TCP/IP stack. Run these two commands: netsh winsock reset then netsh int ip reset. Reboot afterwards. This fixes adapter-level corruption that can be used by malware to redirect traffic.
3. Check for ARP spoofing. Open Command Prompt as admin again. Run arp -a. Look for the same IP address appearing twice with different MAC addresses. That's a clear sign someone is spoofing. If you see it, your router's ARP table is poisoned. Static ARP entries can help, but the real fix is updating router firmware or isolating the bad device.
4. Change router DNS to hardcoded servers. Log into your router (usually 192.168.1.1 or 192.168.0.1). Find the DNS settings – they're usually under WAN or Internet settings. Set primary to 1.1.1.1 and secondary to 8.8.8.8. Save and reboot the router. This bypasses any DNS hijack on your network because the router itself now queries secured servers.
5. Scan for malware. Run a full scan with Windows Defender or Malwarebytes. Malware often modifies the hosts file: check C:\Windows\System32\drivers\etc\hosts with Notepad. Any line that isn't 127.0.0.1 localhost is suspicious. Delete those lines. Also check for rogue network adapters in Device Manager – look for hidden devices under 'Network adapters'. Bad software sometimes installs a fake adapter that redirects traffic.

Alternative fixes if the main steps don't work

1. Use DNSSEC. Some routers support DNS over HTTPS (DoH) or DNS over TLS (DoT). Enable it in your router's advanced settings. On Windows 11, you can set DNS over HTTPS for each network adapter: Settings > Network & Internet > Wi-Fi > Hardware properties > DNS server assignment > Edit > choose 'Manual' and turn on 'Encrypted only'. This prevents anyone from tampering with DNS responses in transit.

2. Static ARP entries. If ARP spoofing keeps happening, you can set static ARP entries for your gateway and trusted devices. Run arp -s [gateway IP] [gateway MAC] as admin. This locks the mapping so spoofed packets get ignored. Downside: if your router's MAC changes (e.g., after reboot), traffic breaks until you update it.

3. Wireshark inspection. For advanced users: install Wireshark, capture traffic on your network adapter. Filter with dns. Look for two different responses to the same query – the fake one usually arrives a few milliseconds faster. Block the source IP in your firewall.

4. Reinstall network drivers. Uninstall your Wi-Fi or Ethernet adapter from Device Manager (check 'Delete driver software'), reboot. Windows reinstalles fresh ones. This clears any rootkit that hooks the driver.

Prevention tip

Don't trust public Wi-Fi without a VPN. Use a wired connection at home if you can. Also, enable MAC address filtering on your router – only known devices can join. This won't stop a determined attacker, but it blocks random script kiddies. And always keep your router's firmware updated – old consumer routers from 2015 are easy targets for DNS spoofing.