What Is DNS Hijacking?
Definition
DNS hijacking is when an attacker changes a domain's DNS records so that the domain's website, email, or other services point to servers the attacker controls. Visitors and mail servers still use the right domain name, but their traffic quietly goes to the wrong place.
How It Works
DNS is the internet's address book. A domain's records say which server hosts the website (A records), which servers accept its email (MX records), and which name servers are in charge (NS records). Those records are managed through an account at a registrar or DNS host.
CISA described the usual pattern in 2019: "The attacker begins by compromising user credentials, or obtaining them through alternate means, of an account that can make changes to DNS records. Next, the attacker alters DNS records," replacing the real addresses with ones the attacker controls.
The damage goes beyond a redirect. CISA warned that "because the attacker can set DNS record values, they can also obtain valid encryption certificates for an organization's domain names." That means the attacker's fake site shows a padlock and "end users receive no error warnings," while passwords and email pass through the attacker's servers.
Other routes include hijacking at the registrar itself, compromised routers that change DNS settings for an office, and lapsed or transferred domains. Defenses focus on the account that controls DNS: strong unique passwords, MFA, registrar lock, and alerts on changes.
Real-World Example
On January 22, 2019, CISA issued Emergency Directive 19-01 after a DNS tampering campaign affected multiple executive branch agency domains. Attackers had "redirected and intercepted web and mail traffic." The directive ordered agencies to audit public DNS records and change passwords on all accounts that can change DNS within 10 business days. It also required multi-factor authentication on those accounts and monitoring of Certificate Transparency logs for certificates they did not request. CISA has since sunset the directive.
Why It Matters for a Small Business
For a small business, the DNS login is often an old registrar account set up years ago by a former employee or web designer, with a reused password and no MFA. Whoever controls it can redirect the website, intercept email, and get valid certificates, which makes invoice fraud and credential theft easy. It is also hard to notice, because everything looks normal from inside the office. Recovery is slow, too: getting a hijacked domain back can involve registrars, hosting providers, and certificate authorities, while customers keep landing on the attacker's servers.
How to Spot It / How DTS Handles It
Warning signs: email suddenly bouncing or missing, the website showing different content in some locations, DNS records nobody recognizes, unexpected certificates for your domain in Certificate Transparency logs, and registrar emails about changes or transfers.
DTS can help with documenting who owns the registrar and DNS accounts, turning on MFA and registrar lock, setting up change alerts, and reviewing records. See our managed IT service, or our incident response team if records were already changed.
Related Terms
- DNSSEC: signs DNS data so tampering in transit is detected.
- Domain registrar lock: blocks unauthorized transfers.
- TLS certificate: what hijackers can obtain once DNS is theirs.
- DNS cache poisoning: a related attack on resolvers.
- Multi-factor authentication (MFA): the key control on DNS accounts.
- Business email compromise (BEC): what intercepted mail often enables.
- Subdomain takeover: hijacking through stale DNS records.
Sources
- CISA, Emergency Directive 19-01: Mitigate DNS Infrastructure Tampering (January 22, 2019; since sunset): https://www.cisa.gov/news-events/directives/ed-19-01-mitigate-dns-infrastructure-tampering
- ICANN, ICANN Calls for Full DNSSEC Deployment, Promotes Community Collaboration to Protect the Internet (February 22, 2019): https://www.icann.org/news/announcement-2019-02-22-en
Last updated October 14, 2026.