“GoDaddy stole my domain” is one of the searches that brings people to DNAccess most often, usually typed in a panic after a website goes dark. We understand the anger behind it, and we owe readers a straight answer: in the recoveries we handle, the registrar almost never took the domain. GoDaddy is the largest retail registrar in the world, so a large share of all domain theft reports involve a GoDaddy account simply because a large share of all domains live there. What actually happened is nearly always one of four things, each with a different fix, whether your search was “domain stolen from GoDaddy” or “GoDaddy domain hijacked.”
Situation one: your account was compromised
This is the case that deserves the word “stolen.” A thief obtains your GoDaddy login through phishing, a reused password from another breach, or a SIM swap that defeats text-message verification. Once inside, the thief either pushes the domain to a different GoDaddy customer account, or unlocks it, obtains the authorization code (the transfer password that proves the requester controls the name) and transfers it to another registrar, often overseas, after changing the registrant email so the approval notice goes to an address you do not control. The domain disappears from your account, a WHOIS (the public registration record for a domain name) lookup shows a registrant or registrar you do not recognize, and your website and email stop working.
First, regain control of the account through GoDaddy’s account recovery process, which verifies your identity against the records the company holds; until the account is yours again, every other step is undermined. Then open a case with GoDaddy’s support and security teams; for a domain moved between GoDaddy accounts, the company has an internal process for reviewing a disputed change of account. For a domain transferred out to another registrar, the losing registrar is expected to use the Transfer Emergency Action Contact, a channel ICANN’s Transfer Policy requires every registrar to maintain, and responses must come from a human at the gaining registrar within four hours, although final resolution may take longer, according to the ICANN Transfer Policy Review working group’s TEAC and TDRP briefing.
If the registrars cannot agree, the formal remedy is the Transfer Dispute Resolution Policy (TDRP), the ICANN procedure for disputes between registrars over an inter-registrar transfer, and a dispute must be filed no later than twelve months after the alleged violation, according to the ICANN TDRP text. Only a registrar can file it, so your job is to give yours a case strong enough to act on. Our explainer on the TURF agreement, the Transfer Undo Request Form registrars use to cooperate on reversals, describes how that works.
Situation two: the domain expired
The second most common story behind “GoDaddy stole my domain” is an expired registration. The card on file lapsed, the notices went to an old address, and the owner later finds the name listed in GoDaddy’s expired-domain auction or registered to someone else. None of that is theft, although it feels like it. ICANN’s Expired Registration Recovery Policy requires registrars to send two notices before expiration, roughly a month and a week ahead, and a further notice within five days after, and it requires gTLD registries to provide a 30-day Redemption Grace Period after deletion, according to the ICANN ERRP policy text. GoDaddy layers its own stages on top, including an auction listing during which the name is often still renewable by you, and our guide to the domain expiration lifecycle lays out what is still possible at each one.
If the domain is still in your account marked expired, renew it now and worry about the fee later. If it is at auction but still redeemable, contact GoDaddy and ask to redeem it. If it has been deleted and re-registered by a third party, the registrar cannot give it back, and the path becomes negotiation, purchase, or a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint where the new holder targeted your brand. That is the point at which our expired domain name recovery service does its work.
Situation three: someone else holds the domain in their own account
The third situation is a dispute over who the registrant ever was. A web developer, agency or former employee registered the domain in their own GoDaddy account, the business treated it as its own, and when the relationship soured the business discovered it had never controlled its most important asset. The domain was not stolen from GoDaddy; it was never in your account to begin with. The registrar will not move a domain between two customers on one side’s say-so, so ask the holder to push the domain to your account; many of these disputes resolve with a firm letter. If the holder refuses or demands payment, gather the invoices, contracts and renewal payments showing the domain was registered for the business. Where an ex-employee withholds a domain to extract money, the Ninth Circuit held in DSPT International v. Nahum that holding a domain for ransom is cybersquatting under the Anticybersquatting Consumer Protection Act and affirmed a jury verdict against him. Our post on recovering a domain held for ransom by a web developer covers the negotiation and legal routes.
Situation four: a privacy service appears as the owner
The fourth situation is not a loss at all. The owner looks up the domain, sees “Domains By Proxy” or “Registration Private” as the registrant, and concludes that a stranger has taken the name. Domains By Proxy is GoDaddy’s affiliated privacy service; its details replace yours in the public record while you remain the actual registrant. “Perfect Privacy LLC stole my domain” is a search phrase that reaches our site regularly, and the answer is the same: Perfect Privacy is another registrar’s privacy service, and the domain still belongs to whoever enabled it.
Log in to the account where you believe the domain lives. If it is there, nothing has happened, and our post on whether private registration is necessary weighs whether to keep privacy on. If it is not there, you are in one of the three situations above.
Preserve evidence in every case
Whatever the situation, preserve evidence immediately, because registrars, panels and courts decide on records. Save every email from the registrar, including the ones you think are spam. Take dated screenshots of the account, the WHOIS results and the website, and write down the timeline while you remember it. Our guide to preventing domain hijacking explains the controls that keep the first situation from recurring.
When to escalate to DNAccess
Many account-compromise cases are reversed through the registrar’s own process within days. Escalate when the domain has left GoDaddy for a registrar that will not respond, when the twelve-month TDRP window is running down, when the registrar has closed its investigation without restoring the name, or when the holder demands money. The difference between recovery and permanent loss is usually someone who knows which contact at which registrar can act and which policy obligates them to move.
What DNAccess does when a domain is stolen from a GoDaddy account
DNAccess has recovered hundreds of stolen domain names, many of them from GoDaddy accounts. We determine which of the four situations you are actually in, assemble the evidence the registrars will require, and work the TEAC, TURF and TDRP channels with the people at each registrar who handle them. Where the name has expired or a developer is holding it, we manage the acquisition or negotiation and prepare the record for counsel. Our stolen domain name recovery service describes the engagement, and our domain hijacking hub covers the wider subject. If your domain is missing, contact us and we will tell you what happened and what it will take to fix.