What is Domain Hijacking and How to Prevent It

Domain hijacking is the unauthorised takeover of a domain name, either by changing its registration (owner, contacts or registrar) or by changing the DNS so that traffic goes somewhere the owner did not intend. The result is the same in both cases: the attacker decides where your website points, who receives your email and which certificates can be issued for your name. This article focuses on how hijacks actually happen, what the early warning signs look like and what to do in the first hours if it happens to you.

What counts as domain hijacking

The term covers a few different situations that are worth separating, because the response differs:

• Registration hijacking: the attacker gains control of the domain at the registrar or moves it to another registrar, often changing the registrant details.
• DNS hijacking: the registration stays with you, but the nameservers or individual records are altered, for example to point the website or MX records at attacker infrastructure.
• Loss through expiry: the domain lapses and someone else registers it legitimately once it is released. Technically this is not theft, but the practical damage can be identical.

DNS hijacking at scale is a documented threat. In January 2019 the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 19-01 after a campaign in which attackers used stolen credentials to alter DNS records of government domains. It required agencies to audit records, change passwords and enable multi-factor authentication on DNS accounts.

Why attackers want your domain

A domain is valuable to an attacker even when the website itself is small. Control of the name gives them several things at once:

• Trust: visitors, customers and partners already recognise the name, so phishing pages and emails hosted on it are far more convincing than a look-alike domain.
• Email interception: by changing MX records they can receive new mail, including password reset links for cloud, payment and social media accounts tied to addresses on your domain.
• Certificates: with DNS control they can pass domain validation and obtain valid TLS certificates, making a fake site look secure in the browser.
• Resale or extortion: short or brandable names can be sold on, or held while the owner is asked to pay for their return.

Understanding these motives explains why hijacks often go unnoticed for a while: an attacker interested in email or credentials may leave the website untouched and change only one record.

Attack path 1: registrar and DNS account takeover

The most direct route is logging in as you. Attackers obtain credentials through phishing pages that imitate registrars, password reuse from unrelated data breaches, malware on an administrator’s computer or a compromised password manager export. Once inside, they can:

• change nameservers to infrastructure they control;
• edit A, CNAME or MX records at the DNS provider;
• remove the transfer lock and request an authorisation code;
• change the account email so that alerts no longer reach you.

Phishing emails often mimic routine messages such as an expiry notice, a failed payment or a verification request. A registrar login page reached from an email link deserves suspicion.

Attack path 2: email compromise and social engineering

If attackers cannot log in directly, they target what the login depends on. Taking over the email inbox registered on the account allows a password reset. Hijacking a phone number through SIM swapping can defeat SMS-based verification. Some attackers contact registrar support directly, pretending to be the owner, with forged documents or a convincing story about a locked-out employee.

A specific weakness arises when the account email uses the same domain it manages. If an attacker can alter DNS even briefly, they may be able to receive mail for that address and use it to complete a reset.

Attack path 3: transfer fraud

A transfer to another registrar requires the domain to be unlocked and a valid authorisation (EPP) code. Attackers who obtain both can move the domain to a registrar of their choice, sometimes in another jurisdiction, which makes recovery slower. They may obtain the code through account access, a phishing email asking you to "confirm" a transfer, or a compromised contact address.

The ICANN Transfer Policy adds protections, including restrictions on transfers shortly after registration or a previous transfer, and disputes between registrars can be escalated through the Transfer Dispute Resolution Policy. The domain transfer lock guide explains how locks and authorisation codes interact.

Attack path 4: expired-domain re-registration

When a domain expires and is eventually deleted, anyone can register it. Domains with existing traffic, backlinks or email history are attractive, and some services specifically watch for them. A new owner can then receive email still being sent to old addresses, impersonate the previous business or use residual trust in password reset flows on other platforms. This path requires no hacking at all, only an organisation that forgot to renew.

Detection signals to watch for

Hijacks are much easier to reverse in the first hours than after several days. These signals deserve immediate attention:

At the registration layer

• Emails about a transfer request, authorisation code or registrant change that you did not initiate.
• A WHOIS/RDAP lookup showing a different registrar, missing clientTransferProhibited status or new nameservers. The TLDix WHOIS and RDAP lookup makes it quick to compare the current record with what you expect.
• An expiry date that changed without a renewal on your side, which can indicate a completed transfer.

At the DNS and service layer

• The website shows unfamiliar content, redirects or certificate warnings.
• Incoming email stops, or users report phishing messages that pass SPF or DKIM checks for your domain.
• Certificate Transparency logs show new certificates from a CA you do not use.
• Monitoring reports changed A, MX or TXT records.

Recovery steps if your domain is hijacked

Act quickly and in parallel where possible.

1. Contact your registrar immediately through its official abuse or security channel, not through links in any email you received. Ask them to freeze the domain and reverse unauthorised changes.
2. Secure the accounts behind it. Reset passwords and 2FA for the registrar, DNS provider and the recovery email, from a clean device. Revoke unfamiliar sessions and API keys.
3. Preserve evidence. Save WHOIS/RDAP output, DNS records, emails, invoices and account logs with timestamps. Proof of prior ownership speeds up every recovery process.
4. If the domain moved to another registrar, your original registrar can raise the case with the gaining registrar and, if needed, use the Transfer Dispute Resolution Policy. In cases of trademark abuse, UDRP or local court action may also be options.
5. Limit the damage. Warn customers and staff about possible phishing, revoke certificates issued during the incident, and rotate any credentials or tokens that could have been exposed through intercepted email.
6. Restore and harden. Once control is back, verify every record, re-enable locks, review DNSSEC and request a registry lock if the domain is critical.

Prevention priorities

Prevention mostly comes down to closing the paths above: phishing-resistant 2FA on registrar, DNS and email accounts; a recovery email on a different domain; permanent transfer locks and, for key names, a registry lock; DNSSEC to protect resolution integrity (see why DNSSEC is essential); and renewals that never depend on one person remembering. Tracking all your domains, certificates and hosting dates in the TLDix panel removes the expiry route entirely and gives you a baseline to compare against when something looks wrong.

Finally, prepare before an incident. Write down your registrar’s security contact, the account IDs of each domain and the people allowed to request changes, and keep copies of invoices that prove ownership. Ask your registrar whether it supports an account PIN or verbal password for support calls. A one-page response plan, reviewed once a year, turns a stressful hijack into a sequence of known steps.