Runbook: DNS Hijack
Security SpecialistOperations & StrategyDevOps
🔑 Key Takeaway: DNS hijacks redirect users to attacker infrastructure. Lock registrar controls, restore authoritative records, force cache abandonment, and verify resolution from multiple resolvers.
Stub runbook. Customize with your DNS provider details and procedures.
Quick Reference
| Field | Value |
|---|---|
| Typical Severity | P1 |
| Primary Responder | Infrastructure SME |
| Last Updated | [Date] |
| Owner | [Name] |
Identification
Symptoms
- Domain pointing to wrong IP
- Users redirected to malicious site
- SSL certificate errors (attacker using different cert)
Confirm DNS Hijack
dig yourdomain.com
# Compare output to expected IP
Immediate Actions
- Regain access to DNS provider account
- Enable 2FA if not already enabled
- Point DNS to known good infrastructure or maintenance page
- Enable DNS lock / registrar lock
Mitigation
[Document your specific DNS provider procedures here]
Prevention
- Enable registrar lock
- Use DNSSEC
- Enable 2FA on DNS provider
- Limit DNS admin access
- Monitor DNS records for changes
Further reading
- Runbooks overview: how the runbooks in this section fit together
- Frontend Compromise: what users see when DNS is redirected
- Domain & DNS Security: registrar and record controls that prevent this
- Incident Response Policy: severity levels, roles, and escalation