Every time you type a website address, your device performs a DNS lookup — translating a human-readable domain like example.com into an IP address your computer can route to. This lookup is a foundational layer of how the internet works, and it is also a high-value target for attackers. DNS hijacking manipulates this lookup process to redirect your traffic to malicious destinations without your knowledge.
The results range from credential theft and malware delivery to surveillance and censorship. Understanding the different types of DNS hijacking and how to defend against them is essential for anyone who cares about their online security.
How DNS Works (The Brief Version)
When you request yourbank.com, your device queries a DNS resolver (usually provided by your ISP or a public resolver like Google’s 8.8.8.8). The resolver checks its cache or queries authoritative DNS servers to return the correct IP address. Your browser then connects to that IP.
If any part of this chain is manipulated — the resolver’s response, the records stored by the authoritative server, or the settings on your device — you can be sent to an IP the attacker controls instead of the legitimate destination.
Types of DNS Hijacking
1. Local/Router DNS Hijacking
Attackers modify DNS settings on the victim’s router or device. This can happen through:
- Malware that changes the DNS server settings in the OS or browser
- Router exploitation via default credentials, UPnP vulnerabilities, or unpatched firmware
- Cross-Site Request Forgery (CSRF) attacks that trick a user’s browser into sending requests to the router admin interface
Once the DNS settings are changed to point to an attacker-controlled resolver, every DNS query from the network can return fraudulent results. The attacker can silently redirect facebook.com, yourbank.com, or any other domain to phishing pages.
Real example: The DNSChanger malware (2007–2012) infected millions of devices and changed their DNS settings to servers controlled by the Rove Digital cybercriminal group. Infected machines had all DNS queries answered by attacker-controlled servers that served fraudulent ads and could redirect any domain. The FBI eventually seized the malicious DNS servers and ran replacement servers to keep infected users online while remediation occurred.
2. Man-in-the-Middle DNS Hijacking
An attacker positioned between the user and their DNS resolver can intercept queries and forge responses. This is particularly effective on unsecured public Wi-Fi networks. Tools like Ettercap, dnsspoof, and Bettercap can automate this kind of attack.
Without DNS encryption (see defenses below), DNS queries are sent in plaintext over UDP port 53, making them trivial to intercept and tamper with.
3. DNS Cache Poisoning
DNS cache poisoning (also called DNS spoofing) injects malicious DNS records into a resolver’s cache. When a resolver is poisoned, every user who queries it gets the fraudulent response — not just a single victim.
The most famous demonstration was Dan Kaminsky’s DNS vulnerability disclosure in 2008, which revealed a fundamental flaw in DNS that allowed cache poisoning at scale. Most DNS implementations were patched, but improperly configured or outdated resolvers remain vulnerable. The DNSSEC standard was developed specifically to cryptographically authenticate DNS responses and prevent poisoning.
4. Rogue DNS Server / ISP-Level Hijacking
Some ISPs and governments operate DNS resolvers that intentionally return false results:
- ISP NXDOMAIN hijacking: Instead of returning a “domain not found” error, the ISP redirects non-existent domains to their own search/advertising pages
- Government censorship: National DNS resolvers block or redirect access to specific domains (common in China, Iran, Russia, and others)
- BGP hijacking combined with DNS: Attackers can combine Border Gateway Protocol (BGP) hijacking with DNS manipulation to redirect entire domain delegations
5. Authoritative DNS Hijacking
The most sophisticated attacks compromise the authoritative DNS records for a domain — the records held by the domain registrar or DNS hosting provider. If an attacker can log in to a registrar account (via credential theft, phishing, or API key compromise) and change the NS or A records, they effectively own all DNS responses for that domain globally.
Real example: The Sea Turtle campaign (documented by Cisco Talos in 2019) saw a state-sponsored threat actor compromise DNS registrars and providers to hijack DNS records for government, military, and energy organizations primarily in the Middle East and North Africa. Victims were redirected to attacker-controlled servers that performed man-in-the-middle interception of their credentials, including email and VPN logins.
Detecting DNS Hijacking
| Indicator | What to Check |
|---|---|
| Wrong IP for known domains | Use nslookup or dig to query multiple resolvers and compare results |
| SSL certificate mismatch | Browser warnings about invalid certificates when visiting familiar sites |
| Unexpected redirects | Being sent to unfamiliar pages when visiting known URLs |
| Slow DNS resolution | Attacker resolvers may be slower or return unusual TTLs |
| Router settings changed | Check DNS server fields in router admin panel |
Command to check your DNS settings on Linux/Mac:
cat /etc/resolv.conf
dig +short example.com @8.8.8.8
dig +short example.com @1.1.1.1If you get different results from different resolvers, your local resolution may be compromised.
How to Protect Against DNS Hijacking
Use Encrypted DNS
- DNS over HTTPS (DoH): Encrypts DNS queries inside HTTPS traffic, preventing eavesdropping and tampering. Supported natively in modern Firefox, Chrome, and Windows 11.
- DNS over TLS (DoT): Encrypts DNS queries over TLS on port 853. Supported by Android and many enterprise DNS clients.
- Trusted resolvers: Use reputable public resolvers like Cloudflare (1.1.1.1), Google (8.8.8.8), or Quad9 (9.9.9.9) with DoH/DoT enabled.
Enable DNSSEC
DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify that responses have not been tampered with. Ensure your domain registrar supports DNSSEC and that it is enabled for domains you control.
Secure Your Router
- Change default credentials on your router immediately
- Update router firmware regularly
- Disable remote management unless absolutely necessary
- Disable UPnP if not needed
- Set your router’s DNS to a trusted, encrypted resolver
Protect Your Registrar Account
- Use a strong, unique password and multi-factor authentication on domain registrar accounts
- Enable registrar lock (also called domain lock or transfer lock) to prevent unauthorized DNS record changes
- Set up registry lock for critical domains — this requires out-of-band verification for any changes
Monitor DNS Records
Use monitoring services (e.g., DNSlytics, SecurityTrails, or custom scripts using dig) to alert you if DNS records for your domains change unexpectedly.
The Bottom Line
DNS is the phonebook of the internet, and like any phonebook, if someone rewrites the entries, you end up somewhere you did not intend to go. DNS hijacking ranges from trivial router attacks to sophisticated nation-state operations targeting critical infrastructure. The defenses — encrypted DNS, DNSSEC, strong registrar security, and network monitoring — are well understood and increasingly easy to implement. The question is whether you implement them before an attacker exploits your gap.