Home / Knowledge hub / Domain hijacking
Knowledge hub
Domain hijacking
Someone taking control of your domain name, and so your site and email.
What it means
Domain hijacking is when someone takes control of your domain name without your permission, usually by getting into your registrar account, tricking the registrar, or taking over the email address linked to the domain. Once they control it, they control where your website, email and other services point.
The idea that makes it click: a domain is the root of trust for everything built on it. Whoever can change its DNS records can send visitors to a copy of your site, receive your email and get certificates issued in your name. The attacker needs no flaw in your application at all.
Why it matters
Consequences are quick and public. Customers land on a fake site that collects their sign-in details. Mail to your company, including password reset messages, goes to the attacker, which opens the door to account takeover across your services. Recovering the domain can take days.
Brand damage and lost trust follow, and certificate authorities may issue valid TLS certificates to whoever controls the domain, so the fake site looks secure. Related risks include a lapsed domain bought by someone else and subdomain takeover, which is smaller but more common.
How it shows up
It shows up as a registrar account with a weak password, no multi-factor authentication and a shared mailbox as its owner, or a domain that expired because the card on file lapsed. Attackers also impersonate the owner to a registrar's support desk, or use a hijacked email address to complete a transfer.
Protect it with multi-factor authentication on the registrar, a registrar lock so transfers need approval, and a registry lock for important domains where offered. Use a monitored role mailbox, turn on auto-renewal, restrict who can edit DNS, and watch for changed records. Review dangling DNS entries too.
Questions people ask
Domain hijacking, answered
How is domain hijacking different from DNS hijacking?
Domain hijacking takes control of the registration itself. DNS hijacking changes where the name resolves, which can be done by editing records, attacking a resolver or altering a router.
The first gives the attacker lasting ownership.
What is a registrar lock?
A setting at your registrar that blocks transfer of the domain to another registrar without extra steps. It stops many simple hijacks.
A registry lock goes further, requiring manual confirmation with the registry, and is offered for some domains.
What should we do if our domain is hijacked?
Contact your registrar immediately and report the incident. Secure the email account tied to the domain, and tell customers not to trust links in that period.
Then review what the attacker could have received, such as mail and certificates.
Can an expired domain be taken over?
Yes. If you let a domain expire, someone else can register it and receive its email and traffic. This has caught companies who stopped using a brand name.
Keep auto-renewal on and keep domains tied to live services.
Does DNSSEC stop domain hijacking?
No. DNSSEC signs DNS data so tampering in transit can be detected. If the attacker controls the registration, they can change the signing keys too.
The registrar account is the thing to defend.
Related
Terms that sit next to this one
Subdomain takeover
Claiming an abandoned cloud resource that one of your DNS names still points to.
Dangling DNS
A DNS record pointing at something you no longer own or run.
DNS security
Protecting the lookup system that turns your domain name into a server address.
MFA
A second proof beyond the password, usually a code or a hardware key.
Account takeover
An attacker ends up signed in as one of your real users.
Who can change your DNS today?
Domain control sits outside a web app test, but the sign-in and password reset flows that rely on your email are inside it. We test those and report only what we exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.