DNS hijacking is any unauthorized change that makes names resolve to attacker-controlled addresses. It can happen at three levels: the domain owner's registrar or DNS account, a device or router configured with a rogue resolver, or a resolver or ISP that rewrites answers.
Why it matters
Hijacking a domain lets an attacker intercept web traffic and email, issue valid TLS certificates through domain validation and impersonate the brand. Because the DNS data itself is changed rather than forged in transit, DNSSEC may not help if the attacker also controls the signing keys or the DS record. Detecting changes quickly limits the damage.
Example
A registrar account without two-factor authentication is phished. The attacker swaps the nameservers:
Before: ns1.goodhost.net, ns2.goodhost.net
After: ns1.evil.example, ns2.evil.exampleEvery record is now served from the attacker's zone. Monitoring for nameserver and A record changes would flag it within minutes.
Common mistakes
- Protecting the website but not the registrar and DNS provider logins.
- Skipping registry lock for high-value domains.
- Leaving a router on default credentials, which lets malware change its DNS servers.
- Having no alerting on NS or A record changes.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.