DNS Hijacking How to Detect It and Stop It Fast

Your browser loads a site that looks exactly right, but something feels off — the padlock is missing, the login page seems slightly different, or your antivirus just fired an alert. DNS hijacking is one of the most insidious network attacks because it can redirect you to malicious servers without touching a single file on your computer. The domain in your address bar looks legitimate, the page looks familiar, and yet every credential you type goes straight to an attacker. This guide walks you through exactly how to detect DNS hijacking using command-line tools, router admin panels, and third-party checks — then shows you how to lock things down so it does not happen again.

What DNS Hijacking Actually Is

DNS hijacking is the unauthorized modification of DNS query responses so that a domain name resolves to an IP address chosen by an attacker rather than the legitimate one. Instead of example.com pointing to 93.184.216.34, a hijacked response might return 198.51.100.77 — a server under attacker control that serves a convincing clone of the real site.

There are four common forms of this attack:

• Local hijacking: Malware on your machine modifies the hosts file or replaces the DNS server settings at the OS level.
• Router hijacking: An attacker changes the DNS settings in your home or office router — either through a compromised admin password or a router vulnerability — so every device on the network is affected at once.
• ISP-level hijacking: Some ISPs redirect NXDOMAIN responses (non-existent domains) to their own ad-serving pages. This is technically hijacking even if the motivation is commercial rather than criminal.
• Rogue DNS server / man-in-the-middle: Attackers intercept unencrypted DNS traffic (UDP port 53) between your resolver and the authoritative server and inject forged answers — a technique called DNS cache poisoning.

Warning Signs That Your DNS May Be Hijacked

Before running any commands, look for these red flags:

• Sites you visit every day suddenly show certificate errors or load slowly.
• Your browser is redirected to a search page you did not set when you mistype a URL.
• Security sites (antivirus update servers, security blogs) are unreachable or load incorrectly.
• Ads appear on sites that normally do not have them, or existing ads are replaced with unfamiliar ones.
• You receive browser warnings about invalid certificates on normally-trusted sites.
• Your router admin page looks different, or you cannot log in with your normal password.

Step 1: Check Your Current DNS Server

The fastest first step is to find out which DNS server your computer is actually querying. This should match what you intentionally configured — whether that is your ISP's resolver, Cloudflare (1.1.1.1), Google (8.8.8.8), or a corporate DNS.

On Windows

Look at the output. If you see an IP address you do not recognize — especially a private IP like 192.168.1.1 that points to your router when you expected a public resolver — that is your first clue. Follow up by checking the router itself (Step 3).

On macOS and Linux

On modern macOS (Ventura, Sonoma), scutil --dns gives a more accurate picture than resolv.conf because the OS uses a system-level DNS dispatcher. Compare the nameserver lines against what you configured in System Settings > Network > DNS.

Step 2: Query a Known Domain and Compare the Result

Use nslookup or dig to resolve a well-known domain and then verify the returned IP against a trusted external source.

Run the plain dig google.com and the forced @8.8.8.8 version side by side. If the IP addresses differ, your local resolver is returning a different answer than Cloudflare or Google — a strong indicator of hijacking or poisoning. Minor differences are normal for large CDN-backed domains (Google uses anycast), but the returned IPs should all belong to the same organization. Use DNS Lookup tool to cross-reference any suspicious IP against the authoritative record for that domain.

Step 3: Inspect Your Router's DNS Settings

Router hijacking is the most common form for home users. An attacker who gains access to your router admin panel can change the DNS server pushed to all devices via DHCP with a few clicks — and most users never notice.

How to Access Your Router Admin Panel

Open a browser and navigate to your router's admin URL. Common addresses by brand:

• Netgear: routerlogin.net or 192.168.1.1
• TP-Link: tplinkwifi.net or 192.168.0.1
• ASUS: asusrouter.com or 192.168.1.1
• Linksys: 192.168.1.1
• D-Link: 192.168.0.1

If you cannot reach your router's admin page at all, or your admin password no longer works, treat that as a serious red flag — reset the router to factory defaults immediately.

Where to Check DNS Settings

Once logged in, navigate to the WAN or Internet settings section. Look for a field labeled Primary DNS and Secondary DNS. These are the servers your router uses for its own lookups and, depending on configuration, may also be pushed to LAN clients via DHCP.

Then check the DHCP server settings (often under LAN or Local Network). There will be a DNS field there too — this is what gets handed out to every device that connects. Both entries should show either your ISP's DNS IPs, a resolver you deliberately configured (e.g., 1.1.1.1, 8.8.8.8, 9.9.9.9), or your router's own LAN IP if it is acting as a pass-through.

