DNS hijacking
In network security, DNS hijacking is the redirection of traffic by tampering with how a domain resolves, at the registrar, the resolver or the record level. Because DNS is the first lookup almost every connection makes, controlling it lets an attacker send users and services to infrastructure they control.
How it works
DNS hijacking can happen at several points. At the registrar, an attacker who compromises the account that manages a domain can change its name servers and take over resolution wholesale. At the record level, they alter individual entries, pointing a name at their own server. At the resolver, they poison or replace the answers a resolver returns to its clients. A related weakness is subdomain takeover, where a record still points at a decommissioned service an attacker can re-register. In each case the victim’s own systems are untouched; what changes is the map that tells everyone where to find them. A related but distinct technique, BGP hijacking, redirects traffic at the routing layer rather than the naming layer, with a similar effect on where connections actually land.
What goes wrong
The reason this is attractive is that it defeats controls that assume the destination is genuine. Redirect a login domain and you harvest credentials on infrastructure that looks right to the user. Redirect a mail record and you intercept or spoof email, which is why DNS hijacking pairs naturally with DMARC failures. From the attacker’s side, the registrar account is often the softest target: it may lack multi-factor authentication, be shared across a team, or sit with a former supplier nobody thinks of as security-critical. The blast radius is the whole domain, and the victim frequently learns about it from customers rather than from any alert.
Where this shows up in an audit
We review the external DNS footprint as part of the perimeter: how the registrar account is protected, whether records are monitored for change, whether dangling records invite subdomain takeover, and whether the answers can be integrity-checked with DNSSEC. Findings are written against the control that failed (an unprotected registrar account, an orphaned record), with the redirect demonstrated where scope allows. This is part of how we review your external DNS exposure.