How it works
Every website visit and every mail delivery starts with a DNS lookup. Classic DNS is unencrypted, mostly runs over UDP, and gives the client no way to verify that an answer is genuine. Whoever gets a matching answer in first, or in the right place, decides where the connection goes.
There are several ways to pull this off. An attacker on the same network, say a public Wi-Fi, answers queries directly. A compromised router hands out a rogue resolver. With cache poisoning, the forged answer ends up in a resolver's cache and hits all of its users. Related but different is DNS hijacking, where the real records are changed at the DNS provider or registrar, typically through a compromised account.
DNSSEC makes forged answers detectable, provided the zone is signed and the resolver validates. DNS over TLS or HTTPS only protects the path between the device and its resolver, not the answers the resolver fetches from other servers.
Why it matters
Forged A records send visitors to a lookalike site that harvests credentials or serves malware. HTTPS usually gives it away through the wrong certificate, but only if the site uses HSTS or visitors take the warning seriously.
Forged MX records route mail to the attacker's server. Since mail servers barely check certificates without MTA-STS or DANE, nothing looks wrong during delivery, and confidential messages can be read.
How to prevent it
- Enable DNSSEC for the domain so validating resolvers throw away forged answers.
- Enforce HTTPS with HSTS so a redirected site fails on the certificate instead of loading.
- Use MTA-STS or DANE for mail so senders only deliver to servers with a valid certificate.
- Protect registrar and DNS provider accounts with two-factor authentication and a registrar lock to make DNS hijacking harder.
- Run validating resolvers on your own networks and keep router firmware up to date.
How DomainWarn detects it
DomainWarn cannot directly observe a forged answer sitting in some third-party resolver's cache or on a stranger's Wi-Fi; it only affects users at that spot. Instead, the DNSSEC check verifies that your domain is signed and that the chain validates at a validating resolver. Without DNSSEC it points out that protection against DNS spoofing is missing.
For hijacking at the source, the DNS check helps: it queries records at the authoritative name servers where possible, reports every change, and flags a name server or MX switch as a warning. If a certificate authority issues a new certificate within 24 hours of such a switch, DomainWarn adds the critical change “Certificate issued after DNS change”, the classic pattern of a domain takeover.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.