If you see an IP address you do not recognize in either field — especially one that is not from a known public resolver or your ISP — change it immediately and change your admin password.

Step 4: Check the Hosts File for Local Hijacking

Malware frequently modifies the operating system hosts file to redirect specific domains before DNS is even consulted. This file has the highest priority in name resolution.

Windows

macOS and Linux

A clean hosts file will contain only a few lines for localhost and 127.0.0.1 and possibly IPv6 entries for ::1. Any line that maps a real domain name — like google.com, paypal.com, or your bank's domain — to an external IP address is a hijack entry. Delete those lines and save the file (you will need administrator / root privileges).

Step 5: Use an Online DNS Leak and Hijack Test

Several services let you quickly verify whether your DNS resolver is who you think it is:

• dnsleaktest.com — Shows which DNS servers are handling your queries. Run the extended test to see all resolvers in use.
• whoami.akamai.net — Returns the IP address of the recursive resolver that queried Akamai's authoritative server on your behalf.
• bash.ws/dnsleak — Another independent DNS leak checker.

If the resolver shown is not your ISP and not a public DNS you configured, investigate further.

Step 6: Check for BGP or ISP-Level Redirection

If your local machine and router look clean but results are still wrong, the hijacking may be happening upstream — at the ISP or transit level. This is harder to confirm but traceroute can help reveal where your DNS traffic is being intercepted.

If the path terminates at an IP that is not Google's infrastructure, or takes an unexpected detour through an unfamiliar network, your ISP or an upstream provider may be intercepting DNS traffic. At that point, switching to DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) is the right countermeasure — it encrypts your DNS queries so they cannot be intercepted or modified in transit.

How to Prevent DNS Hijacking Going Forward

Secure Your Router

• Change the default admin credentials immediately on any new router. Use a strong, unique password.
• Disable remote management (WAN-side access to the admin panel) unless you specifically need it.
• Keep firmware updated — router vulnerabilities are a primary attack vector for DNS hijacking campaigns.
• Disable UPnP if you do not need it; it can allow malicious devices on your network to change router settings programmatically.

Use Encrypted DNS

Plain DNS over UDP port 53 is completely unencrypted and trivially interceptable. Switch to a resolver that supports encryption:

• DNS-over-HTTPS (DoH): Available natively in Firefox, Chrome, Edge, and Windows 11. Configure it in browser settings or at the OS level.
• DNS-over-TLS (DoT): Supported by Android 9+ (Private DNS setting), and by resolvers like Cloudflare (1dot1dot1dot1.cloudflare-dns.com) and Google (dns.google).
• DNSSEC validation: Ensures that DNS responses are cryptographically signed and have not been tampered with. Check whether your resolver validates DNSSEC — Cloudflare and Google both do.

Enable DNSSEC on Your Domains

If you manage your own domains, enable DNSSEC through your DNS host or registrar. DNSSEC creates a chain of cryptographic signatures from the root zone down to your domain's records. Clients using validating resolvers will reject any forged DNS response for your domain that lacks a valid signature.

Monitor DNS Changes

Set up monitoring that alerts you if your domain's DNS records change unexpectedly. Many DNS management platforms (Cloudflare, AWS Route 53, DNSimple) offer change notifications. Third-party monitoring tools like UptimeRobot can alert you if your site starts resolving to an unexpected IP address.

What to Do If You Confirm a Hijack

1. Disconnect affected devices from the network immediately to prevent further credential theft or data exfiltration.
2. Factory-reset your router and configure it from scratch — do not restore from a backup config file, which may contain the malicious DNS settings.
3. Run a full malware scan on every device that was on the network, using a reputable scanner run from a bootable USB if possible.
4. Change all passwords that were used during the period the hijack was active — email, banking, social media, and any work accounts.
5. Enable multi-factor authentication everywhere it is available. Even if an attacker captured your password through a phishing page served via DNS hijacking, MFA prevents account takeover.
6. Report the incident to your ISP if upstream hijacking is confirmed, and file a report with your national cybersecurity authority (CISA in the US, NCSC in the UK, CCCS in Canada).

Quick Reference Command Summary

DNS hijacking is a serious threat but it is entirely detectable and preventable with the right habits. The attack depends on users not noticing subtle inconsistencies in their network environment. Regular checks of your DNS configuration, encrypted DNS resolvers, locked-down router settings, and DNSSEC-enabled domains collectively make you a very hard target. Run through the detection steps above now — it takes under five minutes — and you will know immediately whether your DNS is clean or compromised.