DNS Hijacking and Poisoning
DNS attacks redirect domain name queries to malicious servers. This includes DNS cache poisoning, registrar hijacking, and man-in-the-middle attacks on DNS resolution. Users are redirected to attacker-controlled servers while believing they are on the legitimate site.
Overview
DNS hijacking and poisoning attacks manipulate the Domain Name System to redirect users to malicious servers. By compromising DNS resolution, attackers can intercept all traffic destined for a legitimate domain, steal credentials, distribute malware, or conduct surveillance -- all while the victim sees a legitimate URL in their browser.
Types & Variants
DNS Cache Poisoning
Injecting forged DNS records into a resolver's cache.
Registrar Hijacking
Compromising the domain registrar account to change DNS records.
Man-in-the-Middle DNS
Intercepting DNS queries on the network path.
Impact
Complete traffic interception, credential theft, malware distribution, data exfiltration, email interception.
Remediation
Implement DNSSEC, use DNS-over-HTTPS (DoH), enable registrar lock, use multi-factor authentication on DNS management, and monitor DNS records for unauthorized changes.
Implement DNSSEC on all domains
Enable registrar lock and MFA on DNS management
Use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT)
Monitor DNS records for unauthorized changes
Use multiple DNS providers for redundancy
Related SuperClue scanner checks
These scanner checks look for signs of DNS Hijacking and Poisoning. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works