Hijacked DNS: when someone else answers for your name
If the query goes to the wrong address, everything else keeps working and you do not notice straight away. That is why it is worth knowing how to check.
What DNS hijacking is
DNS hijacking is when the queries of a device stop reaching the real name server and start reaching one chosen by somebody else. It happens in three ways: the router configuration was changed, malicious software on the device altered the address, or someone in the middle of the network answers before the legitimate server does.
The effect is serious precisely because it is silent. The addresses returned are not random: the attacker can point them at servers they own, capture what you send and, in common cases, simply declare an advertising server in place of the site.
The signs it shows in practice
The first sign is in the browser: sites that open do not open, open slowly, or show an invalid certificate warning on pages that worked before. The second is the content: ads or redirections appear on every site, including ones you do not usually visit.
The third is the answer itself. If the same name, looked up through two different resolvers, returns different addresses, there is an inconsistency worth investigating. Addresses in unexpected ranges, or always the same address for names that should sit on different servers, are a reason to check the configuration.
How to check and fix
The simplest check is to compare: query the same name through two independent resolvers and see whether the addresses match. If they differ, the problem lies between your device and one of them, and the cause is usually the router configuration or the device itself.
After fixing it, it is worth locking the choice down. Using encrypted DNS with a server you chose, and logging the queries per device, makes any change in the answers show up as something you did yourself. On public networks, encrypted DNS stops the local network from answering in place of the server.