Cloudflare Registrar sells domains at wholesale cost, and nearly every customer who registers there also runs DNS on the same account. That is why a Cloudflare incident feels so total: when an account is compromised, the attacker can change the registration and the DNS in a single session, and website, email and every subdomain stop resolving correctly. “Cloudflare stole my domain” is how owners describe that moment. In the cases we see, Cloudflare took nothing: the account was taken over, the domain expired, or the zone and registration belong to an employee’s personal account. This guide explains how to tell those apart and what to do at each layer. It is part of our domain hijacking hub.
What people usually mean when they say Cloudflare stole the domain
The account was taken over
Domain hijacking (the unauthorized transfer or control of a registered domain) at Cloudflare usually begins with a phished password or a compromised email address rather than any weakness in the registrar. Once inside, an attacker can edit DNS records, change the account email, and transfer the registration to another registrar. See our page on what domain hijacking is.
Only the DNS was changed
A DNS hijack differs from a registration theft, and the distinction decides your recovery path. If the attacker changed A, CNAME or MX records inside your Cloudflare zone, the registration is untouched; the domain is still yours at the same registrar, and the fix is to regain the account and correct the records. If the attacker transferred the registration away, the domain itself has moved and only the registrar-to-registrar process brings it back. Nameserver hijacking is more common than owners assume: ICANN’s SSAC found that registrar nameserver renaming practices had exposed over 500,000 gTLD domains to resolution hijacking risk as of September 2020, and that unauthorized parties gained control of more than 163,000, according to SAC125, the SSAC report on registrar nameserver management.
The registration expired
Cloudflare renews at cost, but it still needs a working payment method. A failed card and reminders sent to an unmonitored address produce a lapsed domain. That is expiration, handled through our expired domain name recovery service.
The domain is locked to an employee’s account
Cloudflare accounts are often created by the engineer who first set up the zone, using a personal email. When that person leaves, the company discovers that the registration and DNS live in an account it cannot open. The same arises with an outside developer or agency; our post on recovering a domain held for ransom by a web developer covers that version.
How to tell which situation you are in
Run an RDAP lookup (RDAP, the Registration Data Access Protocol, is the structured successor to WHOIS) and read the registrar, dates and status codes. If the registrar is still Cloudflare and the creation date is yours, the registration has not moved; the problem is at the DNS or account layer. If the registrar has changed and the updated date is recent, the domain has been transferred out. Then check the nameservers: if they are no longer the pair Cloudflare assigned to your zone, the delegation was changed at the registrar level, which only an account holder can do. Status codes complete the picture: clientTransferProhibited means locked, pendingTransfer means a transfer is in flight, and redemptionPeriod or pendingDelete means it expired. SAC044, ICANN’s registrant guide to protecting registration accounts, recommends setting clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited, with registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) as a further layer, per the SSAC’s SAC044 report; if those codes are missing from a domain you locked, someone with account access removed them.
What to do at Cloudflare for each scenario
For an account takeover, use Cloudflare’s account recovery process, which, like most registrars, verifies your identity before restoring access. Once back in, revoke every session and API token, rotate the password, enable two-factor authentication, and review the audit log, which records who changed what and when. Then report any transfer-out through Cloudflare’s registrar support and abuse channels, with the date of the change and a request for reversal. Cloudflare is the losing registrar and the party that can contact the gaining registrar.
For a DNS-only hijack, the audit log is your map. Restore each altered record, remove records you did not create, and confirm the nameservers still match your zone. For an expired registration, renew if the domain is still renewable or ask Cloudflare to restore it during redemption. For a domain locked to a departed employee’s account, Cloudflare will not move it on your word alone, because to the registrar that account is the registrant. The paths are cooperation from the former employee, a documented ownership claim through support, or legal action.
Escalating beyond the registrar
When the registration has been transferred away, ICANN’s Transfer Policy requires each registrar to staff a Transfer Emergency Action Contact (TEAC), and a human at the gaining registrar must respond within four hours, though final resolution may take longer, according to the ICANN Transfer Policy Review working group’s TEAC and TDRP slides. Only the losing registrar can open that channel. Registrars reverse a transfer between themselves with the Transfer Undo Request Form; our guide to the TURF agreement explains how. If the registrars disagree, the Transfer Dispute Resolution Policy (TDRP) lets one file against the other, but no later than twelve months after the alleged violation, per the ICANN TDRP text. Our step-by-step guide to recovering a stolen domain name covers the full sequence.
Evidence to preserve
Export the Cloudflare audit log before anyone cleans up; it is the clearest record of the attacker’s actions. Save registration receipts, login alerts and any suspected phishing message. Screenshot the RDAP record and nameservers now and again daily. For an employee or developer case, keep the agreement and invoices showing the domain was bought for the business.
How DNAccess helps with a Cloudflare domain
DNAccess has recovered hundreds of stolen domain names, and Cloudflare cases start with separating the DNS layer from the registration layer so effort goes where the damage is. For hijacks we handle registrar correspondence, TEAC and TURF requests and, where needed, litigation through our stolen domain name recovery service. Afterward we lock it down, including registry lock, which Cloudflare offers on certain plans, following our guides on registrar account security and how to prevent domain hijacking. Contact us for a confidential assessment.
We have written the same guide for GoDaddy, Namecheap, Squarespace and Google Workspace.