How to Detect DNS Pollution? Domain Resolution Anomalies and Troubleshooting Methods

For the same domain, overseas access works fine, but some regions in China cannot open it; switching to a different network restores access; and querying with different DNS servers returns completely different IPs. In such cases, many people's first reaction is to check the server, CDN, or website code, but if the origin server is running normally, the problem is likely at the domain resolution layer.

DNS pollution is difficult to troubleshoot because its symptoms are similar to ordinary DNS failures, cache not updated, and CDN smart routing. Simply pinging once from your own computer or switching to a public DNS resolver makes it hard to determine which part is actually failing.

A more reliable approach is to start with multi-region resolution results, then verify layer by layer using authoritative DNS, IP ownership, and actual network conditions. Below, we explain in detail how to detect DNS pollution and the order in which to troubleshoot domain resolution anomalies.

1. What is DNS Pollution?

Normally, when a user visits a domain, the device first converts the domain into an IP address that servers can recognize through a DNS query.

The general process is:

User visits domain
      ↓
Local DNS / Recursive DNS
      ↓
Query authoritative DNS
      ↓
Return correct IP
      ↓
Connect to website server

DNS pollution occurs during this resolution process.

When a DNS query receives an abnormal, incorrect, or forged resolution result, the user may not get the IP address that the website should actually use. As a result, even if the server and website code are running normally, users may be unable to access the site because they are directed to the wrong address.

For example, a domain should normally resolve to:

203.0.113.10

But some network environments return:

198.51.100.25

If this IP does not belong to the origin server, the current CDN, or any other legitimate business node, further investigation into the DNS resolution process is needed.

Note that different resolution results do not directly equate to DNS pollution. Many websites now use CDN, GeoDNS, or smart resolution, so it is common for different regions to return different IPs. What really matters is whether those IPs fall within the expected business scope.

2. What Situations May Indicate DNS Pollution?

DNS pollution does not have a fixed browser error page; it often manifests as "different results in different places." During troubleshooting, the following situations are worth noting.

1. Significant Differences Between Domestic and Overseas Resolution Results

If multiple overseas nodes resolve to the correct server or CDN address, but some domestic regions consistently return completely unrelated IPs, further verification is needed. For example:

Assuming the 198.51.100.x range does not belong to the current business, the Shanghai and Guangzhou nodes are clear anomalies.

2. Different ISPs Return Completely Unrelated IPs

Sometimes a domain resolves correctly on China Telecom's network, but returns unfamiliar IPs on China Unicom or China Mobile.

If the website does not have ISP-based smart routing configured, and these abnormal IPs are unrelated to the origin server or CDN, the corresponding network environment should be investigated.

3. Overseas Access Works, but Some Domestic Regions Cannot Access

This situation is often immediately attributed to DNS pollution, but that conclusion should not be drawn too quickly.

Besides DNS issues, other possibilities include:

• CDN node failure

• Network routing issues

• Domain access restrictions

• TLS or HTTPS configuration problems

• IPv6 resolution anomalies

Therefore, overseas normal and domestic abnormal only indicates "regional differences in the problem," and you still need to examine the DNS return results.

4. Repeated Abnormal Resolution for the Same Domain

If multiple queries from the same region consistently return a clearly incorrect IP, while authoritative DNS and other regions return normal results, this is more concerning than a one-off anomaly.

Conversely, if different IPs all belong to the same CDN's normal nodes, it should not be simply judged as pollution.

3. How to Detect DNS Pollution?

Testing only from your own machine provides very limited information. DNS pollution often shows clear regional and network differences, so multi-node detection is more valuable.

You can use Chahu's DNS Pollution Detection feature:

https://www.chahu.com/pollution

On the page, enter the main domain to test, for example:

example.com

You do not need to enter the full URL:

https://www.example.com/page/

Because this tests domain resolution, not the webpage itself.

After submitting the test, the focus is not just on the result from a single node, but on observing whether there are significant differences between regions.

When reviewing the results, pay attention to two questions:

First, which regions return normal IPs?

Normal IPs should typically belong to your origin server, CDN, or known business nodes.

Second, are there regions returning completely unfamiliar addresses?

If most nodes return normal results, but only a few regions consistently show abnormal IPs, it is worth recording those regions for further verification.

