DNS hijacking is one of the most effective router attacks - it silently redirects all your internet traffic through attacker-controlled servers. Here's exactly how it works and what protects against it.
DNS (Domain Name System) is the internet's phone book - it translates domain names (google.com) into IP addresses (142.250.80.46). Every time you visit a website, your device asks a DNS server for the IP address. DNS hijacking occurs when an attacker alters your DNS settings - either on your device or your router - to point your DNS queries to a malicious server they control.
When an attacker compromises your router (through a CVE, default password, or malware), they can change the DNS server your router tells all connected devices to use. Your devices trust your router's DNS settings - so without knowing it, every website lookup goes through the attacker's DNS server. The attacker can then redirect banking websites, email logins, or any other site to fake versions they control.
Routers with unpatched CVEs, default passwords still in use, or end-of-life firmware are most vulnerable. Chinese-owned brands (TP-Link, Huawei) have also been implicated in government-level DNS manipulation capabilities. Check your router's security grade at ismyroutersafe.com.
Log into your router admin panel and check the DNS server settings (usually under WAN Settings or Internet Settings). Your DNS should show either your ISP's DNS (assigned automatically) or a trusted DNS like 1.1.1.1 or 8.8.8.8. An unfamiliar IP address in the DNS field - especially one you didn't set - may indicate DNS hijacking.
Partially. HTTPS encrypts the content of your web traffic, and browsers show SSL certificate warnings when a site's certificate doesn't match. A sophisticated DNS hijacking attack with fraudulent SSL certificates (possible if an attacker has a trusted certificate) can still intercept HTTPS traffic. HTTPS is important but not a complete defense against DNS hijacking.
DNS-over-HTTPS sends DNS queries encrypted over HTTPS instead of in plain text. This prevents ISPs, attackers, or compromised routers from seeing or modifying your DNS queries in transit. Most major browsers (Chrome, Firefox, Edge) support DoH. Enable it in your browser's security settings for improved DNS privacy.
DNS hijacking is a type of man-in-the-middle (MITM) attack specifically targeting DNS. A MITM attack broadly refers to an attacker positioning themselves between two communicating parties. DNS hijacking achieves this by redirecting traffic at the DNS resolution stage before the connection is even established.
CHECK YOUR ROUTER
Enter your model to get a full security report - FCC status, CVEs, grade, and your action plan.
Check a Router → Top 10 Safe Routers