Recommended Free Tools
Domain hijacking is the wrongful taking of control of a domain name from its rightful holder. It can happen through a compromised registrar account, email account, identity check, or transfer process—and can disrupt a website and email even if the domain itself has not moved to another registrar. Protect the registrar login and its recovery channels, use available locks, and treat transfer codes as sensitive credentials. DNSSEC can help authenticate DNS data, but it does not secure the registrar account.
What domain hijacking means
ICANN’s Security and Stability Advisory Committee (SSAC) defines domain hijacking as the wrongful taking of control of a domain name from its rightful name holder. The term covers loss of control over the registration or its administration; it is broader than a single DNS record being changed. SSAC’s 2005 report describes possible consequences including loss of web and email service, phishing exposure, traffic inspection, reputational harm, and effects on customers and partners. That report is a historical threat analysis, not a current estimate of how often hijacking occurs. Read the SSAC report.
As an Amazon Associate I earn from qualifying purchases.
People also use “DNS hijacking” to describe malicious redirection at the DNS layer, including cases where malware changes where a victim is sent. A DNS problem does not by itself prove that the domain registration or registrar account was taken over. The distinction matters because the cause determines which account, provider, or DNS configuration needs attention.
How an attacker can take control or redirect traffic
Attacks can exploit weaknesses in the registrar account, the email address used to recover it, identity verification, or the procedures for making changes and transfers. ICANN identifies unauthorized access to email or login credentials as possible causes of unauthorized transfers. An attacker who gains influence over one of these paths may change registrant information, request or use transfer authorization, alter nameservers, or change DNS settings. An inter-registrar transfer can move management of the domain; changing nameservers or DNS can redirect a website or mail while the domain remains at its original registrar. ICANN’s guidance on unauthorized transfers and registrant changes explains the reporting route.
#1 Best Overall
- MULTI-LAYERED SECURITY HARDWARE: Reputation filtering (IP/DNS/URL) and SecuReporter visibility included in Entry Defense Pack, while the optional Gold Security Pack license unlocks anti-malware, sandboxing, web filtering, IPS, and full UTM
- OFFLINE-CAPABLE SETUP AND UPDATES: Configure via Nebula portal wizard; update firmware offline via FTP on the local network, while the web interface remains fully accessible without internet after each update
- COMPACT FANLESS DESIGN: with SPI 4,000 Mbps firewall throughput, 1,500 Mbps IPS, and 900 Mbps VPN, the firewall supports up to 50 users, 300,000 concurrent sessions, 50 IPSec tunnels, 25 SSL VPN users, and 16 VLANs
- FLEXIBLE SOFTWARE-DEFINED PORTS: 8 x 1G RJ-45 ports assignable as WAN or LAN, WAN load balancing, active-backup failover, 16 VLAN interfaces, and Link Aggregation for resilient connectivity
- NEBULA MANAGEMENT AND VPN: Centralized configuration, policy sync, and SD-VPN orchestration; supporting IKEv2/IPSec, SSL, Tailscale VPN, 50 IPSec tunnels, 25 SSL VPN users, and up to 24 managed APs via Secure WiFi
Registrar-account or recovery compromise
A stolen password or compromised recovery email can let an attacker access the registrar account or impersonate its holder. If the registrar’s support or verification process is also weak, an attacker may try to use that process to make changes. Securing only the registrar password is not enough if the email or identity accounts used to reset it remain exposed.
Transfer-code misuse
For many transfers, the EPP authInfo code—often called an authorization code or transfer code—is a domain-specific credential used in the transfer process. Despite the title’s reference to “domain keys,” this code is not a cryptographic key that makes the domain immune to account compromise. Treat it as sensitive: use a unique code where the registrar supports that, protect it, and share it only through the registrar’s intended process. SSAC also recommends transfer notifications and appropriate handling of authInfo codes.