Here is an important judgment principle:

DNS pollution detection looks for "abnormal resolution," not "whether IPs are exactly the same."

For websites using CDN, it is perfectly normal for Beijing, Shanghai, and Singapore to return three different IPs. What you should really be wary of is an IP that does not belong to the current CDN, origin server, or other expected network.

4. How to Further Confirm DNS Pollution?

After detecting anomalies through multi-node testing, it is not advisable to jump to conclusions. It is best to perform several cross-validations.

1. Compare Query Results from Different DNS Servers

On Windows, you can use nslookup:

nslookup example.com 223.5.5.5

Then try other DNS servers:

nslookup example.com 8.8.8.8

Or:

nslookup example.com 1.1.1.1

Then compare the returned IPs.

If different DNS servers return completely different addresses, it indicates that resolution results do differ, but this alone is not enough to determine pollution.

Because mechanisms like CDN, smart DNS, and ECS may return different nodes based on the query source.

What you really need to confirm is: Do all these returned IPs belong to legitimate business?

If one DNS returns a normal CDN node, while another consistently returns a completely unrelated address, that is more suspicious.

2. Compare with Authoritative DNS Results

Compared to comparing two public DNS servers, directly checking the authoritative DNS is more valuable.

First, find the domain's current Name Servers, then confirm the resolution result with the authoritative DNS.

If the authoritative DNS returns:

example.com → 203.0.113.10

While a regional recursive DNS has long been returning:

example.com → 198.51.100.25

And this address is clearly not part of legitimate business, the problem is more likely in the resolution chain after the authoritative DNS.

3. Repeat Tests from Multiple Regions

A single abnormal result could be due to cache, node failure, or a brief network fluctuation.

Therefore, it is best to repeat the test after some time, especially observing:

• Is it always the same region that is abnormal?

• Is it concentrated in the same ISP?

• Is the abnormal IP consistent?

• Are overseas and authoritative DNS always normal?

If the anomaly persists over time, it has much higher diagnostic value than a single result.

5. What Are the Differences Between DNS Pollution, DNS Hijacking, and Ordinary Resolution Failure?

These concepts are often mixed up in troubleshooting, but their manifestations are not the same.

The most easily misjudged is CDN smart routing.

For example, after a website integrates with CDN, it may show:

Beijing → 192.0.2.10
Shanghai → 192.0.2.20
Singapore → 192.0.2.30

Three different IPs do not mean DNS pollution; as long as they all belong to normal CDN nodes, this is normal routing. So when judging, do not just ask: "Why are the resolution results different?" Instead, ask: "Are these the addresses I should be getting?"

6. How to Determine If It's Just DNS Cache Not Updated?

When a domain has just had its resolution changed, cache issues are most easily mistaken for pollution.

For example, the original A record was:

192.0.2.10

Later changed to:

192.0.2.20

For a period after the change, some regions may return the new IP while others still return the old IP. This is likely just the TTL cache not having fully expired.

You can look at a few details to judge.

If the abnormal result happens to be the old IP before the change, rather than a completely unfamiliar address, then DNS cache should be considered first.

Also check:

• When was the DNS record changed?

• What is the TTL setting?

• Have you recently changed Name Servers?

• Are multi-node results gradually switching from old to new IP?

Generally, cache updates tend to become more consistent over time.

In contrast, DNS pollution more commonly returns an IP that is neither the current IP nor a previously configured old IP, but a completely unrelated address.

7. After Detecting DNS Anomalies, How to Continue Troubleshooting?

Once you find resolution anomalies, do not rush to modify server configurations. DNS issues should be investigated down the resolution chain.

1. First Confirm Your Own DNS Configuration Is Correct

Check the domain's current:

• A

• AAAA

• CNAME

• NS

Make sure the records themselves are not incorrect.

Especially for websites that have both IPv4 and IPv6 enabled, a normal A record does not guarantee a normal AAAA record. If some users prefer IPv6, an incorrect AAAA record can also cause access failures.

2. Confirm Whether the Abnormal IP Is a CDN Node

Many so-called "unfamiliar IPs" turn out to be CDN routing nodes.

You can use IP lookup and ASN information to confirm whether the IP belongs to the CDN or cloud provider you are using.

If it belongs to the expected network, it should not be treated as pollution.

