DNS: the internet's phone book, and how it gets abused

On Day 1 we said the very first thing your browser does is ask, “What’s the number for this name?” We promised to come back to it. Today we do, because that small question decides where every request you make actually goes.

If someone controls the answer, they don’t need to break HTTPS or steal a password. They just send you somewhere else.

How a lookup works

Computers on the internet find each other by IP addresses, numbers like 203.0.113.42. People prefer names. The Domain Name System (DNS) is the worldwide directory that connects the two.

When you type cybersearch.in:

1. Your device asks a resolver, usually run by your internet provider, your router, or a public service such as Cloudflare (1.1.1.1) or Google (8.8.8.8).
2. If the resolver doesn’t already know the answer, it asks the servers responsible for .in, which point it to the servers responsible for cybersearch.in.
3. Those authoritative name servers, run by whoever hosts the domain’s DNS, give the final answer.
4. The resolver passes the address back to your browser and remembers it for a while, so the next lookup is instant.

The whole thing usually takes a few milliseconds.

The records worth knowing

A domain’s DNS is a short list of records. A few common ones:

Record	What it says	Example use
A / AAAA	This name lives at this IPv4 / IPv6 address	Where the website is
CNAME	This name is an alias for another name	www pointing to the main domain, or to a hosting service
MX	Send email for this domain here	Your mail provider
TXT	Free text, mostly for verification and email rules	SPF, DKIM, DMARC, ownership checks
CAA	Only these certificate authorities may issue certificates for this domain	Limiting who can get an HTTPS certificate

Notice that email, websites and even HTTPS certificates all depend on these few lines.

Why it matters for security

Because DNS sits underneath everything, problems there are quiet and wide-reaching. The main ways it gets abused, at a high level:

• Hijacked domain accounts. The most common and most damaging. If someone gets into the account at your domain registrar or DNS provider, they can point your domain, and your email, anywhere they like. This usually starts with a reused password and no two-factor login.
• Tampered answers. Historically, attackers could sometimes trick a resolver into caching a false answer, or a compromised home router could hand out a malicious resolver. Users then reach the wrong server while the address bar shows the right name.
• Lookalike domains. Registering names that look like yours (cybersearch-in.com, cyb3rsearch.in) to use in phishing. Nothing is technically broken; people are simply fooled.
• Dangling records. A subdomain like shop.example.com still points, through a CNAME, to a hosting service you stopped using. If someone else can claim that service name, they can serve their own content on your subdomain. This is known as a subdomain takeover.
• Email spoofing. Without the right TXT records, anyone can send email that claims to come from your domain.

Why HTTPS still helps

Remember Day 4: HTTPS checks that the server holds a valid certificate for the name in the address bar. So if a tampered DNS answer sends you to an impostor’s server, the impostor usually can’t show a valid certificate and your browser warns you. That’s one more reason never to click through certificate warnings.

But HTTPS can’t help if an attacker controls your actual DNS records, because then they may be able to get a real certificate issued for your domain. That’s why protecting the domain account matters so much, and why CAA records are worth adding.

How site owners protect their domain

Most of the protection is unglamorous account hygiene:

1. Lock down the registrar and DNS accounts. Use a unique password and two-factor login, ideally a passkey or authenticator app rather than SMS. Limit who has access, and remove people who’ve left.
2. Turn on registrar lock (often called transfer lock). It stops the domain being moved to another registrar without extra steps.
3. Keep renewal on auto, with a valid payment method. Expired domains get bought by other people, sometimes within hours.
4. Enable DNSSEC if your provider supports it. It adds signatures to DNS answers so resolvers can tell if an answer has been tampered with.
5. Add a CAA record naming the certificate authority you actually use.
6. Clean up old records. When you stop using a service, delete the DNS record that points to it the same day. Review the full list of records every few months.
7. Publish SPF, DKIM and DMARC records for email. Start DMARC at p=none to collect reports, then move to quarantine or reject once legitimate mail passes.

What users can do

You can’t control a website’s DNS, but you can make your own lookups harder to tamper with:

• Use encrypted DNS. Modern browsers and phones support DNS over HTTPS or DNS over TLS, often called “Secure DNS” or “Private DNS” in settings. It stops anyone on the network from reading or changing your lookups.
• Secure your router. Change the default admin password and keep its firmware updated, since a hijacked router can quietly swap your resolver.
• Read the domain name before logging in, especially in links from messages, so lookalike domains don’t catch you.

Look up a domain yourself

You don’t need special tools to see a domain’s DNS. Try our free IP & DNS lookup tool, or use a public service like Google’s DNS lookup. Check your own domain’s MX, TXT and CAA records and see whether anything points to a service you no longer use.

What you can do today

If you browse the web:

1. Turn on Secure DNS in your browser or Private DNS on your phone.
2. Change your home router’s admin password if it’s still the default.
3. Bookmark the sites you log in to most, so you never have to type or click your way to a lookalike.

If you run a website:

1. Turn on two-factor login and registrar lock for your domain today. These two steps prevent the worst outcome.
2. Check auto-renew is on and the card on file hasn’t expired.
3. Review your DNS records and delete anything pointing to services you’ve stopped using.
4. Add a CAA record and check your SPF, DKIM and DMARC setup. The Cloudflare learning centre on DNS is a clear reference if you want to go deeper.

Coming up next

On Day 6 we’ll meet the browser’s most important security rule, the same-origin policy: why one website can’t simply read your data from another, and how sites sometimes loosen that rule by accident.