Could someone hijack your domain?

The guide

What is domain hijacking?

Domain hijacking is when someone takes control of your domain name, or of where it points, without your permission. Once they have it, they decide where your visitors and your email go.

It usually happens in one of four ways:

• Through your registrar account. Someone logs in with a stolen or guessed password and changes your nameservers or transfers the domain.
• Through the registrar itself. An attacker compromises or tricks the registrar, and changes are made on its side.
• Through a lapsed registration. The domain isn't renewed, and someone else registers it.
• Through a forgotten subdomain. A DNS record still points to a service you've stopped using, and someone else claims it.

Does it still happen?

Yes. On 31 October 2026, Crypto Briefing reported that at least 12 DeFi websites registered with Name.com had been hijacked through DNS changes made at the registrar. Visitors who typed the correct address were sent to copies of the sites loaded with a wallet drainer, and about $138,000 had been traced as stolen at the time of the report. The underlying code was never breached: the attackers only needed control of where the domains pointed.

The same approach works against any business. A hijacked domain can serve a fake checkout, collect logins, intercept email or simply go dark, and every ranking, backlink and AI citation you've earned goes with it.

What the checker looks at

The checker runs eight checks in two groups, worth 100 points in total. Registration checks read your domain's public record from its registry through RDAP, the modern replacement for WHOIS. DNS checks read your live DNS records.

Registration

• 20 points

  Transfer lock

  Whether the registry will refuse requests to move your domain to another registrar. The lock shows in your registration record as clientTransferProhibited, or serverTransferProhibited if it's set at the registry.

  How to fix: Turn on the transfer lock, sometimes called a registrar lock or domain lock, in your registrar's control panel. Almost every registrar offers it free.

• 20 points

  Renewal date

  How long until the registration expires. A lapsed domain can be registered by someone else, along with every link, ranking and email address that points to it.

  How to fix: Turn on auto-renew, pay with a company card that won't expire, and renew for several years at a time.

• 10 points

  Update lock

  Whether the registry will refuse changes to the registration, including the nameservers that control where your website and email go (clientUpdateProhibited or serverUpdateProhibited).

  How to fix: Ask your registrar whether it offers an update lock. Not all do, and some include it in a paid security add-on.

• 5 points

  Delete lock

  Whether the registry will refuse requests to delete the domain (clientDeleteProhibited or serverDeleteProhibited).

  How to fix: Turn on the delete lock if your registrar offers it. It's usually in the same settings as the transfer lock.

DNS

• 15 points

  DNSSEC

  Whether your DNS answers are digitally signed, so resolvers can reject forged ones, and whether the signatures validate. Broken DNSSEC is worse than none, because validating resolvers refuse to load the site.

  How to fix: Turn on DNSSEC with your DNS provider and add the DS record at your registrar. Many providers do both in one step. If it's broken, fix or remove it quickly.

• 10 points

  Nameservers

  Whether your domain has at least two nameservers, the servers that tell the internet where your website and email live.

  How to fix: Use at least two nameservers. Your DNS provider will normally supply them, so check the nameserver settings at your registrar match what the provider gives you.

• 10 points

  CAA record

  Whether your DNS limits which certificate authorities can issue HTTPS certificates for your domain. Without one, any public certificate authority may issue them.

  How to fix: Add a CAA record naming the certificate authority you use, for example 0 issue "letsencrypt.org". Your host can tell you which one that is.

• 10 points

  Forgotten subdomains

  Whether 20 common subdomains, such as blog, shop and help, point to a service that no longer exists. Someone else could claim that service and publish under your name.

  How to fix: Delete the DNS record for any subdomain you no longer use, or reconnect it to the service it points to.

Registrar locks explained

Locks show up in your domain's public record as status codes. ICANN's guide to EPP status codes explains that registrars set the “client” codes, while registries set the “server” codes, which take precedence. These are the ones that protect you:

When both server codes are set, the domain has a registry lock: changes need manual checks by the registry. It usually costs extra and suits domains a business can't afford to lose for even an hour.

How to protect your domain in seven steps

These steps follow the NCSC's guidance on managing public domain names, plus the settings this checker tests.

1. Turn on two-step verification for every account that can log in to your registrar and DNS provider.
2. Register domains to the business, using a shared company email address rather than one person's inbox, with more than one trusted person able to log in.
3. Turn on auto-renew, paid with a company card that's kept up to date.
4. Turn on the transfer lock, plus the update and delete locks if your registrar offers them.
5. Remove DNS records for services you no longer use, such as an old blog, shop or help desk.
6. Add a CAA record so only your chosen certificate authority can issue certificates for your domain.
7. Consider DNSSEC. The NCSC notes it adds integrity checks to DNS responses, but also management work, so weigh it up with your DNS provider.

Does DNSSEC stop domain hijacking?

Not on its own. ICANN describes DNSSEC as adding digital signatures to DNS, so resolvers can detect forged answers and discard them. That protects against attacks such as cache poisoning, where fake DNS data is slipped into a resolver.

It doesn't help if someone logs in to your registrar and changes your nameservers, because the registry treats that as a genuine change. That's why the checker gives the transfer lock and renewal date more weight than DNSSEC.

What is a subdomain takeover?

MDN's guide to subdomain takeovers describes the problem: a subdomain still has a CNAME record pointing to a hosting provider, but nothing is hosted there any more. Anyone who sets up an account with the same name at that provider can publish content on your subdomain.

It's common after a campaign site, help desk or blog is switched off and the DNS record is left behind. The checker tests 20 common subdomains and flags any that point to a name that no longer exists. It also lists subdomains that point to outside services, so you can confirm you still use them.

What the checker can't see

• Your registrar account security. Two-step verification and strong passwords matter more than any lock, because a lock can be switched off by anyone who can log in.
• Whether auto-renew is on. The checker sees the expiry date, not your billing settings.
• Every subdomain. It checks 20 common names. Your DNS provider can show you the full list.
• Some registries. A few, including .io and .so, don't publish registration data through RDAP, so registration checks show as “Not checked”.

How your score is calculated

Each check is worth a set number of points, 100 in total. A pass earns all of them, “Improve” earns half and “Fix” earns none. Checks that can't run for your domain are left out, and your score is scaled from the rest.

• 0 to 49

  Exposed

  Basic protections are missing. Start with the transfer lock and auto-renew, which are free and take minutes, then work down the list.

• 50 to 69

  Partly protected

  Some protections are in place, but there are gaps someone could use. Fix anything marked “Fix” first.

• 70 to 84

  Well protected

  The important locks are on. The remaining points usually come from DNSSEC, a CAA record or an update lock.

• 85 to 100

  Locked down

  Strong protection on everything this checker can see. Keep your registrar account secure with two-step verification, because locks only help if nobody else can log in and remove them.

Frequently asked questions