DNS hijacks of three ccTLDs enabled 2026 issuance of counterfeit TLS certificates for Google domains

Three unspecified ccTLD registries were compromised, allowing attackers to change IP addresses and nameserver delegations for selected domains. With control of authoritative DNS, they completed the domain-control proofs required by multiple certificate authorities and received valid TLS certificates. Chrome deployed targeted blocks for known serial numbers, but Google stated that browser interventions do not cover every affected domain or non-Chrome clients.

Certificate Transparency logs and post-incident analysis have so far identified only a subset of the issued certificates. The slow revocation process forced reliance on browser-level pinning rather than CRL or OCSP updates. No domain-owner infrastructure was breached, and CAs met existing baseline requirements, shifting the failure point to registry-level DNS security.

This incident repeats the 2011 DigiNotar pattern in which forged certificates for Google.com reached Iranian users, yet current CT monitoring reduces undetected issuance windows. It also echoes the 2018 GitHub BGP hijack that demonstrated similar traffic redirection for certificate validation. Persistent gaps remain in DNSSEC adoption at ccTLDs and in mandatory multi-party validation for high-value domains.

Operational response requires mandatory DNSSEC with DANE records, automated certificate revocation lists refreshed within hours, and expanded CT monitoring that feeds directly into browser distrust lists rather than after-the-fact blocks.