DNS hijacking is an attack that changes how domain names are resolved – on a device, router, resolver or at the registrar – so that users are sent to servers controlled by the attacker.
How DNS hijacking works
The Domain Name System translates names into IP addresses, so whoever controls the answers controls where traffic goes. Attackers can intervene at several points:
- Local hijacking – malware changes DNS settings on a computer. The DNSChanger trojan did this on millions of machines until the FBI’s Operation Ghost Click in 2011.
- Router hijacking – default passwords or vulnerabilities in home routers let attackers point all devices on the network to a rogue resolver, as the GhostDNS campaign did in 2018.
- Record hijacking – stolen registrar or DNS hosting credentials let attackers change a domain’s authoritative records directly.
- Resolver manipulation – rogue or compromised ISP resolvers return false answers, sometimes for advertising or censorship.
A related but different technique, DNS cache poisoning, injects forged answers into a resolver’s cache without changing any settings.
Why DNS hijacking matters
Hijacked DNS enables phishing on the “right” domain, email interception and issuing valid TLS certificates for the attacker’s servers. The DNSpionage and Sea Turtle campaigns (2018–2019) redirected government and telecom domains in the Middle East and elsewhere this way, prompting the US CISA to issue Emergency Directive 19-01 on DNS infrastructure tampering in January 2019.
How to protect against DNS hijacking
- Secure registrar and DNS provider accounts with MFA and enable registrar or registry lock (see domain hijacking).
- Sign zones with DNSSEC and monitor DNS records and Certificate Transparency logs for changes.
- Change default router passwords and keep router firmware updated.
- Use trusted resolvers with encrypted DNS such as DNS over HTTPS.
