Topic starter
11/11/2026 6:01 pm
TL;DR: DNS hijacking lets users reach the correct URL while MarkMonitor says they are still redirected to a malicious front end. That shifts security focus to domain-layer governance, where resolution changes can undermine trust even when the core application remains intact.
Editorial analysis by NHI Mgmt Group, based on content published by MarkMonitor: “DNS Hijacking, Registry Lock, and Enterprise Domain Risk”.
By the numbers:
- ICANN said its enforcement of DNS abuse mitigation requirements from April 2024 to August 2025 directly mitigated nearly 20,000 malicious domain names.
Key questions
Q: Why does registrar access create domain hijack risk?
A: Registrar access can change a domain’s nameservers, contact details, or transfer status, so a compromised registrar account can redirect traffic or enable an unauthorised transfer.
Q: What is the difference between registrar lock and registry lock?
A: Registrar lock is a status at the domain registrar that blocks routine transfers, while registry lock is a stronger control at the domain registry that prevents changes such as transfer, deletion, or nameserver updates until out-of-band verification.
Q: How do DNS hijacks redirect users without breaking the site?
A: A DNS hijack changes the resolution layer, so the browser still reaches what looks like the expected domain while the request is sent to a different destination.
Practitioner guidance
- Audit critical domains for change authority Map every business-critical domain to the person or team that can change records, transfers, and ownership, then identify where approval paths are informal or undocumented.
- Apply registry-level locking to crown-jewel domains Use registry lock or an equivalent approval model on domains that support authentication, customer journeys, email, or regulated communications.
- Reduce registrar sprawl and inherited ownership Consolidate domains where possible so security, legal, and IT can govern renewals, locks, and DNS settings from one operating model.
Bottom line: DNS hijacking is a domain-layer trust failure, so a healthy backend does not eliminate the customer risk.
Glossary terms: DNS Hijacking, DNS Resolution Path, Registry Lock, Lookalike Domain
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
DNS hijacking succeeds because trust is anchored too high in the stack. Organisations often harden applications, cloud services, and backend infrastructure while treating the domain layer as routine administration. That leaves the resolution path as the weakest trust point, even though customers experience the domain name first. The governance lesson is that domain control is part of identity and trust, not just internet plumbing.
A question worth separating out:
Q: What is the difference between registrar lock and registry lock?
A: Registrar lock is a status at the domain registrar that blocks routine transfers, while registry lock is a stronger control at the domain registry that prevents changes such as transfer, deletion, or nameserver updates until out-of-band verification. Registry lock usually protects against registrar account compromise as well as direct registrar misuse.
👉 Read our full editorial: DNS hijacking can send users to malicious sites through legit domains