Your web server, your email, your branding — all of it depends on DNS. If an attacker controls your DNS records, they control where your traffic goes. They can redirect your website, intercept your email, and serve phishing content under your domain name. Your server is untouched. Your certificate appears valid. Nothing looks wrong from the inside.
Only 1.99% of domains have DNSSEC active. Most Irish business domains are fully exposed to DNS-level attacks.
How domain and DNS hijacking works
Registrar account takeover. An attacker gains access to your domain registrar account — via phishing, credential stuffing, or a weak password. They change your nameservers to infrastructure they control. All DNS responses for your domain now come from them.
DNS cache poisoning. An attacker inserts a forged DNS record into a resolver's cache. Users querying that resolver get directed to attacker-controlled infrastructure even though your zone data is correct.
Registrar-level DNS record manipulation. Without proper authentication controls, an attacker who compromises your registrar or DNS provider can modify individual DNS records — redirecting MX records to intercept email, or A records to redirect web traffic.
What actually blocks it
Registrar-side controls:
- Registrar lock (registry lock on high-value domains) — prevents unauthorised transfers
- Strong authentication (hardware key, not SMS) on your registrar account
- Notification alerts on any DNS change
DNSSEC: DNSSEC adds cryptographic signatures to DNS records. A resolver that supports DNSSEC validation will reject any DNS response that doesn't have a valid signature — which means a poisoned cache entry or a spoofed DNS response gets blocked rather than served.
The catch: DNSSEC requires your registrar, DNS provider, and the TLD all to support it — and it must be configured correctly. Misconfiguration causes DNS resolution to fail entirely.
CAA records: CAA records limit which certificate authorities can issue certificates for your domain. Even if an attacker redirects DNS, they can't easily get a certificate from an unauthorised CA — limiting the quality of phishing they can run under your domain.
What your domain's exposure looks like right now
Run the free DomainScores check to see your DNSSEC status, CAA records, and DNS security posture across 34 checks.
Need to lock this down properly? Domain Fix from €1,197 — we configure DNSSEC, CAA, and DNS security controls for your domain. Grade B+ guaranteed, or your money back.