Cloudflare has announced that DNS hijacking protection is now enabled by default for all domains, adding automatic protection against account takeover attacks that target domain registration accounts.
This proactive security measure comes after a spike in targeted attacks against domain registrars, where attackers compromise registrar accounts to reroute DNS traffic and intercept sensitive communications.
How It Works:
Hijacking Detection: Cloudflare monitors DNS changes and detects unauthorized modifications to nameserver records in real-time.
Automatic Rollback: Detected hijacking attempts trigger automatic rollback to the previous safe DNS configuration, minimizing attack window.
Alert Notifications: Domain owners receive immediate alerts via email and SMS when hijacking is detected, enabling rapid response.
Historical Registry: Detailed logs of all DNS changes help organizations audit and investigate suspected attacks.
Real-World Impact:
Recent attacks have targeted cryptocurrency exchanges, financial institutions, and cloud service providers, using DNS hijacking to redirect traffic to phishing sites. Cloudflare's new default protection prevents these attacks entirely for its 20+ million domains.
Domain owners using legacy registrars are strongly advised to enable similar protections and implement multi-factor authentication on registrar accounts.
Best Practices:
While Cloudflare's protection is automatic, administrators should also: enable 2FA on registrar accounts, use DNSSEC where supported, and regularly audit DNS records for unauthorized changes.