DNS Explained: The Quiet Layer Attackers Love to Hijack

You can have a strong password, two-factor authentication enabled, and an updated browser, and still land on a fake banking site with the correct-looking address bar, because the layer that got compromised was never your device at all.

DNS is the quiet translation step between the name you type and the address your device actually connects to.

In this post

1. What DNS actually does, in plain terms
2. Why this specific layer is such a valuable target
3. DNS spoofing and cache poisoning, explained without jargon
4. Router-level DNS hijacking, the more common home scenario
5. DNSSEC and DNS over HTTPS, briefly
6. What you can actually check and change

DNS, the Domain Name System, is one of the most foundational, least visible parts of how the internet works, and precisely because it operates quietly in the background, it rarely gets the attention it deserves in casual security conversations. That obscurity is part of what makes it such a consistently attractive target.

What DNS actually does, in plain terms

Computers on the internet find each other using numerical addresses, IP addresses, not domain names. DNS is the system that translates the domain name you actually type or click, like a bank's website address, into the numerical address your device needs to actually connect to. Every single time you visit a website, your device performs a DNS lookup behind the scenes, asking a DNS server "what numerical address corresponds to this name," before it can connect to anything at all. This happens so quickly and invisibly that most people never think about it, which is exactly the point, it is meant to be invisible infrastructure.

Why this specific layer is such a valuable target

If an attacker can influence what numerical address you get back for a given domain name, they can redirect you to a server they control, while the domain name in your address bar still looks completely correct. This is fundamentally different from a phishing site relying on a lookalike domain you might catch if you read carefully, a successful DNS-level attack can redirect you from the actual, correctly typed, legitimate domain name itself, which is what makes it particularly dangerous and hard for an ordinary user to detect through normal vigilance.

DNS spoofing and cache poisoning, explained without jargon

DNS servers cache, or temporarily store, the results of lookups to make future requests faster, rather than looking up the same domain from scratch every single time. Cache poisoning is an attack that tricks a DNS server into storing an incorrect, attacker-controlled address for a legitimate domain name. Once poisoned, every user relying on that DNS server for lookups gets redirected to the attacker's address for that domain, without any individual action or mistake on their part, until the false entry expires or gets corrected. This has historically affected DNS infrastructure at various scales, from individual routers to, in serious documented cases, larger internet service provider DNS servers affecting large numbers of users at once.

Router-level DNS hijacking, the more common home scenario

For an individual home user, the more commonly encountered version of this problem happens closer to home, literally. Malware, or an attacker who has gained access to your router through weak or default admin credentials, covered in an earlier post on this blog about router security, can simply change the DNS server setting in your router's configuration to point at a malicious DNS server instead of a legitimate one. Every device connecting through that router then unknowingly uses the attacker's DNS server for every lookup, with no indication anything has changed from the user's side at all, since the domain names being typed remain completely correct throughout.

DNSSEC and DNS over HTTPS, briefly

Two separate technical improvements address different parts of this problem. DNSSEC adds a cryptographic signature to DNS responses, letting a resolver verify that the answer it received genuinely came from the legitimate source and was not tampered with in transit, directly addressing cache poisoning style attacks at the infrastructure level. DNS over HTTPS, often shortened to DoH, encrypts the DNS lookup itself as it travels between your device and the DNS server, preventing anyone in between, including on public Wi-Fi, from seeing or tampering with the raw lookup request. Most modern browsers now support DNS over HTTPS directly in their own settings, independent of whatever your operating system or router is configured to use.

What you can actually check and change

• Check your router's current DNS settings against what you actually configured, or your ISP's default, and be suspicious of any unexplained change, particularly following a period of unusual network behavior
• Consider using a reputable third-party DNS provider like Cloudflare's 1.1.1.1 or Quad9, both of which support DNSSEC validation and are documented in detail on Cloudflare's 1.1.1.1 documentation, rather than relying solely on whatever your ISP provides by default
• Enable DNS over HTTPS in your browser's network or privacy settings if it is not already active by default, which most current browsers now support natively
• Secure your router's admin panel with a strong, changed password, covered in more depth in this blog's router security post, since router-level DNS hijacking requires that access as its starting point in most home scenarios

Why this deserves more attention than it gets: DNS sits underneath almost every other security measure people focus on, a strong password does nothing if the site you are entering it into is not actually the site you think it is. It is a quiet layer precisely because it is meant to be invisible infrastructure, and that same invisibility is exactly why it is worth understanding deliberately rather than trusting blindly.

DNS is not something most people need to think about on a daily basis, and that is by design. It is worth understanding at least once, specifically because an attack at this layer bypasses a lot of the vigilance people are taught to apply elsewhere, checking a URL carefully does no good if the correct URL itself has been quietly redirected underneath.