What's the difference between DNS poisoning and DNS hijacking?

　　DNS (Domain Name System) is the internet's "phone book," responsible for translating human-readable domain names into machine-readable IP addresses. If this translation process goes wrong, websites will either be inaccessible or redirected to unwanted locations.

　　The two most common DNS anomalies are DNS poisoning and DNS hijacking. Many people confuse them, but in reality, their technical mechanisms, attack objectives, outward manifestations, and countermeasures are completely different. Not understanding the differences can lead to detours in troubleshooting—changing DNS settings instead of server configurations, or reinstalling the operating system instead of checking the router.

　　I. The Fundamental Difference: One "Blocks the Path," the Other "Changes the Path"

　　To understand the difference, it's essential to understand the two key nodes in the DNS resolution chain: the authoritative DNS server (which stores the actual resolution records) and the recursive DNS server (which helps you ask the authoritative server for directions). Poisoning and hijacking operate at different points in this chain.

　　DNS poisoning occurs on the path of query result "return transmission." Attackers don't need to control any DNS servers. Instead, they exploit the connectionless nature of the UDP protocol to send a forged DNS response packet to the user's device before the real response arrives. This forged packet points to the wrong IP address (it could be an invalid address, a blocked page, or a malicious site). The user's device receives the fake packet first and discards the real one. The authoritative DNS itself is normal; the problem lies in the transmission link being disrupted.

　　DNS hijacking is more direct—the attacker tampers with the DNS server's own resolution records. Whether it's compromising the ISP's DNS nodes, changing the router's DNS settings, or modifying the local hosts file with malware, the result is always the same: the DNS server returns an incorrect IP address. The user asks the server for directions, and the server points them to the wrong path.

　　In short: DNS pollution is "intercepting midway"—a race between real and fake responses, with the fake one arriving first; DNS hijacking is "insider guidance"—the person asking for directions is deceived. The former is transport layer interference, the latter is server-side tampering.

　　II. Preliminary Diagnosis Based on Symptoms

　　Although both can cause abnormal access, their symptoms differ significantly.

　　The typical symptoms of DNS hijacking are: websites are accessible, but the content is incorrect. You enter a domain name, the page does open, but you're redirected to an advertising page, a ISP-pushed page, or a highly realistic phishing website. Even the address bar may still display the original domain name, but the content is from a different website. This is because hijacking resolves the domain name to a server controlled by the attacker, but the browser still trusts the domain name.

　　The typical symptoms of DNS pollution are: websites are completely inaccessible, or the resolution results are inconsistent globally. Browsers report errors such as "Unable to connect," "Domain name resolution failed," and "SERVFAIL." The same domain name may be accessible in Beijing but not in Guangzhou; inaccessible in China but working normally on overseas nodes. This "randomness" and "regionality" are typical characteristics of pollution.

　　Simple way to remember: Accessible but incorrect content → check for hijacking; inaccessible or intermittently accessible → check for pollution.

　　III. Different Technical Causes and "Perpetrators"

　　Behind these two abnormal paths are different actors.

　　DNS hijacking usually has a clear "attacker" intent: ISP pop-up ads, malicious redirection of public Wi-Fi, hackers infiltrating routers to modify DNS settings, malware tampering with hosts files… these are all typical hijacking behaviors. Attackers want profit—traffic monetization, data theft, phishing scams…

　　DNS poisoning has more complex causes. In some cases, there is "active blocking"—network nodes forcibly return blocking responses for specific domains due to network management or policy reasons. But many are also technical issues: cache poisoning on cross-border links, recursive servers receiving erroneous data and then spreading it, attackers injecting forged records into the cache using vulnerabilities (such as the Kaminsky vulnerability). Poisoning is more like "link-level interference," not necessarily someone trying to steal your data, but the result is that your access is blocked.

　　IV. How to verify which one it is? Practical testing methods

　　Faced with abnormal access, don't guess, just test it to identify:

　　Compare DNS resolution results: Use the nslookup or dig command to resolve the same domain name using both local DNS and public DNS.

　　If the public DNS returns the correct IP address but the local DNS returns the wrong IP address → it's very likely that the local DNS server has been hijacked.

　　If neither is correct, or the results are inconsistent across different nodes globally → it's more likely DNS poisoning.

　　Check your router's DNS settings: Log in to the router's management interface and check if the WAN port or DHCP DNS address has been changed to an unfamiliar IP address. If so, it's hijacking.

　　Survey packets to check the TTL value: Use Wireshark to capture DNS response packets. If the TTL value is abnormally high (e.g., 86400 seconds) or the response source IP does not match the normal value, there is a high probability that it's a forged packet injected with DNS poisoning.

　　V. Countermeasures: Treat the Specific Problems

　　Having clarified the differences, the solutions must also be tailored to the specific issue.

　　If it's hijacking:

　　Change DNS: Changing your local or router's DNS to a public DNS (8.8.8.8, 1.1.1.1) is the most direct solution.

　　Check the router: Change the router's management password and update the firmware to ensure no malicious scripts have been injected.

　　Check your local machine: Check the hosts file and delete any abnormal domain mappings.

　　If it's DNS poisoning:

　　Changing DNS has limited effect: Because poisoning occurs on the transmission link rather than the server side, changing DNS may not solve the problem. However, using encrypted DNS (DoH/DoT) can—encrypting query packets and transmitting them via HTTPS or TLS prevents intermediate nodes from injecting forged responses.

　　Change network exit: If the poisoning is regional, switching to a different network (e.g., using a mobile hotspot instead of Wi-Fi) may bypass the poisoned link.

　　Enterprise-level solution: For website owners, deploying Anycast DNS, enabling DNSSEC verification, and setting up multi-zone intelligent resolution can effectively alleviate cross-border or cross-carrier poisoning problems.

　　DNS poisoning and DNS hijacking are not the same thing. Pollution interferes with DNS resolution results—giving you incorrect information; hijacking controls the resolution process—the person asking for directions is lying to you. The former is "preemptive response," the latter is an "insider attack."

　　For ordinary users, the most crucial distinguishing indicator is this: does the website content match? If it doesn't match, suspect hijacking first; if it's completely inaccessible, consider pollution. Mastering this principle will save you a lot of trouble when encountering DNS anomalies.