DNS Spoofing & Hijacking

What it is

DNS maps names such as website domains to destinations. Spoofing falsifies answers; hijacking changes legitimate DNS settings or records through compromised access. These are related but distinct paths. Manipulation can redirect web traffic or email, while a properly validated HTTPS connection may still reject a destination that cannot prove the expected domain identity.

How it works

An attacker may compromise a registrar account, alter authoritative records, change router resolver settings, or manipulate a resolver response. Each path affects a different part of name resolution. DNSSEC validates signed DNS data where deployed; encrypted DNS protects the exchange to a resolver, but neither simply declares every destination honest.

How people get tricked

Users may type the correct address and assume the resulting page must be correct. Administrators may neglect registrar security because it seems separate from hosting, although changing records can redirect critical services.

Example scenario

A compromised registrar account changes a company's mail records. Incoming messages are sent to attacker-controlled infrastructure even though employees continue using the company's familiar domain.

Warning signs

• Unexpected authoritative-record or registrar-account changes.
• Several devices resolve a familiar name to an unexplained destination.
• New certificate errors or unusual email delivery patterns.

If it happens to you

Secure compromised administration, restore correct records, and account for cached answers while changes propagate. Investigate web and mail exposure, review certificates, and rotate affected secrets. Fix the specific layer involved rather than assuming a browser reset resolves authoritative hijacking.