August 17, 2026

A DNS hijack is not a BGP hijack

A DNS hijack points the name at an address you do not control. A BGP hijack points the address at an origin you do not control. Users experience both as “the site is weird.” If you only traceroute the name, you will follow the lie you were given.

I resolve the name from more than one resolver, write down the addresses, then run each through an IP lookup and the looking glass. If the A/AAAA records changed and the prefixes still originate from the usual ASN, stay in DNS. If the records are stable and the origin ASN moved, stay in BGP. If both moved, you have a long night and you should still treat them as two tickets.

How a DNS hijack shows up

Registrar lock off. NS set to a stranger. Glue that does not match. Resolvers that disagree because TTLs are still dying. The prefix behind the new address may be a bulletproof host with a boring ROA. That does not make it a BGP prefix incident. It makes it a registrar and DNSSEC incident. If you signed the zone, this is the day you find out whether anyone validates.

Never debug “the website” as one object. Debug the name, then the address, then the path.

How a BGP hijack shows up next to honest DNS

The name still returns your VIP. The VIP’s prefix now originates elsewhere. RPKI invalid if you did the homework. That is the RPKI validator and the glass, not the registrar. I keep a one-page runbook that says “resolve, lookup, glass, ROA” in that order so 3 a.m. me does not skip a step.

Page the team that owns the layer you actually lost. The other team can go back to sleep. That is the whole point of checking both.