You type your bank's URL, the page loads, it looks completely normal, and you enter your credentials. But you never actually reached your bank. You reached a pixel-perfect clone sitting on a server in another country, and everything you typed just went straight to an attacker. This is DNS hijacking in its most dangerous form, and the terrifying part is that it works without any malware on your device, without any browser warning, and sometimes without any visual sign at all. DNS hijacking is one of the most underappreciated threats in modern networking, affecting home users, businesses, and even ISPs, and understanding exactly how it works is the first step toward protecting yourself.
What DNS Hijacking Actually Is
DNS hijacking, also called DNS redirection or DNS poisoning depending on the technique, is any attack that causes a DNS query to return a fraudulent IP address instead of the legitimate one. When your browser wants to reach yourbank.com, it fires a DNS query asking "what is the IP address for this hostname?" Normally, your configured DNS resolver answers correctly. Under a hijacking attack, something in that chain lies to you, and your connection goes somewhere the attacker controls instead.
It is important to distinguish DNS hijacking from DNS spoofing or cache poisoning, though the end result is similar. Hijacking usually refers to direct, persistent modification of DNS settings, whether on your router, your operating system, or at the resolver level. Cache poisoning is more of a one-off injection attack. Both redirect traffic, but the attack surface and the fix differ.
The Four Main Attack Vectors
1. Router DNS Hijacking
Your home or office router is the most common target. Attackers compromise the router through default credentials, unpatched firmware, or a malicious script loaded from a website you visited. Once inside, they simply replace your ISP's DNS server addresses with their own rogue resolver. Every device on your network, phones, laptops, smart TVs, starts using the attacker's DNS without knowing it. This attack is especially effective because it is completely transparent to every device downstream.
Common vulnerable routers include older TP-Link, Netgear, D-Link, and ASUS models. The admin panels are accessible at:
If you have never changed the admin password on your router, do it right now before you finish reading this article.
2. Local Host File Modification
On Windows, macOS, and Linux, the hosts file is checked before any DNS query is sent. Malware frequently modifies this file to redirect specific domains, typically banking sites, to attacker-controlled IPs. The attack is targeted and surgical: everything else resolves normally, so the victim rarely suspects anything.
3. Rogue DNS Resolver at the ISP or Network Level
Nation-state actors and rogue ISPs have been documented replacing legitimate DNS responses in transit. Your device sends a query to 8.8.8.8, an in-path device intercepts the response, and substitutes a fake IP before the packet reaches you. Without DNS over HTTPS (DoH) or DNS over TLS (DoT), you cannot tell the difference.
4. Registrar or Authoritative DNS Compromise
In high-value attacks, attackers target the domain registrar itself or the authoritative DNS provider. They change the NS records or A records for a target domain at the source. Every resolver on the planet then serves the fraudulent IP because it is coming from the legitimate authoritative nameserver. This happened to major companies including WhatsApp and Google in various incidents. The attacker does not need to touch your device or router at all.
Why DNS Hijacking Is So Dangerous
Several factors make this attack uniquely destructive. First, DNS runs on UDP port 53 and responses are trusted implicitly by default. There is no built-in authentication in traditional DNS. Second, because the connection lands on an attacker-controlled server that has a valid TLS certificate (Let's Encrypt will happily issue a cert for a domain you control), your browser may show a padlock, giving users a false sense of security. Third, the attack can persist for months on a compromised router with no indication to any device on the network.
How to Detect DNS Hijacking
Check Your Router's DNS Settings
Log into your router admin panel using the addresses listed above. Navigate to Advanced > Network > WAN (TP-Link) or Internet > DNS Address (Netgear) or WAN > WAN DNS Setting (ASUS). The DNS server addresses listed there should match what your ISP provides, or a trusted public resolver you configured yourself such as 1.1.1.1 or 8.8.8.8. If you see an unknown private IP like 192.168.1.x that is not your router itself, or any public IP you do not recognize, that is a red flag.
Query a Known Domain and Compare
Use nslookup or dig to ask your current DNS resolver what IP it returns for a well-known domain, then compare that to what authoritative sources say.
If the IP returned by your local resolver differs from the result you get when querying 8.8.8.8 or 1.1.1.1 directly, your DNS is being manipulated.
Check Your Hosts File
On Windows, open Notepad as Administrator and open the file at C:\Windows\System32\drivers\etc\hosts. On macOS and Linux, run:
The only entries you should see are the localhost loopback lines (127.0.0.1 localhost, ::1 localhost) and anything you deliberately added. Any entries mapping real domain names like your bank or Google to non-standard IPs are a sign of compromise. Delete them immediately, then scan for malware.
Check What DNS Your System Is Actually Using
Cross-reference the DNS servers shown against what you configured. On a DHCP network the router pushes these values, so a rogue router silently overwrites whatever was there before.
Step-by-Step: How to Stop and Fix DNS Hijacking
Step 1: Secure Your Router Immediately
- Log in to your router admin panel (see addresses above).
