One defense from the Web application side is to verify that the HTTP host header is correct; however, there are attacks to circumvent this as well, depending on which Web browser the victim is using. Users will likely always be vulnerable to anti-DNS pinning until the browsers (and other client-side components such as Flash) fix the issue.
If I'm the owner of a Web application, say Gmail, the best way to protect my users from the effects of anti-DNS pinning attacks is to eliminate cross-site request forgery (CSRF or XSRF) vulnerabilities in my application. While this doesn't prevent anti-DNS pinning itself, it prevents an anti-DNS pinning attack from being able to target users of my particular Web application.
-- Chris Eng, director of security services at Veracode, contributed to this response.
This was first published in December 2007