DNS Hijacking: How It Works, How to Detect It, and How to Stop It
DNS hijacking is the unauthorized alteration of DNS resolution so that traffic intended for your domain lands on infrastructure an attacker controls. It is one of the most damaging attacks a domain can suffer — because when DNS lies, everything built on it lies too: your website, your email, your API endpoints, and the certificates that vouch for them. This guide covers how DNS hijacking works, the four places it happens, how to recognize it, and how to detect and prevent it.
What Is DNS Hijacking?
DNS translates your domain name into the IP addresses, mail servers, and service endpoints the internet uses to reach you. DNS hijacking subverts that translation. Instead of your nameservers answering with your infrastructure, the answers point somewhere else — a phishing clone of your site, a mail server that intercepts your email, or a proxy that silently records everything before passing it along.
What makes DNS hijacking uniquely dangerous is its stealth. Your servers keep running normally. Your uptime monitoring shows green. But for some or all of the internet, "your domain" is now someone else's infrastructure — and with free SSL certificates issued in minutes, the imposter even gets a padlock.
The Four Types of DNS Hijacking
1. Registrar-Level Hijacking
The attacker compromises your registrar account — through credential stuffing, phishing, or social-engineering the registrar's support desk — and changes your domain's nameserver delegation. Every DNS answer for your domain now comes from nameservers the attacker runs. This is the most complete form of hijack, and it often starts with a WHOIS change (registrar transfer, removed lock, new registrant contact) hours or days before the DNS actually flips.
2. DNS Provider or Zone-Level Hijacking
The attacker gains access to the account at your DNS host and edits individual records — pointing an MX at their mail server or an A record at their web server. Because the delegation is untouched and most records stay the same, zone-level hijacks are subtler than registrar takeovers and routinely go unnoticed until damage surfaces.
3. Cache Poisoning and Resolver Hijacking
Instead of changing your records, the attacker corrupts what resolvers believe about them — injecting forged answers into recursive resolver caches, or operating rogue resolvers entirely. Your authoritative data stays intact, but users behind poisoned resolvers are steered to attacker infrastructure. DNSSEC exists to defeat exactly this class of attack by cryptographically signing your zone data.
4. Local and Router-Level Hijacking
Malware on a user's machine or a compromised home router rewrites DNS settings so the victim uses attacker-controlled resolvers. This happens outside your infrastructure entirely — you cannot prevent it, but strong HTTPS, HSTS, and DNSSEC limit what the attacker can accomplish against your users.
Real-World DNS Hijacking Incidents
DNS hijacking is not theoretical. The "Sea Turtle" espionage campaign disclosed in 2019 compromised registrars and DNS providers to hijack the domains of government and energy organizations across more than a dozen countries, harvesting credentials through look-alike login portals with valid certificates. In 2018, attackers used a BGP hijack against Amazon's Route 53 to answer DNS queries for a cryptocurrency wallet service with forged records, redirecting users to a phishing clone and stealing funds. In both cases, the victims' own servers were never breached — the DNS layer was.
Warning Signs Your DNS May Be Hijacked
A DNS record changed and nobody on your team changed it — the definitive signal, if you have monitoring in place to see it.
Your nameservers disagree with each other — some answering with old values, some with values you don't recognize.
Unexpected WHOIS changes: a registrar transfer you didn't initiate, a transfer lock that was removed, or new registrant contacts.
An SSL certificate for your domain was issued by a CA you don't use — visible in Certificate Transparency logs, and often the first public evidence of a hijack.
Users report your site looking different, asking for credentials unexpectedly, or email going missing — late-stage signs that the hijack is already being exploited.
How to Detect DNS Hijacking
Detection comes down to one discipline: continuously comparing what your DNS actually answers against what it should answer — from the outside, the way the rest of the internet sees it, on every authoritative nameserver independently. Internal change logs cannot do this; a hijacked zone edits itself without leaving entries in your ticketing system.
DNS record monitoring watches every record on every authoritative nameserver and alerts on any change, with full history of what each nameserver answered and when. Pairing it with WHOIS monitoring catches registrar-level attacks at the delegation-and-lock stage — often before the DNS itself flips. Reviewing your DNS history establishes exactly when a hijack began and what changed, which drives both incident response and recovery.
How to Prevent DNS Hijacking
Lock the domain: enable registrar lock (clientTransferProhibited), and for high-value domains ask about registry lock, which requires out-of-band verification for any delegation change.
Harden the accounts: unique passwords and hardware-key 2FA on both your registrar and DNS provider accounts — these two logins are your domain's real security perimeter.
Sign the zone: DNSSEC makes forged answers detectable by validating resolvers, neutralizing cache-poisoning attacks.
Restrict API tokens: DNS provider tokens embedded in CI/CD and infrastructure tooling should be read-only wherever possible and scoped to the zones they need.
Monitor from the outside: independent, per-nameserver monitoring is the safety net that catches whatever gets past the locks — and the only measure on this list that tells you when the others have failed.
Check Your Domain Right Now
Want to see what your DNS is actually answering — on every authoritative nameserver, with security checks for the weaknesses hijackers exploit? Run a free DNS scan — no signup required. For continuous protection, DNS Spy monitors your records, WHOIS, certificates, and nameserver health around the clock and alerts you the moment anything changes. Related reading: domain hijacking protection covers the registrar-level defenses in depth.
