Is my router's DNS hijacked? Signs and how to check

What DNS hijacking actually looks like

Every device needs DNS to turn a domain name like example.com into an IP address before it can connect to anything — which makes the resolver performing that translation one of the most trusted, least-visible components of your connection. DNS hijacking is when that trust is misplaced: something has changed which resolver your traffic actually uses, redirecting lookups through a server an attacker controls instead of your ISP’s resolver or whichever one you intentionally configured.

Once an attacker controls the resolver a device uses, they can return whatever answer they want for any lookup — sending you to a convincing fake banking site while the address bar still shows the real domain name, injecting ads, or quietly collecting a record of every site you visit. CISA’s advisory on a global DNS infrastructure hijacking campaign documented exactly this pattern at scale: actors who gained access to DNS records used that access to redirect traffic and obtain fraudulent TLS certificates for the affected organizations’ domains — a reminder that DNS hijacking isn’t a theoretical risk, it’s a documented attack pattern used against real infrastructure.

On home and small-office networks, the more common version is simpler: malware or an attacker with router admin access changes the DNS server setting in the router itself, so every device on the network — not just one infected machine — gets redirected through the rogue resolver.

Signs something might be wrong

None of these alone proves hijacking, but any of them is worth investigating:

• Websites you visit regularly look slightly different, show unexpected certificate warnings, or redirect somewhere unfamiliar before loading.
• Your browser or antivirus software warns about an unusual DNS server or a certificate mismatch.
• Devices on your network seem slower to resolve sites, or intermittently fail to load pages that work fine on mobile data.
• You didn’t choose a custom DNS provider, but your router’s settings show one you don’t recognize.
• You recently noticed unfamiliar admin logins, or you’ve never changed your router’s default admin password.

Step 1: confirm your actual resolver

Don’t rely on what your router’s settings page claims — some hijacking malware specifically hides its changes from the router’s own admin interface. AdminKit’s DNS resolver / leak test checks which resolver your connection is actually using, as seen from outside, which is a more reliable signal than reading a settings page that could itself have been tampered with.

If the resolver shown isn’t one you recognize or deliberately configured (your ISP’s default, or a public resolver you intentionally set like Cloudflare or Google), treat that as a strong signal worth investigating further.

Step 2: check your router directly

1. Log into your router’s admin page using its IP address (commonly printed on the device, or found via your computer’s network settings) — change the admin password first if you discover it’s still the factory default, since that’s one of the most common ways routers get compromised in the first place.
2. Check the WAN/Internet DNS settings for any custom resolver that doesn’t match what you or your ISP set.
3. Check for unfamiliar admin accounts or remote-management settings — some router malware adds its own persistent access rather than just changing one setting.
4. Check the firmware version against the manufacturer’s latest release — many router-hijacking campaigns specifically exploit known, patched vulnerabilities in outdated firmware.

Step 3: verify a specific domain isn’t being tampered with

If you suspect a specific site is being redirected, DNS lookup lets you see exactly what records a domain publishes from AdminKit’s own resolver path — comparing that against what your own network returns for the same domain can reveal a discrepancy, though for a conclusive comparison you’d need to check from a network you’re confident isn’t compromised.

Step 4: fix it

• Change the router admin password immediately, ideally from a device on a different network or one you’re confident is clean.
• Reset DNS settings to your ISP’s default, or explicitly set a resolver you trust (your ISP’s, or a public one like Cloudflare’s 1.1.1.1 or Google’s 8.8.8.8), rather than leaving whatever was there.
• Update the router’s firmware to the latest version from the manufacturer.
• Factory-reset the router if you can’t be confident about what else might have changed, then reconfigure from scratch with a strong admin password.
• Check every device individually too — some malware changes DNS settings on an individual computer or phone rather than (or in addition to) the router, so a clean router doesn’t guarantee every device is clean.
• Check router-level parental control or ad-blocking features you may have enabled yourself in the past — these sometimes work by pointing DNS at a third-party filtering service, which can look identical to hijacking in a resolver test if you’ve forgotten you set it up.

A note on public Wi-Fi and unfamiliar networks

Everything above assumes you control the router in question. On a network you don’t control — a café, hotel or airport Wi-Fi — you can still run the same resolver check to see what you’re being handed, but you have no way to fix a suspicious result beyond disconnecting and using a trusted network or your own mobile data instead. Treat any unexpected resolver on a network you don’t manage as a reason for caution rather than something to troubleshoot on the spot, since you have no way to confirm whether it reflects normal configuration by the network operator or something worse.

Why this matters beyond one check

A one-time check tells you about right now; router settings can be changed again later, especially if the original vulnerability (weak password, outdated firmware) isn’t fixed. If you’re also unsure whether your connection is behind a shared IP, which changes how some of these signals should be interpreted, see our CGNAT guide. AdminKit’s planned Protective DNS is designed to give ongoing visibility into which resolver your devices actually use and flag unexpected changes automatically — it is in early access and not available yet, so a periodic manual check with the free resolver test remains the practical option today.