3. After DNS Is Normal, Check the Access Layer

If DNS resolution is normal across multiple regions, but the website is still inaccessible in some areas, the problem is likely no longer in DNS.

Then continue to check:

• Whether ports 80/443 are reachable

• Whether HTTPS handshake is normal

• HTTP status codes

• Routing path

• Whether the domain has access restrictions

This avoids repeatedly fiddling with resolution records when DNS is already normal.

4. Save Anomaly Detection Results

If the problem is concentrated in certain provinces or ISPs, it is recommended to record:

• Detection time

• Abnormal regions

• Normal IP

• Abnormal IP

• DNS servers used

• Multiple test results

Later, whether you contact the DNS provider, CDN, or network operator, this information is more helpful for locating the problem than simply saying "the website is down."

8. Common Misjudgments in DNS Pollution Detection

1. CDN Returns Multiple IPs

This is the most common misjudgment. As long as these IPs belong to the normal CDN network, different regions returning different nodes is normal.

2. DNS Just Changed

When old and new resolutions coexist, prioritize TTL and cache propagation rather than directly judging pollution.

3. IPv4 Normal but IPv6 Abnormal

Some devices prefer IPv6. If the AAAA record is incorrect, it may cause "some people can open it, some cannot."

When troubleshooting, it is best to check A and AAAA records separately.

4. Only One Computer Has Access Issues

If other devices on the same network can access normally, but only one computer has problems, first check: local DNS cache; hosts file; browser proxy; router DNS; local network settings, etc. This situation is usually not enough to indicate large-scale DNS pollution.

The most important point in DNS pollution troubleshooting is not to immediately conclude "resolution is polluted" just because you see different IPs. For websites that heavily use CDN and smart DNS, it is very normal for different regions to return different nodes. What really deserves attention is: whether certain regions consistently return abnormal addresses that do not belong to the origin server, CDN, or legitimate business scope.

When encountering domain resolution anomalies, you can first use Chahu's DNS pollution detection to view resolution differences across regions, then cross-validate with public DNS, authoritative DNS, and IP ownership. If you find that it is just an old IP that has not refreshed, it is more likely a TTL cache issue; if DNS itself is completely normal, the troubleshooting focus should move to TCP, HTTPS, and network routing layers. Confirming layer by layer in this order is usually more effective than immediately changing DNS, switching servers, or replacing CDN.

FAQ

Q1: Why does the detection tool prompt "resolution anomaly" right after I switched to CDN?

A: It is likely a false positive. CDN works by using GeoDNS to assign node IPs based on user location, so it is perfectly normal for users in Beijing, Shanghai, Guangzhou, or even overseas to get different IPs. As long as those IPs belong to the network range of your CDN provider, it is normal routing and not DNS pollution.

Q2: I just changed the A record of my domain, but some regions still access the old IP. Is this DNS pollution?

A: This is not DNS pollution, but a typical DNS cache not refreshed (TTL not expired). Each ISP's recursive DNS has its own cache update cycle. After you change the resolution, some places may return the new IP quickly, while others will return the old IP until the TTL expires. Usually, after waiting from 10 minutes to 24 hours, the caches will update and become consistent.

Q3: After detecting DNS pollution, is it useful to just change my local DNS to 8.8.8.8 or 114.114.114.114?

A: The effect is very limited. Because ordinary public DNS (like 114 or 8.8.8.8) uses UDP port 53, DNS query packets can still be intercepted and forged at the egress gateway. To mitigate or resolve this on your local machine, it is recommended to enable encrypted transport like DoH (DNS-over-HTTPS) or DoT (DNS-over-TLS), which sends queries through an encrypted HTTPS tunnel to prevent tampering.

Q4: Can incorrect AAAA record configuration for a website behave like DNS pollution?

A: Yes. Many mobile devices and broadband networks now prefer IPv6 by default. If you only configured the correct IPv4 (A record) but the IPv6 (AAAA record) is wrong or unreachable, you may see the strange phenomenon where "some devices can open it, but others cannot load it at all." When troubleshooting, be sure to test A and AAAA records separately with tools.

Q5: Are there any free tools to quickly check DNS resolution across the country?

A: For cross-region resolution issues, single-machine testing is basically useless. It is recommended to use multi-node testing tools: Chahu DNS Pollution Detection, which is specifically designed for comparing nodes for domain resolution pollution and regional resolution anomalies.