DNS Hijacking: How It Works, How to Detect It, and How to Stop It
DNS hijacking is the unauthorized alteration of DNS resolution so that traffic intended for your domain lands on infrastructure an attacker controls. It is one of the most damaging attacks a domain can suffer — because when DNS lies, everything built on it lies too: your website, your email, your API endpoints, and the certificates that vouch for them. This guide covers how DNS hijacking works, the four places it happens, how to recognize it, and how to detect and prevent it.
What Is DNS Hijacking?
DNS translates your domain name into the IP addresses, mail servers, and service endpoints the internet uses to reach you. DNS hijacking subverts that translation. Instead of your nameservers answering with your infrastructure, the answers point somewhere else — a phishing clone of your site, a mail server that intercepts your email, or a proxy that silently records everything before passing it along.
What makes DNS hijacking uniquely dangerous is its stealth. Your servers keep running normally. Your uptime monitoring shows green. But for some or all of the internet, "your domain" is now someone else's infrastructure — and with free SSL certificates issued in minutes, the imposter even gets a padlock.
The Four Types of DNS Hijacking
1. Registrar-Level Hijacking
The attacker compromises your registrar account — through credential stuffing, phishing, or social-engineering the registrar's support desk — and changes your domain's nameserver delegation. Every DNS answer for your domain now comes from nameservers the attacker runs. This is the most complete form of hijack, and it often starts with a WHOIS change (registrar transfer, removed lock, new registrant contact) hours or days before the DNS actually flips.
2. DNS Provider or Zone-Level Hijacking
The attacker gains access to the account at your DNS host and edits individual records — pointing an MX at their mail server or an A record at their web server. Because the delegation is untouched and most records stay the same, zone-level hijacks are subtler than registrar takeovers and routinely go unnoticed until damage surfaces.
3. Cache Poisoning and Resolver Hijacking
Instead of changing your records, the attacker corrupts what resolvers believe about them — injecting forged answers into recursive resolver caches, or operating rogue resolvers entirely. Your authoritative data stays intact, but users behind poisoned resolvers are steered to attacker infrastructure. DNSSEC exists to defeat exactly this class of attack by cryptographically signing your zone data.
4. Local and Router-Level Hijacking
Malware on a user's machine or a compromised home router rewrites DNS settings so the victim uses attacker-controlled resolvers. This happens outside your infrastructure entirely — you cannot prevent it, but strong HTTPS, HSTS, and DNSSEC limit what the attacker can accomplish against your users.
Real-World DNS Hijacking Incidents
DNS hijacking is not theoretical. The "Sea Turtle" espionage campaign disclosed in 2019 compromised registrars and DNS providers to hijack the domains of government and energy organizations across more than a dozen countries, harvesting credentials through look-alike login portals with valid certificates. In 2018, attackers used a BGP hijack against Amazon's Route 53 to answer DNS queries for a cryptocurrency wallet service with forged records, redirecting users to a phishing clone and stealing funds. In both cases, the victims' own servers were never breached — the DNS layer was.
Warning Signs Your DNS May Be Hijacked
A DNS record changed and nobody on your team changed it — the definitive signal, if you have monitoring in place to see it.
Your nameservers disagree with each other — some answering with old values, some with values you don't recognize.
Unexpected WHOIS changes: a registrar transfer you didn't initiate, a transfer lock that was removed, or new registrant contacts.
An SSL certificate for your domain was issued by a CA you don't use — visible in Certificate Transparency logs, and often the first public evidence of a hijack.
Users report your site looking different, asking for credentials unexpectedly, or email going missing — late-stage signs that the hijack is already being exploited.
How to Detect DNS Hijacking
Detection comes down to one discipline: continuously comparing what your DNS actually answers against what it should answer — from the outside, the way the rest of the internet sees it, on every authoritative nameserver independently. Internal change logs cannot do this; a hijacked zone edits itself without leaving entries in your ticketing system.
DNS record monitoring watches every record on every authoritative nameserver and alerts on any change, with full history of what each nameserver answered and when. Pairing it with WHOIS monitoring catches registrar-level attacks at the delegation-and-lock stage — often before the DNS itself flips. Reviewing your DNS history establishes exactly when a hijack began and what changed, which drives both incident response and recovery.
How to Prevent DNS Hijacking
Lock the domain: enable registrar lock (clientTransferProhibited), and for high-value domains ask about registry lock, which requires out-of-band verification for any delegation change.
Harden the accounts: unique passwords and hardware-key 2FA on both your registrar and DNS provider accounts — these two logins are your domain's real security perimeter.
Sign the zone: DNSSEC makes forged answers detectable by validating resolvers, neutralizing cache-poisoning attacks.
Restrict API tokens: DNS provider tokens embedded in CI/CD and infrastructure tooling should be read-only wherever possible and scoped to the zones they need.
Monitor from the outside: independent, per-nameserver monitoring is the safety net that catches whatever gets past the locks — and the only measure on this list that tells you when the others have failed.
Check Your Domain Right Now
Want to see what your DNS is actually answering — on every authoritative nameserver, with security checks for the weaknesses hijackers exploit? Run a free DNS scan — no signup required. For continuous protection, DNS Spy monitors your records, WHOIS, certificates, and nameserver health around the clock and alerts you the moment anything changes. Related reading: domain hijacking protection covers the registrar-level defenses in depth.
Related
Frequently asked questions
What is DNS hijacking?
DNS hijacking is the unauthorized change of DNS answers so that traffic for your domain reaches an attacker's servers. It happens at the registrar, at your DNS host, in resolver caches, or on a user's router. Your servers keep running normally, so the attack often goes unnoticed until users are phished or email goes missing.
How can I tell if my DNS has been hijacked?
The clearest sign is a DNS record that changed when nobody on your team changed it. Other signs are nameservers that disagree with each other, WHOIS changes you did not make, and SSL certificates for your domain issued by a CA you do not use, which show up in Certificate Transparency logs.
How do I prevent DNS hijacking?
Lock the domain with clientTransferProhibited and, for critical domains, a registry lock. Protect your registrar and DNS host accounts with unique passwords and hardware-key two-factor authentication. Sign the zone with DNSSEC, keep DNS API tokens read-only where possible, and monitor every authoritative nameserver from outside so any change alerts you.
Does DNSSEC stop DNS hijacking?
DNSSEC stops cache poisoning, because validating resolvers reject answers that are not signed with your zone's keys. It does not stop registrar or DNS account takeovers, since an attacker with account access can change records or delegation and have them signed too. Combine DNSSEC with account security, domain locks and change monitoring.
