Preventing domain hijacking means protecting every link in the chain that controls a domain name: the email account the registrar writes to, the registrar account that holds the domain, the registry record behind it, the registration itself, and the people who are allowed to make changes. Domain hijacking (the unauthorized change of control of a registered domain) almost never involves a technical attack on the registry. It involves a stolen password, a phishing email, or a contractor who registered the domain in his own name. The controls that stop it are inexpensive, and the recoveries we handle at DNAccess nearly always trace back to one of them being absent.
This guide is organized by layer, from the email account outward. Our pillar guide to domain hijacking covers how the thefts happen and how they are reversed; this page is about making sure they do not happen to you.
Layer one: the registrant email account
The email address on the registrar account is the single most important credential in domain security, because the registrar sends every password reset, transfer authorization, and change confirmation to it. A thief who controls that mailbox controls the domain. The first control, therefore, is a dedicated email address used for nothing except registrar and registry correspondence. It should not be an individual’s personal account. A dedicated address is harder to find, harder to phish, and far less likely to appear in a data breach alongside a reused password.
Protect that mailbox with multi-factor authentication (MFA, a second proof of identity beyond the password), and choose the strongest form available: a hardware security key rather than a code sent by text message. Text-message codes are defeated by SIM swapping, in which an attacker persuades a mobile carrier to move the victim’s number to a new phone. Review the account’s forwarding rules and recovery addresses on a schedule, because a thief who has been inside a mailbox often leaves a forwarding rule behind. And make sure someone reads the mailbox, because a registrar’s notice of a pending transfer is only useful if a person sees it in time to deny it.
Layer two: the registrar account
The registrar account needs its own unique password, held in a password manager and never reused on any other service, because credential stuffing (the automated testing of leaked username and password pairs against other sites) is the standard way registrar accounts are opened. Turn on multi-factor authentication at the registrar as well, with a hardware key where the registrar supports one; if it does not offer MFA at all, that is a reason to move.
Use account roles where the registrar offers them, so that the people who update DNS records do not also hold the authority to transfer or delete the domain. Remove former employees and agencies from the account the day the relationship ends, and change the password and the account email at the same time.
Set the transfer lock on every domain. At the registry this appears as the status code clientTransferProhibited, and it means the registry will reject any transfer request for the domain until the registrar removes the lock. A thief who obtains the authorization code still cannot move the domain while the lock is in place, which forces him into the registrar account first and gives the owner a second chance to notice. The ICANN Security and Stability Advisory Committee’s registrant guidance, SAC044, A Registrant’s Guide to Protecting Domain Name Registration Accounts, recommends setting clientTransferProhibited, clientUpdateProhibited, and clientDeleteProhibited together, with registry lock as a further layer; the report dates from 2010, but the controls it describes remain the baseline.
Several registrars sell an additional account-level protection, sometimes marketed as an executive lock or a high-security account, under which no change to the domain or the account is processed until the registrar has verified the request by a telephone call or a second channel with a named person. These products close the social-engineering path, because a support agent can no longer act on an email or a chat alone. Our page on registrar account security covers these settings in more detail.
Layer three: the registry
Registry lock is a registry-level hold that blocks transfers, nameserver changes, and deletions until the registrar verifies the request out of band, usually by a telephone call with a passphrase to a named contact. It works because the lock is set at the registry, above the registrar, which cannot remove it through its ordinary systems. A thief who has taken over the registrar account, or a deceived support agent, still cannot move the domain, because the registry will refuse the command until the lock is lifted through the separate verification process. At the registry the lock appears as serverTransferProhibited, serverUpdateProhibited, and serverDeleteProhibited; the “server” prefix signals that the registrar did not set it and cannot clear it alone.