- Change the admin username and password to something strong and unique. Never leave it as admin/admin or admin/password.
- Check the WAN DNS settings. If they have been modified, set them back to automatic (from ISP) or enter trusted resolvers manually: 1.1.1.1 and 1.0.0.1 (Cloudflare) or 8.8.8.8 and 8.8.4.4 (Google).
- Check under Advanced > Security or equivalent whether remote management is enabled. If you did not enable it, turn it off.
- Update the router firmware. On TP-Link this is under Advanced > System > Firmware Upgrade. On ASUS it is under Administration > Firmware Upgrade. Manufacturers regularly patch the vulnerabilities attackers exploit.
- If you suspect deep compromise, perform a factory reset and set it up from scratch with new credentials.
Step 2: Flush Your DNS Cache
After correcting the settings, flush cached records so your devices start fresh.
Step 3: Enable DNS over HTTPS or DNS over TLS
Encrypting your DNS queries prevents in-path interception. In Windows 11, go to Settings > Network and Internet > Ethernet or Wi-Fi > Hardware Properties > DNS server assignment > Edit. Set preferred DNS to 1.1.1.1, toggle DNS over HTTPS to On. In Firefox, go to Settings > Privacy and Security > DNS over HTTPS and select Max Protection. In Chrome, go to Settings > Privacy and Security > Security > Use secure DNS.
On your router, if it supports DNS over TLS (some newer ASUS and TP-Link models do), enable it under WAN > DNS Privacy Protocol. This protects every device on the network without per-device configuration.
Step 4: Clean Any Hosts File Modifications
If you found suspicious entries in your hosts file, delete them and run a full malware scan with a reputable scanner (Malwarebytes, Windows Defender Offline Scan, or equivalent). The hosts file is often modified as part of a broader malware infection, so treat it as a symptom, not the whole problem.
Step 5: Check for Rogue DHCP on the LAN
Advanced attackers sometimes put a rogue DHCP server on your LAN that hands out malicious DNS settings to devices before your legitimate router can respond. If flushing and reconfiguring the router does not help, check what DHCP server your device is actually getting its IP lease from.
The DHCP server address should be your router's LAN IP (typically 192.168.0.1 or 192.168.1.1). Any other address means something else on the network is handing out settings.
How to Verify the Fix Worked
After completing the steps above, repeat the dig or nslookup tests from earlier and confirm that your resolver is now returning the same results as querying 8.8.8.8 directly. Then check a few critical domains: your bank, your email provider, your company VPN login page. If results match across all resolvers, you are clean.
Preventing DNS Hijacking Long Term
- Change all default router credentials the moment you install any new device. This eliminates the single most common attack vector.
- Keep router firmware updated. Subscribe to your router manufacturer's security advisory list. Critical CVEs for consumer routers are discovered and patched several times a year.
- Use DNSSEC-validating resolvers. Cloudflare's 1.1.1.1 and Google's 8.8.8.8 both validate DNSSEC signatures, which detects tampering with authoritative records even if your resolver has been pointed at them legitimately.
- Enable DoH or DoT everywhere you can. Encrypted DNS prevents in-path interception at the ISP or network level.
- Monitor for unexpected DNS changes. Tools like GlassWire on Windows can alert you when your configured DNS servers change. On Linux, auditd can watch /etc/resolv.conf for modifications.
- Use a VPN on untrusted networks. Coffee shop Wi-Fi, hotel networks, and conference venues are prime locations for rogue DHCP and in-path DNS manipulation. A reputable VPN tunnels your traffic including DNS queries away from the local network entirely.
- If you manage a domain, lock it at your registrar. Enable registrar lock (also called domain lock or transfer lock) and two-factor authentication on your registrar account. This prevents attackers from modifying your NS records even if they compromise your registrar credentials.
A Note on ISP-Level DNS Interception
Some ISPs practice what they call DNS-based filtering or NXDOMAIN hijacking, where failed DNS lookups (domains that do not exist) return a search page full of ads instead of the proper NXDOMAIN response. While this is technically a form of DNS hijacking, it is less malicious than attacker-driven redirection. It does, however, break certain applications and security tools that rely on NXDOMAIN responses to detect phishing domains. Switching to a third-party resolver like 1.1.1.1 or 8.8.8.8 eliminates this behaviour entirely.
The Bigger Picture
DNS was designed in a time when the internet was a trusted academic network and authentication was not a priority. Decades later, that foundational layer still carries almost all internet traffic without built-in verification. DNSSEC, DoH, and DoT are the industry's answers, but adoption is still incomplete. Until DNS is universally secured at every layer, hijacking will remain an effective and widely-used attack technique. The best defence is layered: harden your router, encrypt your queries, validate responses, and monitor for anomalies. None of these steps requires expert knowledge, just a few minutes of configuration and the awareness that the problem exists.