DNS Hijacking & Cache Poisoning Explained — Types, Attacks, Prevention
DNS hijacking and cache poisoning are two of the most dangerous attacks on internet infrastructure. They let attackers intercept, redirect, or forge DNS responses without the victim ever seeing a warning. A successful DNS attack can redirect bank websites to phishing pages, steal email credentials, and compromise corporate networks — all because the first step of every web connection (the DNS lookup) was compromised.
This guide explains the main types of DNS hijacking and cache poisoning, how each attack works at a technical level, and the practical steps you can take to detect and prevent them — whether you are protecting a personal network or securing a production domain.
Types of DNS Hijacking
DNS hijacking is a broad term. It covers any situation where an attacker redirects DNS queries to servers they control. There are several distinct variants, each operating at a different layer of the network.
Router DNS hijacking
Many home routers ship with default administrator passwords. Attackers on the same network (or who have compromised the router through a firmware vulnerability) log in to the router's admin panel, navigate to the DNS settings, and change the DNS server addresses. After that, every device on the network sends DNS queries to the attacker's server.
This is the most common form of home DNS hijacking. It is especially dangerous on public Wi-Fi networks where anyone can access the router's admin interface. The attack is invisible to the victim — the browser shows no error, just the wrong website.
ISP-level hijacking
Some ISPs perform DNS interception at their own infrastructure level, sometimes without the user's knowledge. The ISP's DNS servers silently rewrite certain responses — for example, replacing NXDOMAIN (domain not found) responses with their own advertising page. While not malicious in intent, this practice breaks expected DNS behavior, interferes with DNS over HTTPS, and can introduce vulnerabilities that actual attackers exploit.
Malware DNS hijacking
Some malware modifies the operating system's DNS configuration directly. On Windows, it changes the TCP/IP settings in the registry to point to attacker-controlled DNS servers. On Linux, it edits /etc/resolv.conf. On Android and iOS, it configures a malicious VPN profile that intercepts DNS traffic. This form persists even after a reboot and is difficult to detect without explicitly checking your DNS settings.
DNS hijacking via BGP manipulation
At the internet-scale level, attackers have used BGP (Border Gateway Protocol) hijacking to redirect entire IP address ranges, including DNS server IPs, through their own network. This was used in a real attack in 2018 when researchers observed BGP hijacking redirecting traffic for several major banks and cryptocurrency exchanges through attacker-controlled infrastructure in Russia.
How DNS Cache Poisoning Works
Cache poisoning (also called DNS spoofing) is a different attack from hijacking. Instead of redirecting the victim's queries, the attacker corrupts the cache of a legitimate recursive resolver so that the resolver itself returns the wrong answer.
The most famous cache poisoning attack is the Kaminsky attack, named after security researcher Dan Kaminsky who disclosed it in 2008. Here is how it works:
Step 1: The attacker sends a query to the target resolver for a name the resolver has never seen before (for example, nonexistent.example.com).
Step 2: The resolver does not have the answer cached, so it starts recursively querying authoritative nameservers, beginning at the root and working down.
Step 3: While the resolver is waiting for the legitimate answer, the attacker floods it with forged responses — thousands of them, each guessing the query ID (a 16-bit number) and other parameters. Because 16 bits is a small space, the attacker can guess correctly within seconds.
Step 4: When a forged response with the correct ID is accepted, the resolver caches the fake answer. All future queries for that name (and sometimes all names under the same parent zone) now return the attacker's data.
Modern resolvers have implemented several mitigations — source port randomization, DNSSEC validation, and response rate limiting — but the Kaminsky attack showed how fragile the DNS protocol is without cryptographic verification. Cache poisoning remains possible against resolvers that have not been updated or that do not validate DNSSEC.
How to Detect DNS Hijacking
The simplest detection method is to compare your DNS results against a trusted baseline. Run the same query against multiple DNS servers and compare the responses.
Use our DNS checker tool or run this from the command line:
nslookup example.com 1.1.1.1 (your default resolver)
nslookup example.com 8.8.8.8
nslookup example.com
If the third result differs from the first two, your default DNS is likely hijacked. The IPs in the third query should match one of the other two. If they do not, something is intercepting and rewriting your DNS responses.
For domain owners, you can set up DNS monitoring to alert you when your authoritative nameservers change unexpectedly. A sudden change in NS records, A records, or MX records without your action is a strong indicator that your registrar account has been compromised or a registrar-level hijack is in progress.
You can also run a DNS leak test using our DNS leak test tool to see which servers are actually answering your queries. This is especially useful if you are using a VPN and want to confirm DNS is being routed through the encrypted tunnel.
How to Protect Against DNS Hijacking
Use encrypted DNS
The single most effective defense against both hijacking and cache poisoning is to use DNS over HTTPS (DoH) or DNS over TLS (DoT). These protocols encrypt the connection between your device and the DNS resolver, making it impossible for an attacker on the network to intercept or modify your DNS queries.
Choose a trusted resolver
Use a reputable public DNS provider that implements DNSSEC validation, randomizes source ports, and logs anomalies. Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9), and AdGuard DNS are all strong choices. You can compare them with our fastest DNS test to find the best one for your location.
Secure your router
Change the default administrator password immediately. Enable automatic firmware updates. Disable remote administration unless you need it. Use the strongest Wi-Fi encryption available (WPA3). If your router supports DNS settings, lock them to a trusted resolver — or better yet, run a local recursive resolver like Unbound or dnsmasq that validates DNSSEC on your network.
Monitor domain-level DNS changes
For businesses and domain owners, sign up for registrar lock (ClientHold) so no unauthorized DNS changes can be made without verification. Use registrar two-factor authentication. Set up automated monitoring on NS, A and MX records — any change should trigger an immediate alert. This stops registrar-level hijacking where an attacker logs into your domain registrar account and changes the nameservers.