How to Detect and Prevent DNS Hijacking

What DNS Hijacking Actually Is

DNS hijacking means someone else controls what IP addresses your domain resolves to. When a user types your domain into a browser or an email server looks up your MX records, they expect a specific answer. DNS hijacking changes that answer, often without the user noticing.

There are four main ways this happens:

Malware on the local machine changes the DNS resolver settings in TCP/IP stack, so the machine talks to a rogue server for every DNS query.
Router firmware compromise changes the DNS settings the router hands out via DHCP. Every device on that network is affected.
ISP-level DNS manipulation intercepts port 53 queries and returns answers the ISP controls, rather than the answers from your actual nameservers. This is how some ISPs inject advertising and how certain governments block access to specific domains.
Registrar or DNS provider compromise changes the authoritative nameservers for your domain at the registry level. This is the most severe form because it affects every user worldwide, not just those on one network.

Real examples: In 2019, Iran redirected DNS resolution for dozens of domains including Facebook and Twitter through state-controlled servers. Some European and North American ISPs have quietly redirected NXDOMAIN responses to show search pages with advertising instead of an error message. These are not theoretical attacks.

Why DNS Hijacking Matters for Email Security

Email delivery depends on DNS. An MX lookup tells the sending server where to deliver mail. SPF publishes which IP addresses are authorized to send for your domain. DKIM publishes the public key that verifies email signatures. If an attacker can manipulate these DNS answers, they can redirect your mail, impersonate your sending infrastructure, or intercept messages.

More specifically, DNS hijacking enables:

Mail interception: the attacker points your MX records to a server they control, capturing incoming messages.
Spoofing at scale: with control of your DNS, the attacker can set up SPF and DKIM records that look legitimate, bypassing receiver checks.
Credential phishing: users are redirected to fake login pages that look like your real domain, because the DNS resolves to the attacker's server.

This is why DNS security and email authentication are connected. Protecting one without thinking about the other leaves gaps.

How to Detect DNS Hijacking on Your Domain

Run through this checklist. The first three steps tell you if something has already gone wrong. The rest are ongoing monitoring habits:

If you suspect an active compromise:

1. Query your domain from multiple locations. Use dig +short NS yourdomain.com from your local machine, then compare the result against an external DNS checker. If the nameservers differ depending on where you query from, something is intercepting your traffic.
2. Verify your authoritative nameservers match what your registrar shows. Run whois yourdomain.com | grep -i "name server" and compare it to what your DNS hosting panel lists. If they do not match, your registrar records may have been changed.
3. Track email volume anomalies. A sudden drop in legitimate inbound mail, with no other changes on your end, can indicate MX records have been redirected.

Ongoing monitoring:

4. Watch for unexpected NS record changes. Any change to your nameservers should be intentional and documented. Set up a monitor that alerts you when NS records change.
5. Check for unexpected subdomains resolving. If subdomains you never created are suddenly resolving to IP addresses, your DNS may have been altered.
6. Use a DNS monitoring service. Services like DNSViz track your zone and alert you when records change. DMARCFlow monitors DNS changes as part of its broader email authentication platform, flagging unexpected modifications to your SPF, DKIM, and DMARC records alongside your nameserver configuration.
7. Validate DNSSEC if enabled. Run your domain through dnsviz.net to confirm DNSSEC signatures are resolving correctly. A broken DNSSEC setup causes resolution failures, not security.

