Runbook: DNS Hijack
Security SpecialistOperations & StrategyDevops
Stub runbook. Customize with your DNS provider details and procedures.
Quick Reference
| Field | Value |
|---|---|
| Typical Severity | P1 |
| Primary Responder | Infrastructure SME |
| Last Updated | [Date] |
| Owner | [Name] |
Identification
Symptoms
- Domain pointing to wrong IP
- Users redirected to malicious site
- SSL certificate errors (attacker using different cert)
Confirm DNS Hijack
dig yourdomain.com
# Compare output to expected IPImmediate Actions
- Regain access to DNS provider account
- Enable 2FA if not already enabled
- Point DNS to known good infrastructure or maintenance page
- Enable DNS lock / registrar lock
Mitigation
[Document your specific DNS provider procedures here]
Prevention
- Enable registrar lock
- Use DNSSEC
- Enable 2FA on DNS provider
- Limit DNS admin access
- Monitor DNS records for changes