Defence

DNSSEC

Digital signatures on DNS answers, so a resolver can tell a genuine record from a forged one.

DNSSEC lets domain owners sign their DNS records and resolvers verify the chain of signatures back to the DNS root. It stops forged answers such as cache poisoning, but it does not encrypt lookups.