How to protect a domain from hijacking
Author: Domeny.ForSale editorial team Published Updated
In brief: The most important domain safeguards are strong authentication for your registrar account, a transfer lock, checks on registrant details and reliable renewal. You also need to protect the email account used to recover access, since its compromise could open the door to changes to domain settings. In a business, access should belong to the organisation, not solely to an employee or an external agency.
What can actually be hijacked
A domain is managed through a registrar: a company that lets you register a name, renew it and change its configuration. Domain hijacking can involve an unauthorised transfer to another provider, a change of registrant or the replacement of DNS servers to direct users to the attacker’s website and email services.
Not every website problem means the domain has been hijacked. A hosting outage, an incorrect certificate or an infected CMS can take a website offline even when the domain details remain unchanged. When investigating, check the registrar account, DNS configuration, hosting and email separately.
Secure your registrar account and its associated email
Enable multi-factor authentication, known as MFA or 2FA. In addition to a password, it requires extra confirmation, such as a code from an authenticator app or a hardware security key. If your registrar offers several methods, an app or hardware key is usually a safer choice than an SMS code, although any additional layer is better than a password alone.
Set a unique, long password and store it in a password manager. Do not use the same password for your registrar, hosting and email accounts. Keep MFA recovery codes somewhere that cannot be accessed through the account you are protecting.
The email address used for password resets needs particular protection. It should have its own MFA and up-to-date recovery methods. Ideally, it should not be a mailbox that operates solely on the domain you are protecting: a DNS outage affecting that domain could then make account recovery difficult.
Example: a company uses admin (at) firma.pl to recover access to the domain firma.pl. After an incorrect DNS change, email stops working, so recovery messages do not arrive. An independent administrative email address, properly secured and controlled by the company, reduces this problem.
Enable locks and protect the information needed for transfers
A transfer lock makes it harder to move a domain to another registrar without first unlocking it. The name of this feature depends on the provider and domain extension; it may be called a transfer lock, registrar lock or operation lock. Check your control panel to see exactly which changes it blocks.
The authorisation code used for transfers, often called AuthInfo or AuthCode, should be treated like a password. It should not appear in ordinary correspondence, publicly shared documents or a support ticket system accessible to many people. After completing a transfer, check whether the provider allows you to generate a new code.
For domains with substantial business value, you can consider an enhanced lock on changes, sometimes offered as a registry lock. Removing it requires additional verification, often performed manually. Availability, the scope of protection, the emergency procedure and the price depend on the registrar and the registry for the particular extension, so confirm these directly with the provider.
Keep track of renewal, DNS and notifications
Losing a domain is not always the result of an attack. It can be caused by a missed renewal, an out-of-date payment card or messages sent to an unused address. Enable automatic renewal, but do not rely on it alone: monitor the expiry date and set an independent reminder well in advance.
Enable notifications for logins, password changes, changes to registrant details or DNS servers, and transfer attempts, if your provider offers them. When you receive an alert, check the event by navigating to the control panel yourself, rather than following a link in the message. Fake domain renewal notices are a common phishing tactic.
DNSSEC allows the recipient to verify the authenticity of DNS responses and reduces the risk of them being forged in transit. However, it does not protect the registrar account against password theft or the domain against expiry. Implementation requires correct configuration by both the DNS provider and the registrar; incorrect records can make services unavailable.
Put business ownership and access in order
Registrant details should identify the appropriate person or organisation in accordance with the rules of the relevant registry. A company should not leave a critical domain in the personal account of an employee, business partner or contractor. Check the current requirements for registrant details and procedures for changing the registrant with the registrar handling the specific extension.
Limit the number of administrators and revoke access immediately after a role change or the end of a working relationship. Once a quarter, you can carry out a brief review: check administrators, MFA, the recovery address, the transfer lock, the renewal date, DNS servers and recent operations.
What to do after detecting a suspicious change
First, use a trusted device, change the passwords for your email and registrar accounts, and revoke active sessions. Then contact the registrar through its official emergency channel, ask it to block operations and preserve the change history. Preserve messages, alerts, ticket numbers and screenshots without unnecessarily altering evidence of the incident.
If DNS settings have been changed, record their current values for analysis before restoring the configuration. After regaining control, also check email, certificates, redirects and accounts with services whose passwords can be reset through addresses on that domain.
A practical next step is to log in to your registrar’s control panel today and check four things: MFA, the transfer lock, the recovery address and the renewal date.
See also: DNSSEC — is extra protection for your domain worthwhile?
Read also
