Domain Hijacking: When the Registrar Is the Breach

By Glenn Lyvers · Updated September 20, 2026 · 4 min read

Your website is gone, your email has stopped, and when you look up your own domain the contact details belong to someone else. This is the worst version of the problem, because your domain is the foundation everything else sits on — your site, your mail, your logins, your identity online — and losing it is not something you can fix by cleaning a server.

What has actually happened

Domain hijacking means someone gained control of the account that owns your domain registration, or persuaded a registrar to transfer it. From there they can point it anywhere, change the contact details, and in the worst case move it to a different registrar entirely, which makes recovery considerably harder.

The distinction from a DNS change matters. If someone altered your DNS records but the domain is still registered to you in your account, you have a serious but straightforward problem — covered in my guide on DNS versus site hacks. If the registration itself has moved, you are now in a formal dispute process rather than a technical fix.

Work out how far it has gone

Check three things immediately. Can you still log into your registrar account? Does a public lookup still show your registrar and your contact details? Is there a transfer pending on the domain?

If you still have account access and the domain is still yours, act fast: change the password, enable two-factor authentication, re-enable the registrar lock, remove any additional users or API keys, and correct the DNS records. If your login no longer works or the domain has moved to another registrar, stop trying to fix it yourself and go straight to the registrar's recovery process.

Working with the registrar

Contact them through a channel that does not depend on your domain — a phone number, a support portal login, or an email address at a different domain, since your own mail may be intercepted. Explain plainly that the domain has been taken without authorization and ask for their account recovery and dispute process.

Have your evidence ready: proof you are the legitimate registrant, historical records showing your ownership, receipts or invoices for the registration, and any business documents tying the domain to you. Registrars deal with this regularly and have procedures for it, but those procedures are evidence-driven and move at their own pace.

Why speed matters so much

Transfers become progressively harder to reverse. Within the first few days a registrar can often simply undo it. Once a domain has settled at a new registrar, recovery moves into a formal dispute that can take weeks. And if it changes hands again, or is sold on, the situation becomes considerably more complicated.

There is also a change lock period after a transfer during which the domain cannot move again, which cuts both ways — it stops it being moved further, and it can slow the return. The practical message is that the hours after you notice are the most valuable ones you will get.

Managing the damage meanwhile

While the domain is out of your control, assume your email is being intercepted, which means password reset links sent to that domain are reaching the attacker. Go through your important accounts and change the recovery email to an address on a domain you still control, starting with your hosting, your payment processors and anything financial.

Your site is unreachable but your hosting and files are untouched, so your content is safe. Tell customers through whatever other channels you have, be straightforward about what happened, and avoid speculating publicly about who did it while a dispute is running.

Making it impossible next time

Four measures, all cheap. Enable the registrar lock and leave it on permanently. Enable two-factor authentication on the registrar account. Use a unique password stored in a password manager. And use a registrar contact email at a different domain, so losing this one does not also lose your ability to receive recovery messages.

Consider registry lock for a domain your business genuinely depends on — it requires manual out-of-band verification before any change and makes automated hijacking essentially impossible. And keep the registration itself in a business account rather than an individual employee's personal one, which is how a surprising number of domains get lost without any attacker involved at all.

Common questions

Is this different from my DNS being changed?

Yes, substantially. A DNS change alters where your domain points while the registration stays yours, and you can correct it from your own account. Hijacking means control of the registration itself has moved, which takes you out of technical fixes and into a formal recovery process with the registrar.

Can I get my domain back?

Usually, yes, particularly if you act quickly and can document your ownership. Registrars handle these cases regularly and have established procedures. Recovery is far easier in the first days than after a transfer has settled, so speed genuinely changes the outcome.

How long does recovery take?

Days if caught immediately and the domain has not left your registrar. Weeks if it has transferred away and a formal dispute is required. Longer still if it has changed hands more than once. Every day of delay moves you toward the slower end of that range.

What should I do about my email?

Assume it is being intercepted. Change the recovery address on your important accounts to one at a domain you still control — hosting, payment processors, banking and anything with financial exposure first — because password reset messages sent to the hijacked domain are reaching someone else.

How do I prevent this happening?

Enable the registrar lock and two-factor authentication, use a unique password from a password manager, and set your registrar contact to an email address at a different domain. For a business-critical domain, registry lock adds manual verification before any change and is worth the small inconvenience.