Home Network Security

What Is DNS Hijacking and How Do You Detect It?

May 28, 2026  ·  8 minute read  ·  SentinelHome101

Imagine typing your bank's web address into the browser, seeing the padlock icon, and landing on what looks like your bank's login page, but it's actually a fake site designed to steal your credentials. You did everything right. You typed the correct address. You checked for HTTPS. And you still ended up somewhere dangerous.

That is what DNS hijacking looks like when it works well. It's one of the more unsettling attacks on home networks because it operates completely silently, it doesn't require you to click anything suspicious, and it can affect every device on your network simultaneously.

What DNS Actually Does

Before understanding how DNS hijacking works, it helps to understand what DNS is. DNS stands for Domain Name System and it functions essentially as the phone book of the internet.

When you type google.com into your browser, your computer doesn't actually know what that means at the network level. Networks communicate using IP addresses, numbers like 142.250.80.46. DNS translates the human-readable name into the IP address your computer needs to make the connection.

This translation happens automatically and invisibly every time you visit any website. Your router handles most of these DNS lookups, forwarding them to your ISP's DNS servers or to a service like Google's 8.8.8.8.

How DNS Hijacking Works

DNS hijacking means someone has tampered with this translation process so that certain domain names resolve to the wrong IP addresses, IP addresses controlled by an attacker.

There are several ways this can happen on a home network:

• Router compromise, an attacker gains access to your router (often through default credentials) and changes the DNS server settings to point to a malicious server they control
• Malware on a device, malware on one of your computers changes the DNS settings on that machine directly, affecting only that device
• ISP-level manipulation, some ISPs intercept DNS queries and redirect failed lookups to their own search pages. This is technically a form of DNS hijacking, though a usually benign one.
• DHCP poisoning, an attacker introduces a rogue DHCP server on the network that hands out a malicious DNS server address along with network configuration to new devices

Why It's Difficult to Detect

The reason DNS hijacking is particularly effective is that everything looks normal from the user's perspective. The URL in your browser shows the correct address. The page loads quickly. If the attacker is sophisticated, the fake site looks identical to the real one.

Even HTTPS doesn't fully protect you. While a proper HTTPS implementation will show a certificate warning if the fake site's certificate does not match the domain, attackers who control DNS can also use fraudulently obtained certificates, or they may target sites where users ignore certificate warnings.

How to Check for DNS Hijacking Manually

Method 1: Check your router's DNS settings

Log into your router's admin interface (type your Default Gateway address into a browser). Find the DNS settings, usually under WAN settings, Internet settings, or Advanced network settings.

Your DNS servers should be one of these well-known legitimate services:

• Google: 8.8.8.8 and 8.8.4.4
• Cloudflare: 1.1.1.1 and 1.0.0.1
• OpenDNS: 208.67.222.222 and 208.67.220.220
• Your ISP's DNS servers (usually in the 10.x.x.x or 172.x.x.x range)

If you see any other IP addresses as your DNS servers, especially ones in unusual ranges, that warrants immediate investigation.

Method 2: Run a DNS lookup test from Command Prompt

Open Command Prompt and run:

nslookup google.com

The response will show which DNS server answered the query and what IP address it returned for google.com. You can verify the returned IP is legitimate by comparing it with a trusted source like Shodan or by running the same lookup from your phone on a mobile data connection (not WiFi) and comparing the results.

How to Protect Yourself

• Change your router's admin password, this is the primary defense against router-level DNS hijacking
• Use DNS over HTTPS (DoH), encrypts your DNS queries so they cannot be intercepted or tampered with in transit. Can be enabled in Windows Settings under Network and Internet settings.
• Keep router firmware updated, patched firmware closes the vulnerabilities attackers use to compromise routers
• Use a reputable DNS service, Cloudflare (1.1.1.1) and Google (8.8.8.8) both have active protections against known malicious domains

Automated Detection with SentinelHome101

Manually checking your DNS settings requires knowing what to look for and doing it regularly. SentinelHome101 automates this as part of its network security scan. It checks your DNS server configuration, verifies that known domain lookups return expected results, tests for DNS over HTTPS status, and flags any anomalies for your review.

It also checks for rogue DHCP servers, one of the other methods attackers use to push malicious DNS settings to devices on your network.

What to Do if You Suspect DNS Hijacking

1. Log into your router and check the DNS server settings immediately
2. If the DNS servers look unfamiliar, change them to a known service like 1.1.1.1
3. Change your router's admin password
4. Run a full antivirus scan on every device on your network
5. Consider a factory reset of your router if you cannot identify how the settings were changed
6. Contact your ISP if the problem persists after a factory reset

DNS hijacking is one of those attacks that sounds technical but is ultimately fairly straightforward to check for and defend against. The combination of a strong router password, current firmware, and DNS over HTTPS covers the vast majority of attack vectors available to someone targeting a typical home network.