DNS hijacking redirects domain traffic to attacker-controlled servers via registrar takeover, router malware, or ro…
What is DNS Hijacking?
DNS Hijacking (also known as DNS redirection) is a cyberattack where an adversary maliciously alters DNS settings to redirect traffic intended for a legitimate domain to an attacker-controlled server.
Unlike cache poisoning—which exploits technical vulnerabilities in how resolvers process UDP packets—DNS hijacking is typically a structural attack against the domain's management infrastructure or the network routing path itself. Attackers hijack DNS to facilitate massive credential harvesting campaigns, distribute malware, or intercept sensitive API and email traffic.
Frequently Asked Questions
Types of DNS Hijacking
Because DNS resolution involves multiple hops and trust boundaries, attackers can hijack the process at several different layers:
Registrar Hijacking: The most devastating type. Attackers compromise the domain owner's account at the registrar (e.g., GoDaddy, Namecheap) and change the domain's authoritative nameservers.
NS Record Tampering: Attackers gain unauthorized access to the authoritative DNS provider (e.g., Cloudflare, Route53) and quietly modify specific A, MX, or CNAME records.
Local/Router Hijacking: Malware on an endpoint or compromised home/enterprise routers forcibly changes the OS network settings to use a rogue recursive resolver operated by the attacker.
BGP Hijacking: Highly sophisticated adversaries manipulate Border Gateway Protocol (BGP) routing tables to steal the IP space of legitimate authoritative nameservers, intercepting the traffic at the internet backbone.
How registrar hijacking works
Registrar hijacking represents a total loss of control. Attackers do not need to exploit complex protocol vulnerabilities; they simply log in as the administrator.
This is typically achieved through:
Credential Stuffing: Reusing passwords leaked from other breaches.
Social Engineering: Tricking registrar customer support into bypassing MFA or resetting the password to an attacker-controlled email.
Phishing: Tricking domain administrators into handing over their credentials.
Once inside, the attacker points the domain to their own nameservers. Because the change happens at the TLD level, it is perfectly legitimate in the eyes of the internet, bypassing DNSSEC entirely (as the attacker will just generate new keys).
NS record tampering
If an attacker breaches the authoritative DNS provider rather than the registrar, they can execute stealthy, targeted hijacks.
Before the hijack, a legitimate A record looks like this:
DNS Record / Config
;; Legitimate Record
www.example.com. 3600 IN A 203.0.113.10
After the hijack, the attacker redirects the web traffic to their phishing clone, leaving other records (like MX) untouched to avoid raising immediate alarms:
DNS Record / Config
;; Hijacked Record
www.example.com. 3600 IN A 198.51.100.99
The 2019 Sea Turtle campaign
The Sea Turtle campaign is a textbook example of nation-state DNS hijacking. Adversaries targeted the DNS registrars and internet registries of government agencies and telecommunications providers in the Middle East and North Africa.
Instead of hacking the targets directly, they compromised the infrastructure that managed the targets' domains. By altering the DNS records, they routed government email and web traffic through adversary-in-the-middle servers, intercepting credentials before seamlessly forwarding the traffic to the legitimate destinations. The victims had no idea they were compromised.
Tip
Applying a Registry Lock prevents unauthorized NS changes at the registrar level. Even if an attacker steals your registrar credentials, they cannot modify the domain delegation without a manual, out-of-band verification process (like a phone call) with the registry operator.
How to detect DNS hijacking
Because hijacked records propagate globally, detection must rely on continuous external monitoring:
NS Record Monitoring: Continuously poll the TLD nameservers to verify that your delegated nameservers have not changed.
SOA Serial Monitoring: The Start of Authority (SOA) serial number increments when a zone is updated. Unexpected serial increments strongly indicate unauthorized tampering.
TLS Certificate Transparency Logs: Attackers redirecting your traffic will need a valid TLS certificate for your domain to avoid browser warnings. Monitoring CT logs for unexpected certificate issuances (e.g., a Let's Encrypt cert for a domain that exclusively uses DigiCert) is a highly reliable indicator of hijacking.
Defenses against hijacking
A defense-in-depth strategy is required to secure the DNS control plane:
Registry Lock: The ultimate protection against unauthorized TLD changes.
Strict 2FA/MFA: Enforce hardware security keys (FIDO2/WebAuthn) on all registrar and DNS provider accounts.
DNSSEC: Prevents attackers from using BGP hijacking to answer queries, as they cannot forge the cryptographic signatures.
DMARC: Enforce strict DMARC policies (p=reject) to prevent attackers from hijacking mail flows and spoofing your domain.
Response steps when hijacking is detected
If a hijack is confirmed, speed is critical due to DNS caching:
Regain Control: Immediately lock out the attacker by resetting credentials, revoking API keys, and contacting the registrar's emergency abuse team.
Revert Records: Restore the legitimate NS or A records.
Flush Caches: Use public cache flush tools (like Google Public DNS Flush Cache) to clear the poisoned records from major global resolvers.
Investigate the Breach: Determine the initial access vector to prevent immediate recurrence.
Dig commands to check NS delegation
To verify that your domain's delegation is intact, you should compare the authoritative nameservers with what the TLD believes to be true.
Ask a public resolver for your NS records:
DNS Record / Config
dig example.com NS +short
Ask the TLD directly to see the delegation (bypassing caches):
DNS Record / Config
dig @a.gtld-servers.net example.com NS +short
If the results of these two commands do not match, you may be experiencing NS drift or an active hijack.
CF
How CyberFurl Helps
Automated monitoring. Zero manual work.
CyberFurl monitors your NS records and SOA authority against your domain registrar's reported nameservers — immediately alerting when a discrepancy indicates that your DNS delegation has been hijacked or silently changed. The platform tracks nameserver history and sends real-time alerts when NS records are modified, giving your team the minutes needed to contact your registrar and revoke unauthorized changes before they propagate globally.
What's the difference between hijacking and poisoning?
The right comparison is scope plus enforcement point: what each option controls, where it acts in the stack, and what failure looks like when it goes wrong. Similar terms often sound interchangeable until a rollout or incident forces the team to explain which trust decision each one actually changes.
Can my router be hijacked?
Dns Hijacking can help, but only when the prerequisites and surrounding trust assumptions are also true. The safest answer is to validate the specific path you care about in production, because edge cases around forwarding, intermediaries, browser support, or vendor behavior are often where theory breaks down.
Does DNSSEC stop hijacking?
Support depends on the exact receiver, browser, platform, or vendor on the other side. Many ecosystems implement part of Dns Hijacking, but the reliable answer comes from testing the specific product path you care about in production rather than assuming support is universal.
What's a registrar lock?
The right next step is usually evidence first: inspect the live public behavior, identify the dependency or exposure that matters, and then decide whether to implement, tighten, monitor, or clean up. Dns Hijacking is most useful when the answer is anchored in what production is actually doing rather than in documentation alone.
What is Dns Hijacking?
DNS hijacking redirects domain traffic to attacker-controlled servers via registrar takeover, router malware, or rogue resolvers. In practice, teams care about Dns Hijacking because it changes a real trust boundary somewhere in the stack and gives them a concrete signal they can validate on the live domain or application.
How long does it take to recover from a hijack?
Recovery time depends on your domain's Time-To-Live (TTL) values and how fast you can regain control at the registrar. Even after reverting the malicious NS records, poisoned resolvers worldwide will continue routing traffic to the attacker until the TTL expires.
Can MFA prevent DNS hijacking?
MFA on your domain registrar and DNS provider accounts is the single most effective defense against credential-based hijacking, though it won't stop sophisticated BGP hijacks or on-path network attacks.
