Note that at that point in the attack, he had not yet gained access to the router, so he didn't control DNS yet.