Cybersecurity glossary
What is Domain Hijacking?
Learn what domain hijacking is, how attackers take over registrar accounts or DNS settings, what business impact follows, and which controls protect domain ownership and resolution.
Definition
Domain hijacking is the unauthorized takeover of a domain name’s registration or DNS control, allowing attackers to change name servers, records, or ownership details and redirect or intercept services that depend on that domain.
Why domain hijacking matters
A domain is not just a marketing label. It is the root of websites, email, package registries, SSO callbacks, API gateways, and customer trust. Domain hijacking steals the control plane for that name. Once attackers can change name servers or records, they can impersonate your organization with frightening completeness.
Unlike an application bug that affects one product, domain loss is a business-wide incident: mail flows, certificate issuance, and brand authenticity can all fail at once.
How domain hijacking happens
Target registration or DNS control
Attackers identify the registrar, DNS host, and people who can approve changes.
Compromise the control plane
Phish passwords, abuse recovery, socially engineer support, or wait for expiration.
Change NS or critical records
Point the domain to attacker name servers or alter A/AAAA/MX/TXT records.
Capture traffic and validation
Web and mail flow to attacker infrastructure; domain validation for TLS may succeed.
Persist and monetize
Phish customers, steal mail, alter software distribution, or ransom the domain back.
Defend and recover
Registrar intervention, registry locks, DNS restoration, cert revocation, and credential resets.
Impact surface
Website impersonation
Customers land on attacker sites that look authentic, especially if TLS certificates are obtained.
Email takeover
MX changes let attackers receive password resets and business correspondence.
Identity provider breakage
SSO redirect URIs and SAML endpoints fail or become attacker-controlled.
Software supply trust
Update endpoints and package namespaces tied to the domain can distribute malware.
Hijacking vs related DNS incidents
| Incident | What changes |
|---|---|
| Domain hijacking | Registration/DNS hosting control or authoritative delegation |
| DNS spoofing | Forged answers without owning the domain |
| Subdomain takeover | Dangling DNS to abandoned cloud resources (related but distinct) |
| Expired domain loss | Lapse in renewal leading to legitimate re-registration by others |
Protection checklist
- Protect registrar and DNS accounts with phishing-resistant MFA and unique passwords.
- Enable registrar transfer locks and registry locks for high-value domains where offered.
- Restrict and audit recovery phone/email channels; treat them as tier-0 assets.
- Monitor NS, DS, MX, and A/AAAA changes with alerting to security operations.
- Maintain an inventory of all corporate domains, including legacy brands and typosquat defenses.
- Auto-renew critical domains and separate billing failures from security silence.
- Limit support-PIN knowledge and require out-of-band verification for ownership changes.
- Watch Certificate Transparency for unexpected certificates after any DNS anomaly.
The practical takeaway
Domain hijacking is theft of domain control—usually through registrar or DNS account compromise—not a bug in your web app. The blast radius spans mail, web, identity, and certificates.
Treat domain accounts as production root access: strong MFA, locks, monitoring, and rehearsed recovery with your registrar. If attackers control the name, they can become you on the internet.
Related security terms
Domain Name System (DNS)
The resolution system attackers alter after seizing domain control.
WHOIS
Registration data resources often involved in ownership disputes and auditing.
DNS Spoofing / Cache Poisoning
A different integrity attack that forges answers without stealing registration.
Certificate Authority (CA)
Attackers with DNS control may obtain fraudulent TLS certificates via domain validation.
Frequently asked questions
What is domain hijacking in simple terms?
Domain hijacking is when someone steals control of your domain at the registrar or DNS host. They can point the domain to their servers and take over email, websites, and logins that use that name.
How do attackers hijack domains?
Common paths include phishing registrar credentials, abusing weak account recovery, social-engineering support, expired-domain capture after lapse, and compromising DNS hosting accounts.
Is domain hijacking the same as DNS spoofing?
No. Spoofing forges DNS answers. Hijacking changes authoritative control so the false answers become the official zone data.
What is a registrar lock?
Locks such as clientTransferProhibition help prevent unauthorized transfers between registrars. They are necessary but not sufficient if the registrar login itself is compromised.
Can attackers get HTTPS certificates after hijacking DNS?
Yes. With control of DNS or HTTP validation paths, they may pass domain validation at a public CA and serve convincing TLS sites.
How quickly should teams respond?
Immediately. Hijacks affect websites, email, SSO, APIs, and customer trust at once. Contact the registrar, restore DNS, rotate credentials, and review certificate issuance.
What preventive controls matter most?
Phishing-resistant MFA on registrar and DNS accounts, registry locks where available, tight recovery controls, monitoring for NS/DS changes, and inventory of all domains.
References
Explore authoritative guidance and frameworks related to domain hijacking.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.