SentryFi- SentryFi
- DNS guides
- DNS hijacking
DNS
How to check if your DNS is hijacked
DNS hijacking means someone answers your address lookups with addresses of their choosing. Some networks do a mild version for good reasons; others don’t.
Compare the answers your network gives for well-known sites with the answers from a trusted DNS resolver. If they differ, or if a made-up address gets a real answer, the network is redirecting lookups. Other signs: familiar sites redirecting elsewhere, certificate warnings, and DNS settings you didn’t set on your router. Some hotels and filtered networks redirect lookups legitimately; on your home WiFi, it’s a reason to check the router.
Signs of DNS hijacking
- Familiar sites redirect to unexpected pages, search pages or ads.
- Certificate warnings on sites you use every day, on one network only.
- Router DNS settings you didn’t set.
- Non-existent addresses (typos) load a page instead of an error.
How a DNS comparison works
- Look up several well-known names through the network’s DNS.
- Look up the same names through a trusted resolver over an encrypted connection.
- Compare. Matching answers (allowing for normal CDN variation) are a good sign; answers pointing somewhere else are a warning.
- Look up a random made-up name. It should fail; if it returns an address, the network rewrites lookups.
SentryFi runs this comparison for you, including the made-up-name test, checks whether the network answers lookups meant for outside DNS servers, and shows the result in plain words.
Legitimate reasons networks redirect DNS
- Hotel and airport sign-in pages, before you log in.
- Content filtering in schools, libraries and family-friendly WiFi.
- Some mobile operators answer lookups themselves.
What to do
- On public WiFi: use mobile data or a VPN for sensitive tasks, and never ignore certificate warnings.
- At home: check router DNS settings, change the admin password, update firmware.
- On Android, Private DNS with a trusted provider encrypts lookups (it can block sign-in pages on public WiFi).
Frequently asked questions
Can DNS hijacking steal my passwords?
It can send you to a fake site. With HTTPS, your browser or app will usually show a certificate error, so don’t click through warnings and use official apps.
Does a VPN stop DNS hijacking?
A VPN that sends DNS through its tunnel takes lookups away from the local network. Check that your VPN handles DNS, and see our DNS leak guide.
Is it hijacking if a hotel redirects DNS?
Redirecting lookups to show a sign-in page is a common, legitimate practice. After you sign in, answers should match a trusted resolver.
