DNS hijacking, also called DNS redirection, is a cyberattack that manipulates DNS settings, records, or responses to redirect users from a legitimate destination to an unintended or malicious one.
DNS translates human-readable domain names, such as example.com, into the IP addresses used to connect to servers. By interfering with this resolution process, attackers can redirect users to phishing pages, malware-hosting infrastructure, or other attacker-controlled destinations.
DNS hijacking can target different parts of the resolution process, including an individual device, a router, a DNS server, or domain-management infrastructure. The exact terminology can vary between security sources, and some forms overlap with DNS spoofing.
How DNS Hijacking Works
Normal lookup
When you enter a website address, your device uses DNS to obtain the IP address associated with that domain.
The attack
An attacker compromises or modifies part of the DNS resolution path, such as local DNS settings, router configuration, DNS records, or a DNS server. Attackers may also intercept DNS traffic and attempt to provide a fraudulent response.
The result
The domain resolves to an unintended destination, which may be controlled by the attacker. This can enable phishing, malware distribution, credential theft, or other attacks.
Common Types of DNS Hijacking
Local DNS hijacking.
Malware or unauthorized changes modify DNS settings or a local hosts file, redirecting DNS requests from a particular device.
Router DNS hijacking.
Attackers compromise a router and modify its DNS settings, potentially affecting multiple devices connected to that network. Weak administrative credentials and vulnerable or outdated firmware can increase the risk of router compromise.
Rogue DNS server hijacking.
An attacker compromises or replaces DNS infrastructure so that DNS requests are resolved through an unauthorized server or altered records.
Man-in-the-middle DNS hijacking.
An attacker positioned in the communication path intercepts DNS traffic and attempts to replace legitimate responses with fraudulent ones. This can overlap with what other sources describe as DNS spoofing.
Domain or registrar account hijacking.
Attackers compromise a domain owner’s account and modify domain or DNS settings, redirecting services that depend on the domain.
Why Router-Level Hijacking Is Dangerous
A compromised router can affect multiple devices that use its DNS configuration, including laptops, smartphones, smart TVs, and IoT devices. Unlike a local DNS hijack that may affect one device, a router-level compromise can potentially redirect DNS requests from an entire network.
Attackers may gain access by exploiting router vulnerabilities, exposed administrative interfaces, or weak credentials. Keeping router firmware updated and securing administrative access can reduce this risk.
How to Detect and Protect Against DNS Hijacking
Check DNS settings.
Review DNS settings on devices and network routers and investigate unexpected changes. An unfamiliar DNS server can be a warning sign, but it does not by itself prove a hijack.
Secure router administration.
Change default administrative credentials, use strong unique passwords, and restrict access to router management interfaces.
Keep firmware updated.
Apply security updates to routers and other network devices to address known vulnerabilities.
Use DNSSEC where supported.
DNSSEC uses cryptographic signatures to help validating resolvers verify the authenticity and integrity of signed DNS data.
Watch for certificate warnings.
If DNS redirection sends a user to a server that does not have a certificate valid for the requested domain, browser certificate validation can expose the redirection.
Reset compromised devices.
If a router or device is confirmed to be compromised, reset it, update its firmware or software, restore trusted DNS settings, and secure its administrative credentials.
Securing the DNS Resolution Path
DNS hijacking can target different points in the resolution process, so protection should cover more than the DNS server itself. Secure router and device configurations, updated firmware and software, protected DNS accounts, and DNSSEC validation can reduce opportunities for attackers to manipulate DNS resolution.
Organizations should also monitor DNS records and configurations for unauthorized changes. For critical domains, protecting registrar and DNS-provider accounts with strong authentication and access controls is particularly important.
Frequently Asked Questions (FAQ)
1. How do I tell if my DNS is hijacked?
Check DNS settings on your device and router for unexpected changes. Unexpected DNS servers or unexplained changes can be warning signs, but they do not prove hijacking on their own.
2. How do you fix DNS hijacking?
Restore trusted DNS settings, change compromised credentials, update router or device software, and scan affected devices for malware. If a router is compromised, reset and securely reconfigure it.
3. How do you protect against DNS hijacking?
Use strong administrative credentials, keep routers and devices updated, restrict management access, use trusted DNS services, and monitor important DNS settings and records for unauthorized changes.
4. Is DNS hijacking illegal?
Unauthorized access or manipulation of another person’s or organization’s systems may violate applicable laws. The legal position depends on the jurisdiction and circumstances.
5. What's the difference between DNS hijacking and DNS spoofing?
DNS hijacking generally refers to unauthorized manipulation of DNS settings, records, infrastructure, or resolution paths to redirect users. DNS spoofing generally refers to forged or manipulated DNS responses. DNS cache poisoning is one technique involving fraudulent DNS data being stored in a resolver’s cache. Terminology can overlap between sources.
Secure DNS. Block threats before they spread.
Prevent DNS attacks, block malicious domains, and protect critical traffic without disrupting your online services.
