Hacker News Reader

DNS is public traffic, on a well known port. I just have to have your network traffic go through a device I own and I can set your DNS results to anything I want, even if you specifically specify a DNS server on your end.

The easiest way is if the attacker is in the path between a DNS client (which could be your ISPs recursive server) and an authoritative server. But anytime there's caching, you have a risk of the wrong thing getting cached.

There's the Kaminsky attack, if your ISP's DNS server doesn't properly randomize query ids and source ports (and query case, for a few extra bits)

But you can also get unintentionally wrong information cached, if something flips a bit on the way, as DNS doesn't have end to end integrity.

Not directly answering re: DNS, but even if you get correct DNS results, at the IP layer there is always a risk of BGP hijacking (https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents).