The attacker did not fake any DNS records. They re-routed traffic to the legitimate IP addresses.