What is DNS Hijacking?

DNS hijacking, also called DNS redirection or DNS poisoning in some contexts, is any method that causes a Domain Name System (DNS) resolver to return a false answer for a domain name lookup. The result directs a user's traffic to an unintended destination, often a malicious server under the control of an attacker. This can occur through cache poisoning, compromised routers, malicious DNS server software, or rogue on-path devices that modify DNS queries or responses in transit. The false answer may be a completely incorrect IP address or a partially altered record (for example, replacing the A record of a legitimate website with an attacker's IP).

There are several common vectors. In router-based hijacking, an attacker gains administrative access to a home or office router and changes its configured DNS servers to resolver instances that the attacker controls. In man-in-the-middle (MITM) scenarios, an active network adversary intercepts DNS packets and spoofs replies before the legitimate answer arrives. In cache poisoning attacks (sometimes considered a subtype of hijacking), an attacker injects a forged record into a recursive resolver's cache so that future queries from legitimate users receive the false answer. Some ISPs have also performed forms of hijacking, such as intercepting NXDOMAIN responses and rerouting users to an advertising portal, though this is generally called DNS interception or DNS redirect.

The impact of DNS hijacking ranges from phishing and credential theft to complete loss of trust in network communications. Mitigations include DNSSEC (which cryptographically signs DNS records so that forged answers can be detected), using encrypted transports like DNS over TLS (DoT) or DNS over HTTPS (DoH), and regularly auditing DNS server configurations. End users can reduce risk by manually setting trusted DNS resolvers (such as those operated by public-interest organizations) and keeping router firmware updated.