Verisign offers registry lock for .com and .net, and many other gTLD and ccTLD registries offer an equivalent. The service is sold through the registrar, and not every registrar supports it, which is one of the better reasons to hold important domains at a corporate registrar. Adoption remains low. CSC’s 2024 Domain Security Report found that 24 percent of Forbes Global 2000 companies use registry lock, up from 17 percent in 2020, and that the figure rises to 45 percent among companies that use enterprise-class registrars. The same report found that only 9 percent of those companies had deployed DNSSEC (the Domain Name System Security Extensions, which cryptographically sign DNS data so resolvers can detect tampering), up from 3 percent in 2020, that 68 percent had adopted less than half of the recommended domain security measures, and that 107 companies scored zero. If the largest companies in the world are that exposed, a mid-sized business should assume its domains are, too. Our guide to registry lock explains how to order it and how changes are made once it is in place.
Layer four: the domain registration itself
Register important domains for several years at a time, and turn on auto-renewal with a payment card that someone monitors and that will not expire without anyone noticing. An expired domain is not a hijacking, but it ends in the same place.
Register the domain in the name of the organization, not an individual. When the registrant organization field names the company, ownership survives the departure of any one employee, and a registrar or a UDRP (Uniform Domain-Name Dispute-Resolution Policy) panel asked to decide who the rightful owner is will see the company in the record. When the field names a founder or a developer, the company has to prove its claim after the fact, and in the disputes we handle that proof is often thin. Keep every contact accurate for the same reason, because a stale contact is both an obstacle to recovery and an opening for a thief who claims to be the person named.
Never allow a web developer, an agency, or a hosting company to register a domain in its own account on your behalf. The party that holds the registration holds the domain, and a dispute over an invoice becomes a dispute over the business’s identity. If a developer must manage DNS, give that person a role in your registrar account rather than the registration itself, and where a domain has already been registered this way, move it into a company-controlled account now, while the relationship is good. Our post on recovering a domain name held for ransom by a web developer describes what happens when that step is skipped.
Layer five: detection
Every control above can fail, and a theft caught in hours is far easier to reverse than one discovered weeks later, because the thief needs time to move the domain through a second and third registrar. Detection means monitoring the domain’s registration record, nameservers, and status codes continuously and alerting a person the moment any of them changes. A changed registrant email, a removed transfer lock, a new nameserver, or a pendingTransfer status is the signature of a theft in progress, and each is visible in the public record before the domain is gone.
Monitoring also catches quieter hijackings. ICANN’s SSAC found in SAC125, its 2024 report on registrar nameserver management, that unauthorized parties had gained control of more than 163,000 gTLD domains through stale nameserver delegations, where a domain’s nameservers pointed to a hostname under a domain that had expired and been re-registered by an attacker. No registrar account was touched in those cases. Attackers also work quickly: a measurement study of targeted DNS infrastructure hijacking published at ACM IMC 2022 found that for 51 percent of hijacked domains the attacker’s resolution lasted at most one day, which is why a weekly check is not enough. Our DNShield domain name monitoring service watches registrant, nameserver, status, and expiration data for exactly these changes, and our domain monitoring hub explains what to watch and why.
Layer six: people and process
Phishing is the most common first step in a domain theft, and the messages are designed for domain owners specifically. They imitate a registrar’s renewal reminder or ICANN’s mandatory contact verification notice, and the link leads to a page that captures the registrar login. Train everyone who touches the registrar account to treat any such message as suspect and to reach the registrar by typing its address rather than by clicking. We describe the current wave of these messages in our post on fake ICANN verification emails.
Put the relationship with every agency, developer, and hosting provider in writing, stating that the domain is the client’s property, that it will be registered in the client’s name and account, and that access will be surrendered on request. A written agreement ends most disputes before they start and gives counsel what it needs if one proceeds. Finally, keep an inventory of every domain the organization owns, which registrar and account hold it, who has access, and when it expires. A domain nobody is responsible for is a domain nobody will notice leaving.
How DNAccess helps prevent domain hijacking
DNAccess manages domain portfolios for businesses that would rather not learn these lessons the hard way. Our domain name management service consolidates domains into a properly secured account, sets transfer locks and registry locks where they belong, corrects registrant records so the organization is the owner of record, and keeps renewals and contacts current. Our DNShield monitoring service watches every domain in the portfolio for the changes that signal a theft and alerts a person in time to act. We have recovered hundreds of stolen domain names, and that experience shapes the prevention work, because we know which controls the thieves run into. To discuss securing your domains, reach us through our contact page.