DNS Changes Can Be as Damaging as Domain Theft
The Domain Name System (DNS) translates a domain name into the technical addresses that route traffic to a website, email server, or other service. A domain does not need to change owners for an attacker or a bad actor to cause serious harm; changing the DNS records alone can redirect a company's website, intercept its email, or route customers to a fraudulent site, often while the domain's registration record appears unchanged.
Because the registration record itself often looks completely normal in these cases, DNS hijacking can be harder to detect than outright domain theft, and the forensic trail lives in a different set of records entirely — hosting and DNS provider logs rather than registrar transfer records.
How Bill Reconstructs What Happened
Reconstructing a DNS hijacking incident generally requires piecing together evidence from several independent sources, since no single provider typically has a complete view of what happened.
- Reviewing historical DNS records through passive DNS databases and archived snapshots
- Identifying the timing and nature of unauthorized record changes (A, MX, NS records)
- Correlating DNS changes with hosting account access logs where available
- Assessing the business impact of redirected traffic, intercepted email, or lost revenue
Because DNS records can be changed back quickly once an intrusion is discovered, preserving evidence of the unauthorized state before it is corrected is often just as important as fixing the underlying problem, and counsel should be looped in before any remediation begins wherever litigation is a realistic possibility.
Bill's reports in these matters walk through the technical mechanism of the redirection step by step, so that a court unfamiliar with DNS can understand exactly how traffic, email, or revenue was diverted without a change ever appearing in the domain's registration record.