DNS Hijacking

Layer 7: Application High risk

How it works

The Domain Name System translates names like your website address into the numeric addresses computers use. If an attacker gains access to your domain registrar account, your DNS hosting provider, or a router's DNS settings, they can change those records. Visitors, customers and even your own staff may then be sent to look-alike sites or have email routed through the attacker. Compromised home and small office routers can also be altered so every device behind them uses a malicious DNS server.

Because the domain name is correct, people have little reason to be suspicious. Hijacked records can be used to capture credentials, intercept email, obtain security certificates for your domain or take your website offline. Registrar accounts are often protected by a single password set up years ago by someone who has since left the organization. Recovering control can take days, during which customers may be sent to the wrong place.

Warning signs

• Your website showing different content or certificate errors
• Email delivery suddenly failing or delayed
• Unexpected changes to DNS records or name servers
• Registrar notifications about logins or transfers
• Router DNS settings pointing to unknown servers

How to defend against it

• Protect registrar and DNS accounts with MFA
• Enable registrar lock to prevent unauthorized transfers
• Keep registrar contact details current and owned by the business
• Monitor DNS records for changes
• Secure and update office routers and firewalls

If it happens to you

1. Regain control of the registrar or DNS account and restore correct records
2. Reset credentials and enable MFA on those accounts
3. Check for certificates issued for your domain without approval
4. Warn customers and staff if they may have been redirected