# Dan Kaminsky

> 1979–2021 · Security Researcher
>
> **Recorded contribution:** DNS cache poisoning discovery; Internet security; Black Hat presentations

## How to use this dossier

Read for a causal chain, not a hero story: inherited problem → contribution → mechanism → downstream capability → limit. Then close the page and complete the reconstruction exercise from memory.

## 1. Historical orientation

American security researcher Dan Kaminsky became widely known in 2008 after independently discovering a practical way to poison DNS resolver caches at scale. He coordinated a confidential multi-vendor patch effort before public disclosure. Kaminsky also worked on penetration testing, secure protocols, and security communication until his death in 2021.

## 2. The problem inherited

DNS resolvers accepted unauthenticated responses identified by a small transaction-ID space, allowing attackers to race legitimate servers and insert false address records into shared caches.

## 3. The central contribution

Kaminsky discovered and responsibly coordinated disclosure of a broadly exploitable DNS cache-poisoning technique, prompting synchronized resolver and operating-system mitigations.

## 4. Reconstruct the mechanism

1. Force a resolver to ask repeated queries for random nonexistent names in a target domain.
2. Race forged authoritative responses against the legitimate reply with guessed transaction identifiers and source ports.
3. Include a malicious delegation or address record that the resolver will cache if the guess wins.
4. Redirect later users until cache expiration; mitigate by increasing entropy and ultimately authenticating data with DNSSEC.

## 5. What changed downstream

- A coordinated patch release raised DNS query entropy across many vendors before detailed disclosure.
- The incident became a case study in embargoed vulnerability coordination for critical Internet infrastructure.

## 6. Attribution, limits, and uncertainty

- Kaminsky did not invent DNS poisoning, source-port randomization, or DNSSEC; the advance was a practical amplification and coordinated response.
- Entropy mitigations reduce race probability but do not cryptographically authenticate answers, and disclosure decisions require balancing defender readiness with independent verification.

## 7. Reconstruction lab

In an isolated toy resolver, model a 16-value transaction ID and compare attack success before and after adding a 16-value source port. Do not target real DNS infrastructure. Plot attack success as the number of forged replies grows, and explain why adding entropy raises expected work without repairing DNS authenticity. Add caching time-to-live and calculate how one successful poisoning persists. Compare randomized ports with DNSSEC validation, separating probabilistic mitigation from cryptographic origin authentication. End with a disclosure timeline that minimizes attacker advantage while allowing heterogeneous vendors and operators to deploy a coordinated fix. Document residual risk after mitigation; increasing entropy changes attack economics but cannot justify declaring a protocol cryptographically authenticated.

## 8. Evidence trail

- [VU#800113: Multiple DNS implementations vulnerable to cache poisoning](https://www.kb.cert.org/vuls/id/800113) — CERT Coordination Center
- [Dan Kaminsky](https://en.wikipedia.org/wiki/Dan_Kaminsky) — Wikipedia contributors
- [DNSSEC](https://www.internetsociety.org/resources/deploy360/dnssec/) — Internet Society

---

*Research checked 2026-08-09. Dates, roles, and claims about living people are historical snapshots. Linked sources remain the authority; this dossier is original instructional synthesis.*