Protecting Your Domains and DNS From Hijacking

A domain name is one of an organization's most important assets, and often one of its least protected. Whoever controls the domain controls where the website points, where email is delivered and which servers can obtain trusted certificates in its name. An attacker who changes DNS records can intercept traffic and credentials without breaking into a single server.

In 2019, CISA issued Emergency Directive 19-01 after a campaign of DNS infrastructure tampering, directing federal agencies to audit DNS records, change DNS account passwords, add MFA and monitor certificate issuance. The same steps apply to any organization.

How hijacking happens

• Compromised registrar or DNS provider accounts, through phishing, reused passwords or a weak account recovery process.
• Social engineering of the registrar, where an attacker convinces support staff to change ownership or contact details.
• Dangling records that point to cloud resources the organization no longer controls.
• Expired domains that are re-registered by someone else.
• Tampering with DNS answers in transit or in resolver caches.

The signs can be subtle. A hijacked domain may keep serving a convincing copy of the real website while quietly collecting credentials, or redirect only email, so mail stops arriving or arrives late.

Secure the registrar account

The registrar account is the master key. Protect it accordingly:

• Use phishing-resistant MFA for every user, and remove shared logins.
• Limit access to a small number of named people, and review it regularly.
• Use an organizational contact address monitored by more than one person, not an individual's mailbox.
• Check how the registrar handles account recovery, and choose one with strong verification for ownership changes.
• Consolidate domains with a small number of registrars so nothing is forgotten in an old account.

Apply the same controls to DNS hosting accounts and any cloud console that manages DNS zones.

Use registrar and registry locks

A registrar lock sets status codes that block unauthorized transfers and, depending on the registrar, other changes. A registry lock goes further: the registry itself prevents changes to the domain's registration and name servers until a manual, out-of-band verification is completed. Registry locks are not offered for every top-level domain or by every registrar, and they add friction to legitimate changes, which is the point. Use them for the domains that matter most.

Sign your zones with DNSSEC

DNSSEC adds digital signatures to DNS records so validating resolvers can detect answers that have been forged or altered. It does not protect against an attacker who controls the registrar or DNS account, because they can change the signed records too, and it must be operated carefully, since a key management mistake can make a domain unreachable for validating resolvers. Many DNS providers now manage signing automatically, which reduces that risk.

Restrict certificate issuance with CAA

Certification Authority Authorization (CAA) records list the certificate authorities permitted to issue certificates for a domain. Compliant authorities must check these records before issuing. CAA reduces the chance that an attacker obtains a trusted certificate from an authority you do not use. Pair it with monitoring of Certificate Transparency logs, which record publicly trusted certificates, so you learn about any certificate issued for your domains.

Clean up dangling DNS

When a cloud service, storage bucket or hosted site is deleted but its DNS record remains, the record is left dangling. If someone else can claim the same resource name, they can serve content on your subdomain, a subdomain takeover. Remove DNS records when the resource is retired, include DNS in decommissioning checklists, and regularly check records against resources you still own. Records that point to IP addresses released back to a cloud provider carry a similar risk, because someone else may later be assigned the same address.

Watch for expiry and change

• Turn on auto-renewal and keep payment details current for all domains, including defensive and legacy ones.
• Track expiry dates centrally rather than relying on renewal emails to one person.
• Alert on changes to name servers, registrant details and critical DNS records.
• Monitor for lookalike domains that could be used for phishing.
• Keep a protected record of known-good registration and DNS settings, and include registrar emergency contacts in the incident response plan.

How CDT can help

CDT helps organizations protect the infrastructure their identity depends on. Our hardening engineers review registrar, DNS and certificate configurations, and our managed security team can monitor for unauthorized DNS changes and suspicious certificate issuance.