DNS Hijacking Detector — Side-by-Side Record Comparison

Hijacks often manifest as unexpected A records pointing offshore, MX redirected to attacker mail, TXT stripped of SPF, or NS delegations moved to attacker-controlled hosts. Comparing a trusted reference domain against the production label highlights those drifts per record type.

NS mismatch is especially severe — it suggests delegation itself changed at registrar or parent zone, not merely a record edit inside your zone file.

Both domains must pass domain validation. The handler queries A, AAAA, MX, TXT, NS, and CNAME for each, sorts values, and sets match true when lists are identical. Empty versus populated is a mismatch.

Results return domainA, domainB, and comparison array entries — same JSON shape as DNS compare tool.

Common patterns: compare documented baseline subdomain against apex after incident; compare failover hostname against primary during drills; compare acquired domain against corporate template hostname before integration.

Both inputs are domain names in the backend — not IP addresses. Use hostnames you control or have rights to investigate.

A mismatch routes web traffic elsewhere — users see phishing or ad pages. MX mismatch redirects mail — credentials and MFA tokens may leak. NS mismatch means entire zone control may have shifted — escalate to registrar security immediately.

TXT mismatches may be benign during marketing token rotations — correlate timing with change tickets before declaring hijack.

True hijack detection sometimes requires comparing answers from multiple recursive resolvers and geographic vantage points. This tool compares two domain names on one resolver path each — powerful for baseline drift, not a global resolver mesh.

After suspected hijack, snapshot DNS with dns-history and open registrar case with WHOIS.

On alert, compare production against last known good baseline hostname. Export comparison JSON. Lock registrar account with MFA. Rotate DNS provider credentials. Lower TTL only after authoritative control restored.

Pair with historical DNS lookup snapshots if you saved exports before the incident.

Identical dns-compare action. DNS compare tool emphasizes staging versus production parity; hijacking detector emphasizes security incident framing. API parameters: domainA and domainB.

Use compare tool language for release management; use this page for abuse desk searches.

GET /ip-tools/api/extended?action=dns-compare&domainA=baseline.example.com&domainB=example.com. Fail monitoring when match false on NS or A for production pairs.

Document intentional mismatches in config management so alerts exclude approved drift.

Compare only domains you own or are contracted to investigate. Public DNS data only — read-only queries.

Mismatch results are leads, not automatic proof of malicious intent — verify with registrar logs.