How to fix WARNING: POSSIBLE DNS SPOOFING DETECTED! in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 431 views

This SSH warning appears when the host key for a remote server doesn't match the stored fingerprint in your known_hosts file, which can indicate DNS spoofing, server changes, or IP address reuse. Usually this is benign but requires verification.

Quick fix

Fixes WARNING: POSSIBLE DNS SPOOFING DETECTED!

ssh user@hostname
# or
ssh user@192.168.1.100
  1. Verify the hostname and IP address you are connecting to
  2. Compare the displayed fingerprint with server documentation
  3. Remove the old host key from known_hosts (Recommended)
  4. Connect to the server and accept the new host key
ssh — error
ssh user@hostname
# or
ssh user@192.168.1.100
WARNING: POSSIBLE DNS SPOOFING DETECTED!

What this error means

When you connect to an SSH server, your client stores the server's host key fingerprint (ECDSA) in ~/.ssh/known_hosts. On subsequent connections, SSH verifies the current key matches the stored fingerprint. If the fingerprint doesn't match, SSH displays this warning because either: (1) you're connecting to a different server (legitimate), or (2) a man-in-the-middle attack is occurring (malicious). The warning is SSH's security mechanism to detect potential DNS spoofing or host key tampering.

Typical symptoms

  • SSH connection blocked with warning message before authentication
  • Connection hangs or requires manual intervention to proceed
  • Message includes 'REMOTE HOST IDENTIFICATION HAS CHANGED'
  • Fingerprint mismatch shown for IP address or hostname
  • Occurs after server reinstall, IP reassignment, or OS upgrade

Common causes

  1. Server was reinstalled or replaced with a new instance at the same IP address
  2. Server underwent significant updates (OS upgrade) that regenerated SSH keys
  3. Hostname resolved to a different IP address (DNS change)
  4. Server key rotation or cryptographic algorithm change
  5. Legitimate man-in-the-middle attack or network spoofing
  6. Corrupted or manually edited known_hosts file
  7. First connection to a hostname that previously resolved to different IP

How to fix "WARNING: POSSIBLE DNS SPOOFING DETECTED!"

1Verify the hostname and IP address you are connecting to

First, confirm the SSH target is correct. Check your command:

bash
ssh user@hostname
# or
ssh user@192.168.1.100

If you're unsure about the target, contact your system administrator to confirm the expected IP address and that the server was recently replaced or updated.

2Compare the displayed fingerprint with server documentation

SSH will show the server's new fingerprint in the warning message. Compare this fingerprint with the published SSH key fingerprints from your server provider or administrator. Log into your server provider's console or contact your admin to retrieve the current host key fingerprint and verify it matches what SSH is reporting.

3Remove the old host key from known_hosts (Recommended)

Once you've verified the server is legitimate, remove the outdated entry using ssh-keygen (most efficient method):

bash
# For hostname
ssh-keygen -f "~/.ssh/known_hosts" -R hostname.example.com

# For IP address
ssh-keygen -f "~/.ssh/known_hosts" -R 192.168.1.100

This safely removes only the specific host entry without affecting other keys.

4Connect to the server and accept the new host key

After removing the old entry, reconnect to the server:

bash
ssh user@hostname

SSH will display the new host key fingerprint and ask if you trust it. Review the fingerprint against your documented value, then type yes to accept and store the new key in ~/.ssh/known_hosts.

5Verify the connection succeeds

Once you've accepted the new key, subsequent connections should work without warnings:

bash
ssh user@hostname

You should now connect without seeing the DNS spoofing warning.

Advanced notes

If you need to prevent this warning in legitimate scenarios where servers are frequently replaced (e.g., auto-scaling cloud environments), consider using DNSSEC with SSHFP DNS records. Servers can publish their SSH keys via SSHFP records, and SSH clients configured to use DNSSEC will validate keys against DNS instead of known_hosts, avoiding key mismatch warnings on server reinstalls. Generate SSHFP records on the server with: ssh-keygen -r $(hostname --fqdn). Another option is to use StrictHostKeyChecking=accept-new in ssh_config for automation, but only in trusted internal networks. Always keep CheckHostIP enabled (default) to detect actual DNS spoofing attacks.

Frequently asked questions

What does "WARNING: POSSIBLE DNS SPOOFING DETECTED!" mean?
ssh/known_hosts. On subsequent connections, SSH verifies the current key matches the stored fingerprint. If the fingerprint doesn't match, SSH displays this warning because either: (1) you're connecting to a different server (legitimate), or (2) a man-in-the-middle attack is occurring (malicious).
How do I fix "WARNING: POSSIBLE DNS SPOOFING DETECTED!"?
This SSH warning appears when the host key for a remote server doesn't match the stored fingerprint in your known_hosts file, which can indicate DNS spoofing, server changes, or IP address reuse. Usually this is benign but requires verification.
What causes "WARNING: POSSIBLE DNS SPOOFING DETECTED!"?
Server was reinstalled or replaced with a new instance at the same IP address Server underwent significant updates (OS upgrade) that regenerated SSH keys Hostname resolved to a different IP address (DNS change)
Is the "WARNING: POSSIBLE DNS SPOOFING DETECTED!" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading