DNS security · hijacking defence

DNS Hijacking: What It Is and How to Stop It

When you open a website, your device first asks a DNS server to translate the name into an IP address — the number that lets it actually connect. It does not pick that server itself; it uses whatever the network hands it: your router's setting, your device's setting, or the one your internet provider assigns. DNS hijacking is when an attacker changes that choice, so your queries are answered by a server they control instead of the one you expect. Every address you type then resolves to a fake or malicious site while your browser looks normal. It happens three common ways: router DNS settings changed by an attacker, malware that rewrites your device's DNS configuration, or a compromised ISP that redirects its customers' queries. AEU DNS reduces this risk by being a trusted filtering forwarder you choose yourself — DNSSEC validation confirms the answers you receive are authentic, and encrypted DoH/DoT/DoQ transport locks you to an authenticated endpoint, so a rogue network cannot silently swap in a malicious resolver.

How AEU DNS reduces DNS-hijacking risk

You choose the endpoint, not the network. AEU DNS is a filtering forwarder you point your device to explicitly. A rogue router or DHCP server cannot silently redirect your queries, because your device is configured to a specific, authenticated AEU DNS address.

Encrypted transport locks the connection. DoH, DoT, DoQ and DoH3 carry every query inside TLS. A hijacker cannot impersonate the endpoint without failing certificate verification, so a swapped-in malicious server is rejected.

DNSSEC validation confirms answers. Every answer is checked against its cryptographic signature. Even if a hijacked path serves a forged record, the answer fails validation and is dropped before it reaches your device.

A trusted filtering forwarder, not a resolver. AEU DNS filters ads, trackers and malware, then forwards your query to an upstream resolver — with no logs by design and EU/GDPR jurisdiction, so the server you rely on is one you trust.

Hijacking vs spoofing — two different attacks

They are often confused. One changes who answers; the other forges the answer. AEU DNS defends against both.

DNS hijacking = the wrong server answers. The attacker changes which DNS server your device or router uses, so every query is answered by a server they control — redirecting you before you ever reach the real one.

DNS spoofing = a forged answer. Your device still asks the right server, but an attacker on the path injects a fake reply before the real one arrives.

Different fixes, one defence. Hijacking is stopped by locking your queries to a trusted, authenticated endpoint over encrypted transport; spoofing is stopped by DNSSEC validation. AEU DNS applies both at once.

Protection by design — nothing to toggle

AEU DNS is a privacy-first European filtering forwarder. It filters ads, trackers and malware, validates DNSSEC, and carries every query over encrypted DoH/DoT/DoQ/DoH3 with post-quantum key exchange (X25519MLKEM768) — with no logs by design. Configure it once and every device in your home uses a trusted DNS path.

Stop DNS hijacking in two minutes

Create a free account, get your DNS profile and a personal mTLS certificate, and copy-paste one configuration onto any device.

Create your account

Keep exploring

Start from the AEU DNS home page, or read how encrypted DNS works for a plain-language walk-through of how encrypted DNS protects you. See how GDPR-compliant DNS adds a privacy-first European DNS layer.

Frequently asked questions

What is DNS hijacking?

DNS hijacking is when an attacker changes which DNS server your device or router uses, so your queries are answered by a server they control. Every address you type then resolves to a fake or malicious site, even though your browser and address bar look normal.

How does DNS hijacking happen?

The most common ways are: an attacker changes the DNS setting on your router, malware on your device rewrites its DNS configuration, or a compromised ISP redirects its customers' queries. In each case your queries end up at a server the attacker controls.

Is AEU DNS a DNS resolver?

No. AEU DNS is a filtering forwarder: it filters ads, trackers and malware, validates DNSSEC, then forwards each query to an upstream resolver over encrypted transport. It never stores logs by design.

How does encrypted DNS stop hijacking?

With DoH, DoT, DoQ or DoH3 your device connects to a specific, authenticated AEU DNS endpoint over TLS. A hijacker cannot swap in a malicious server because it would fail certificate verification — so the attacker cannot silently redirect your queries.

Does DNSSEC also help against hijacking?

Yes. DNSSEC validation confirms that the answers you receive are authentic and unmodified. Even if a hijacked path serves a forged record, it fails the signature check and is dropped before it reaches your device.