How to Prevent DNS Hijacking

Hardening your DNS is the most effective defence:

1. Use a reputable registrar with strong account security. Enable U2F hardware token authentication on your registrar account. Enable IP allowlisting so only trusted IPs can make changes. Avoid registrars that make it easy to transfer domains without proper verification.
2. Enable registrar lock. This prevents accidental or malicious transfers by requiring a PIN or explicit approval before any transfer request is processed.
3. Set up DNSSEC. DNSSEC adds cryptographic signatures to your DNS records. Receivers verify those signatures against trust anchors, making it much harder for an attacker to inject false records. Many domains still do not use it because of perceived complexity, but the protection is real. If your DNS provider supports automatic DNSSEC signing, enable it.
4. Choose DNS hosting with audit logs and change alerting. Your DNS provider should log every record change with a timestamp and source IP. Alerts should fire when changes happen, not just when you notice something is wrong.
5. Monitor your DNS continuously. Do not wait for a visible problem. Set up automated checks that query your nameservers from multiple geographic locations and alert on any deviation from expected results.
6. Restrict zone transfers. Zone transfers are how secondary nameservers get your full record set. Restrict them to authorized secondary servers only. An open zone transfer exposes your entire DNS landscape to an attacker doing reconnaissance.
7. Use encrypted DNS on internal resolvers. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the queries your network sends, preventing network-level eavesdropping. Note: encryption alone does not authenticate the responses you receive. DNSSEC does that job. Use both together.

The Connection to Email Authentication

Email authentication protocols provide a safety net when DNS is already compromised:

SPF validates sending IP authority. If your DNS has been hijacked but the attacker tries to send from an IP not in your SPF record, receivers reject the mail. SPF is not foolproof against DNS hijacking, but it limits what an attacker can do with a rogue mail server.
DKIM signatures survive DNS compromise. The DKIM signing key is stored on your mail server, not in DNS. An attacker who controls your DNS cannot generate valid DKIM signatures for your domain. This is the strongest protection email authentication offers against DNS-based attacks.
DMARC alignment adds a domain match requirement. Even if SPF passes from an authorized IP and DKIM passes with a valid signature, DMARC requires the From domain to align with the authenticated domain. A hijacker who controls your DNS but not your DKIM signing key cannot produce aligned signatures.

The practical takeaway: DKIM with strict alignment is your best defence when DNS is under attack. If you are not signing outbound mail with DKIM, start. DMARC enforcement ensures receivers reject anything that does not align, even if the attacker has manipulated other records.

Quick DNS Hijacking Detection Commands

Copy and run these from any Linux or macOS terminal:

# Check your nameservers
dig +short NS yourdomain.com

# Trace full resolution path
dig +trace yourdomain.com

# Check registrar-recorded nameservers
whois yourdomain.com | grep -i "name server"

# Validate DNSSEC signatures
dig +dnssec yourdomain.com DNSKEY

# Check from a specific resolver
dig @8.8.8.8 yourdomain.com MX
dig @1.1.1.1 yourdomain.com MX

If the answers differ between resolvers, that is a sign something is intercepting or manipulating queries. Run these regularly or automate them with a monitoring script.

FAQ

How do I know if my DNS is being hijacked right now?
Run dig +short NS yourdomain.com from multiple networks (home, office, mobile hotspot) and compare the results. If they differ, or if they differ from what your registrar shows, your DNS may be compromised. Also check for sudden drops in email volume or users reporting being redirected to unfamiliar pages.

Does using DoH or DoT prevent DNS hijacking?
Encrypted DNS prevents network-level interception of your queries, but it does not authenticate the responses you get back. An attacker who controls your DNS provider can still return false answers even if your query is encrypted. DNSSEC is what authenticates DNS responses, not DoH or DoT. Use encrypted DNS for privacy and DNSSEC for authenticity.

Can email authentication protect me if my DNS is hijacked?
DKIM signatures are the key protection here. Since DKIM keys are not stored in DNS, an attacker who hijacks your DNS cannot generate valid DKIM signatures. With DMARC enforcement in place, unauthenticated mail gets rejected regardless of what DNS says about your domain.

What is the single most important step to prevent DNS hijacking?
Enable registrar lock and use a hardware token (U2F) for your registrar account. Most DNS hijacking incidents start with the registrar account being compromised, not with a sophisticated attack on DNS infrastructure itself. A strong registrar account with hardware token protection stops the most common attack path before it starts.