How DNS works (and how attackers hijack it)

Every time someone types your web address, their computer has a problem. It doesn't know where the website is. Computers find each other by number, an IP address, not by name. DNS, the Domain Name System, turns a name like nexcentric.com.au into that number so the page can load, and it points your email the same way. Point either one the wrong way and people arrive somewhere you don't control, while the address on screen still looks right.

What DNS is

A domain name is for people. The number behind it is for the network. DNS is the phone book between them.

When the domain was registered, someone named the servers that answer for it. Those servers hold the records for the website and for email. Staff type the name and the site opens.

The lookup, step by step

The computer asks a resolver where the name is. The resolver is usually run by the internet provider, or by whatever the office network is set to use. If it already knows the answer, it replies at once. If it doesn't, it asks a root server, which only knows where the servers for .com.au live. Those point to the name servers for your domain, and those send back a number. The computer connects, and the page loads. It usually takes a fraction of a second.

Email rides a different record, so the website and the inbox can be moved separately.

Why the next visit is faster

Resolvers and computers remember answers. That memory is a cache. Each record is kept for a set time, called the time to live.

The cache is why the next visit is fast, and why a change is slow to appear everywhere. After an update, some people still receive the old answer until their copy expires.

Hijacking DNS, and taking over the account

Two tricks end the same way. Someone types your real address and lands somewhere else.

DNS hijacking poisons the phone book. The lookup is interfered with, so the resolver returns the wrong number. The address bar still shows your domain.

A domain account takeover doesn't touch the lookup. Someone signs in at the registrar, where the name was bought, or at the service that hosts the DNS, and changes the records. The website can ask customers for passwords. Email, including invoices and password resets, can go to a server they control. The name stays the same.

On paper the business still owns the name. Control comes back only when the account is recovered and the records are put right. The way in is an ordinary one: a reused password, a former staff member, a shared inbox, or a supplier who registered the domain in their own name.

A practical checklist

• Turn on multi-factor authentication for the registrar login. A password alone shouldn't be able to move the website or the email. How MFA works is that second lock, and the prompt you should never approve.
• Turn on the registrar lock, also called a domain lock, so the name can't be transferred without an extra step. A transfer lock and a lock on the name servers aren't always the same switch. Turn on both if you have the choice.
• Review who has access. List every login that can change the domain or its records, remove anyone who has left, and drop shared passwords. The registrant, the legal holder of the name, should be the business.
• DNSSEC is worth considering, and it isn't a replacement for the three checks above. It signs the answers for your domain so a resolver can detect answers that were altered on the way. Turn it on when your registrar and DNS host support it cleanly. Someone who is already logged in can still publish new signed records, which is why the login and the lock come first.

If the site stops being yours, or mail fails and nobody can say why, contact the registrar, recover the account, and restore the records. Tell staff before customers start forwarding messages that look like yours.

If you'd rather hand this on

The registrar login sits alongside email, backups, the firewall and your administrator accounts. Looking after that whole set, including who can change what, is what managed IT is for. Nexcentric does that for Australian businesses, with a local team and the scope in writing.

If you want a second look at the registrar account, book a free review. We'll say what we find, including when nothing needs changing.

The free tools cover the cost of managed IT, where the business sits on the Essential Eight, and a short cyber awareness course for staff. The Weekly Byte is the note we send when there is one practical thing worth passing on.