DNS spoofing
A fake DNS answer wins. Cache poisoning is the recursive version. Logging and resolver choice matter.
DNS spoofing is an answer that did not come from the real authority: on the path, from a resolver you should not have used, or stuffed into a recursive cache. The client then talks to the wrong address with a name that still looks right. Generic spoofing is a separate page; this is the DNS flavour.
DNSSEC validation stops forged data at a validating resolver. Encrypted transports stop casual on-path tampering. Neither helps if you asked a resolver that is itself lying. Log queries and answers. Notice names that resolve to unexpected networks. Do not treat a successful lookup as proof the name is theirs.
See also: Spoofing, DNS, DNSSEC, DNS over HTTPS and DNS over TLS.