<p>DNS forwarders have emerged as an integral component of modern network infrastructures. These servers primarily act as entry points for DNS clients, offering functionalities such as caching, load balancing among upstream recursive resolvers, and access control enforcement, without performing recursive resolution. However, when forwarders store unverified, injected records for arbitrary domain names, they become vulnerable to man-in-the-middle attacks. Existing security measures, such as DNSSEC and entropy-increasing techniques, exhibit limitations in safeguarding forwarders against cache poisoning attacks. This study introduces an innovative approach to mitigate cache poisoning attacks targeting DNS forwarders by leveraging a redactable signature scheme integrated with certificateless technology. The proposed framework involves three main processes: key generation, signature creation, and verification. The signature creation is carried out by authoritative servers, which transforms domain names and IP addresses into a boolean formula and an equivalent matrix. The DNS forwarder is tasked with verifying the signatures and caching only those resource records that pass the verification process. A detailed security analysis is conducted to evaluate the scheme’s robustness against forgery, as well as its ability to ensure privacy and transparency. Comprehensive experimental results validate the practicality, efficiency, and adaptability of the proposed solution.</p>