Participating ISPs include Grande Communications, a Texas telco that said it allowed NeuStar to deploy its Cache Defender appliances in its network because the threat of cache poisoning attacks is “real” and it needs to take precautions to minimize the threat.

The number of cache poisoning attacks is on the rise, experts say. The most publicized attack was in April, when a major Brazilian financial institution was hit by a malicious DNS cache poisoning attack on a leading Brazilian ISP. 

The ultimate solution to cache poisoning attacks is DNSSEC, which uses digital signatures to authenticate all DNS communications. But DNSSEC will take several years to deploy across the Internet infrastructure. Several domains including .org and .gov are deploying DNSSEC, VeriSign has promised to digitally sign the .com domain by 2011, and the U.S. federal government has announced plans to have the DNS root zone signed by the year’s end. 

Joffe says NeuStar is deploying DNSSEC, but that it is offering Cache Defender as an interim solution to the cache poisoning problem until DNSSEC is widely available.

“We have already deployed DNSSEC on our infrastructure for all of the top-level domains we operate. That’s been in place since January,” Joffe said. “The problem is that DNSSEC has not been deployed on the Internet, and it’s not going to occur in any real way until probably 2011…The reality is, as much as we may all want to be able to do DNSSEC, we are a ways from being able to do it.”