DNS Hijacking
Unauthorized redirection of DNS queries — through compromised registrar accounts, rogue resolvers, or BGP attacks — giving attackers control over where your domain points.
Attacking the Delegation Chain
While cache poisoning attacks the resolver's memory, DNS hijacking attacks the delegation chain itself — modifying authoritative records or the infrastructure that resolves them. Victims receive answers from attacker-controlled nameservers, but those answers appear completely legitimate to resolvers.
Unlike cache poisoning, which expires when the TTL runs out, DNS hijacking persists as long as the attacker maintains control of the registrar account, rogue nameservers, or hijacked BGP routes.
The impact can be devastating: valid TLS certificates can be issued for the hijacked domain (attackers pass ACME DNS-01 challenges), making phishing sites indistinguishable from legitimate ones — including the padlock in the browser.
Types of DNS Hijacking
Attacker gains access to your domain registrar account (via phishing, credential stuffing, or social engineering) and changes your NS records to attacker-controlled nameservers. All DNS for the domain is now attacker-controlled.
Malware or a compromised router modifies the DNS resolver settings on a device or network, pointing queries to a rogue resolver. The rogue resolver returns attacker-chosen IPs for target domains.
Attackers hijack the BGP routes for nameserver IP addresses, diverting DNS queries for entire TLDs or large domains to attacker-controlled nameservers. Affects all users globally, not just those on specific networks.
Attacker registers a domain with nameservers that share a name with legitimate nameservers but at a different IP. Targets resolvers that don't strictly validate NS glue records.
Protecting Your Domain From Hijacking
The strongest protection. Registry Lock sets server-side EPP status codes (clientTransferProhibited, serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited) that prevent any changes without an out-of-band verification process — typically a phone call to the registry. Available through most registrars for enterprise domains.
Enable hardware key (FIDO2/WebAuthn) or TOTP 2FA on your registrar account. SMS-based 2FA is vulnerable to SIM swapping. Use dedicated email addresses for registrar accounts — not your company's main email domain, which could itself be hijacked.
Sign your zone with DNSSEC and monitor DS records in the parent zone. If an attacker replaces your NS records and DS records, DNSSEC-validating resolvers will return SERVFAIL — a visible signal to users and monitoring systems rather than silently serving attacker content.
Continuously monitor NS, A, MX, and TXT records for unexpected changes. Services like Cloudflare Radar, DNStwist, and custom monitoring scripts can alert on record changes within minutes. Set up monitoring from multiple global vantage points.
Certification Authority Authorization records restrict which CAs can issue certificates for your domain. Add "issue" and "issuewild" CAA records to prevent attackers from getting certificates from unauthorized CAs even if they temporarily control your DNS.
Audit all NS delegations across your domains. Lame delegations (NS records pointing to nameservers that no longer exist or don't answer for the zone) are a common attack surface — attackers re-register orphaned nameserver domains to take over sub-zone authority.
Detecting Unauthorized Changes
Baseline and monitor NS records
Check EPP status codes
Verify DNSSEC chain is intact
Audit CAA records
Related Topics
Injecting false records into resolver caches is a transient form of DNS hijacking.
BGP HijackingBGP route manipulation can redirect traffic to attacker-controlled nameservers at a network level.
DNS TunnelingHijacked DNS infrastructure can be repurposed for covert data exfiltration channels.