Detecting user dns being tampered with