DNS hijacking: how it works, symptoms and prevention

What DNS hijacking is

DNS hijacking is any attack that takes control of how DNS questions are answered, so that a name resolves to an address the attacker chooses. The person typing a familiar address, or the app connecting to a familiar service, reaches the attacker's server instead: a fake login page, a server that intercepts email, or a relay that reads traffic before passing it on.

It is a real and current threat in the UK. In January 2019 the NCSC published an alert about a large-scale global campaign to hijack DNS, and followed it in July 2019 with further mitigation advice. In April 2026 the NCSC reported that the Russian state group APT28 had exploited vulnerable internet routers to enable DNS hijacking, rerouting users' traffic through malicious servers to harvest login credentials and access tokens.

Types of DNS hijacking

The first three affect the people looking names up. The fourth affects the domain itself: your website, your email and anything else under your name. It is often the most damaging, because the attacker can also get valid certificates issued for your domain once they control its DNS.

Symptoms of DNS hijacking

DNS hijacking is designed to be quiet, but there are signs worth knowing:

• Certificate warnings on sites that normally load cleanly, or a padlock showing a certificate issued to an unexpected organisation.
• Unexpected login prompts, or a familiar login page that looks slightly different.
• A device or router using DNS servers you did not set, or settings that change back after you correct them.
• Website or email changes you did not make: web pages replaced, email going missing, or new MX records.
• Alerts from your registrar or DNS host about logins, changed contacts or changed name servers.
• New TLS certificates for your domain that nobody in your organisation requested, visible in public certificate transparency logs.
• Blocks disappearing: protective DNS test pages that used to show a block suddenly load, because devices are no longer using your resolver.

How to test for DNS hijacking

A few checks will tell you most of what you need to know:

1. Check which resolver devices use. On Windows, ipconfig /all shows the DNS servers for each adapter; on other devices, look in the network details. Compare them with what your network should hand out.
2. Check the router or firewall. Look at the DNS servers it uses and hands out by DHCP, and check its firmware is current and its admin interface is not reachable from the internet.
3. Confirm you reach your protective resolver. Use your provider's published test page or domain; our DNS security test guide explains how.
4. Compare answers. Look up an important name of yours through your normal resolver and directly against your authoritative name servers. They should match.
5. Check your domain at the registry level. Confirm the name servers listed for your domain at its parent zone are the ones you expect.
6. Review account activity. Look at login and change history in your registrar and DNS hosting accounts, and at certificate transparency logs for your domains.

How to prevent DNS hijacking

Each type of hijacking has its own fix. Together they form a sensible baseline:

• Lock down device settings. Use Group Policy or mobile device management so users cannot change DNS settings, and run endpoint protection to catch malware that tries.
• Harden routers. Keep firmware updated, change default credentials, and keep management interfaces off the internet, in line with the NCSC's April 2026 advice to protect management interfaces and keep devices up to date.
• Pin the resolver on roaming devices. A DNS roaming client keeps laptops on your protective resolver on home and public networks, where router and rogue-resolver hijacks are most likely.
• Block outbound DNS that skips your resolver, so a changed setting on one device fails rather than silently working.
• Lock your domains. Turn on registrar transfer lock, and registry lock where your registrar offers it.
• Use multi-factor authentication on every registrar and DNS hosting account, limit who has access, and keep contact email addresses on domains you control.
• Sign your domains with DNSSEC, so validating resolvers can detect forged answers for them.
• Monitor for change. Watch key records such as name servers, MX and website addresses, and certificate transparency logs for unexpected certificates.

The NCSC's guidance on protective DNS also asks buyers to check that providers can prevent DNS spoofing and hijacking attacks, including support for DNSSEC.

If you think your domain has been hijacked

A hijacked domain is an incident, not a configuration task. Move quickly and in this order:

1. Regain control of the account. Contact your registrar or DNS host through their official support route, reset passwords, remove unknown users and turn on multi-factor authentication.
2. Restore the correct records, starting with the name servers at the registry, then website, MX and other important records. Keep a copy of what the attacker changed.
3. Revoke rogue certificates. Check certificate transparency logs for certificates issued during the hijack and ask the issuing certificate authority to revoke them.
4. Reset credentials that may have been captured, especially email and Microsoft 365 or other cloud logins, since intercepting logins is a common goal.
5. Tell the people affected, including customers if email or payment pages were redirected, and take advice on whether the incident is reportable to the ICO under UK GDPR.
6. Fix the root cause before closing the incident: registrar lock, MFA, fewer people with access and change alerts.

Keep an up-to-date export of your DNS zones somewhere safe. Restoring from a known-good copy is far quicker than rebuilding records from memory under pressure.

DNS hijacking vs DNS spoofing

The two terms are often mixed up. Hijacking takes control of part of the DNS chain, such as a device's settings, a router, a resolver or a domain's registrar account, so the attacker can answer queries however they like. Spoofing forges answers without that control, for example by racing a fake response into a resolver's cache. The end result looks the same to the user, but the defences differ. See DNS spoofing and cache poisoning for the forging side, and the full list of DNS attacks for the rest.

How we can help

We can review the DNS settings on your networks and devices, harden routers and firewalls, deploy roaming clients and help you lock down registrar and DNS hosting accounts. If you need a protective DNS service, we can compare the DNS security solutions we supply. Scope is confirmed at quote; contact us to arrange a review.