What is a DNS hijack comes down to one idea: your browser asks a question, “where does this domain live,” and an attacker answers with a lie. DNS hijacking manipulates the domain name resolution process to redirect you toward a malicious destination instead of the real one, without needing to touch your browser, your antivirus, or the website itself. It happens further upstream, at the layer that translates domain names into addresses in the first place. For the normal, non-malicious version of that translation process, see how DNS records and resolution actually work.
How DNS Hijacking Actually Works
An attacker first identifies a target, whether that’s a home router, a domain registrar account, or an ISP’s resolver infrastructure. They gain access through a weak password, a vulnerability, or malware, then modify DNS settings at that point in the chain. From then on, when you or other affected users query that domain, the resolution returns a malicious IP address instead of the legitimate one, and your browser connects to a fake destination believing it reached the real site.
The 5 Main Types of DNS Hijacking
Local DNS Hijack
Malware installed directly on a device changes that device’s local DNS settings, redirecting only that single user, regardless of which network they connect to afterward.
Router DNS Hijack
An attacker exploits a default or weak router password, or a firmware vulnerability, to change the DNS settings at the router level. This affects every device connected to that router, not just one.
Man-in-the-Middle DNS Attack
An attacker intercepts DNS queries while they’re in transit across an unsecured network and injects forged responses before the real answer arrives. This is often grouped under DNS spoofing, covered in more detail below.
Rogue DNS Server or Registrar Compromise
An attacker compromises a domain registrar account and changes the official DNS records for a domain directly. This is particularly dangerous because it affects every visitor to that domain, and because the change happens at the authoritative source, it doesn’t look suspicious to resolvers checking it.
Recursive DNS Hijack
An attacker takes over a recursive resolver, the server, often run by an ISP, that does the actual lookup work on behalf of users. This is the largest-scale variant, since it can serve false answers to an entire ISP’s customer base at once, without touching any individual device or router.
DNS Hijacking vs DNS Spoofing vs Cache Poisoning
These three terms get used interchangeably, but they describe different mechanics:
- DNS hijacking modifies DNS settings directly, whether on a router, a registrar account, or a local device, changing where queries get sent in the first place.
- DNS spoofing intercepts a query while it’s already in transit and forges a response before the legitimate one arrives, without changing any official settings anywhere.
- Cache poisoning injects forged DNS records into a resolver’s cache, so the resolver serves the wrong answer to every user who queries it afterward, until that cached entry expires.
The distinction matters because it determines the scale of impact and where the compromise actually lives, at your device, in transit, or inside a resolver’s memory.
DNS Hijacking Isn’t Always Criminal
Not every instance of DNS hijacking involves an attacker in the traditional sense. Some ISPs use similar redirection techniques to collect browsing statistics or return an ad-filled page for domains that don’t resolve, rather than a standard browser error. Some governments use DNS-level redirection for content filtering and censorship. The underlying mechanism, redirecting a query away from its intended destination, is the same whether the actor is a criminal, an ISP, or a government body. Only the intent and disclosure differ.
The Certificate Danger: Why Hijacking Can Defeat HTTPS Too
The part most explanations skip is what happens to encryption during a hijack. Certificate authorities like Let’s Encrypt issue SSL certificates automatically once an applicant proves control over a domain. During an active hijack, an attacker who controls DNS resolution for a domain can potentially demonstrate that same control to a certificate authority and obtain a valid certificate for it. That means the fake site an attacker sets up wouldn’t necessarily trigger a browser warning, since it would present a properly issued certificate rather than an obviously broken one. This is why a missing padlock icon isn’t a reliable warning sign on its own; a well-executed hijack can produce a site that looks fully secure while sending your data somewhere it was never meant to go.
Real-World Scale: What a Hijack Actually Looks Like
DNS hijacks aren’t rare theoretical scenarios. Documented incidents have shown a single rogue nameserver change redirecting a significant share of a domain’s total DNS queries for hours before correction, and even after records are fixed at the source, cached copies of the bad records can persist across resolvers globally for extended periods, since DNS caching means a fix doesn’t propagate instantly everywhere.
How to Detect DNS Hijacking
A few general warning signs are worth understanding, without treating any single one as definitive proof:
- A website that suddenly looks different, loads unusually slowly, or redirects unexpectedly compared to normal
- Certificate details that don’t match what you’d expect for a familiar site, visible by checking the certificate info in your browser
- Comparing the IP address a domain resolves to against what you’d expect, using basic DNS lookup tools available on most operating systems
- Router admin settings showing DNS server addresses you don’t recognize and didn’t configure yourself
Because DNS hijacking can occur at several different layers, from your own device to your router to your ISP’s infrastructure, no single check rules it out completely. This is closely related to how your Wi-Fi network can expose metadata about your activity to others in the first place. For that broader picture, see who can actually see your activity on a shared Wi-Fi network.
Domain Misconfiguration Is a Separate Risk
Not every hijacking-adjacent incident involves active hacking at all. Incorrect, stale, or non-resolvable DNS records can leave a domain’s ownership effectively up for grabs, since some services will let anyone who can prove control over an unclaimed or misconfigured record take it over. This is a configuration failure rather than an attack, but the practical result for visitors, being redirected to unintended content, looks similar.
Encrypted DNS as a Structural Mitigation
DNS over HTTPS, or DoH, encrypts DNS queries between your device and the resolver, which closes off the man-in-the-middle variant of hijacking that relies on intercepting unencrypted queries in transit. It doesn’t protect against every variant covered here, since a compromised router or a hijacked registrar account changes the trusted starting point of the query itself, not the transit encryption around it. It’s one layer in a chain, not a complete fix on its own.
FAQ
Is DNS hijacking the same as DNS spoofing?
No. Hijacking changes DNS settings directly at their source, while spoofing intercepts and forges a response to a query already in transit, without altering any official configuration.
Can DNS hijacking happen on a phone?
Yes. A malicious app can change local DNS settings on a phone the same way malware can on a computer, redirecting that device’s queries independent of the network it’s connected to.
Does switching to a public DNS provider fully protect me?
It protects against some interception-based variants, but not against a compromise at the domain registrar level, since that changes the authoritative record everyone’s resolver ultimately relies on, regardless of which resolver you personally use.