Rank #2
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
DNS or nameserver changes
A person with enough control to change nameservers or DNS records may redirect visitors or mail without transferring the domain to a different registrar. These changes can cause service disruption or expose visitors to phishing. Review both registration and DNS configuration when investigating an incident; a domain still listed at the expected registrar may nevertheless have been redirected.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat DNSSEC protects—and what it does not
DNSSEC adds authentication and integrity checks for DNS data, helping resolvers detect forged or invalid data when the domain’s DNSSEC chain is correctly configured and validated. It does not stop someone from logging in to a registrar account, obtaining a transfer code, or persuading a registrar to change account or registration details. ICANN recommends DNSSEC as a DNS-security measure, alongside—not instead of—account and transfer protections. See ICANN’s account-security guidance.
DNSSEC support and the work needed to manage signing and DS records vary by registrar and DNS provider. Enable it only when the DNS configuration can be operated correctly; a misconfiguration can make a domain fail to resolve for validating users.
How to reduce the risk
No single setting guarantees protection. Use layered controls that address account access, transfer authorization, and DNS changes separately.
Secure the registrar account and recovery email
- Use a unique, strong password for the registrar account and store it in a password manager.
- Protect the email account used for registrar access and recovery with strong authentication and current recovery methods.
- Where practical, use a registrar-account email distinct from the registration contact email. ICANN recommends separation so that a changed registration record does not erase all evidence of prior control.
- Limit account access to people who need it, and remove access promptly when their role changes.
- Use HTTPS when accessing the registrar. It protects the connection in transit, but does not replace strong account controls.
Enable locks and understand their limits
Ask whether the registrar can apply a registrar lock to block unauthorized changes, transfers, or deletions. Common labels include “Registrar lock” and “Client Transfer Prohibited,” but names and available settings vary. ICANN says a lock can help block unauthorized changes and transfers; it is not a guarantee against every route to account compromise. A legitimate transfer may require the lock to be removed. ICANN says registrars must provide a reasonable, accessible way to request removal. See ICANN’s explanation of locked domains.
Protect transfer credentials and monitor changes
- Keep EPP authInfo or transfer codes private; do not reuse or disclose them outside the registrar’s intended transfer process.
- Keep registrant contact data and organizational ownership records accurate and current.
- Enable available notifications and review unexpected changes to the registrar, registrant contacts, domain status, nameservers, or DNS records.
- Maintain records of ownership and, where useful, backups of DNS-zone settings so you can identify and restore expected configuration.
Choose a registrar with processes you understand
When evaluating a registrar, compare its available transfer and registrant-update locks and removal process, account authentication and recovery, handling of transfer codes and notifications, change alerts and audit history, emergency support, DNSSEC and DS-record management, and restoration or dispute procedures. These are useful questions to ask, not a ranking or certification of any provider.
Best Value
- MULTI-LAYERED SECURITY HARDWARE: Reputation filtering (IP/DNS/URL) and SecuReporter visibility included in Entry Defense Pack, while the optional Gold Security Pack license unlocks anti-malware, sandboxing, web filtering, IPS, and full UTM
- OFFLINE-CAPABLE SETUP AND UPDATES: Configure via Nebula portal wizard; update firmware offline via FTP on the local network, while the web interface remains fully accessible without internet after each update
- COMPACT FANLESS DESIGN WITH POE+: with SPI 2,000 Mbps firewall throughput, 1,000 Mbps IPS, 500 Mbps VPN, the firewall supports up to 25 users, 20 IPSec tunnels, 15 SSL VPN users, and PoE+ (30W) through port number 5
- FLEXIBLE SOFTWARE-DEFINED PORTS: 5 x 1G RJ-45 ports (port 5 supports PoE+) assignable as WAN or LAN, WAN load balancing, active-backup failover, 8 VLAN interfaces, and Link Aggregation for resilience
- NEBULA MANAGEMENT AND VPN: Centralized policy control, monitoring, and SD-VPN orchestration; supporting IKEv2/IPSec, SSL, Tailscale VPN, 20 concurrent IPSec tunnels, 15 SSL VPN users, and up to 12 managed APs
What to do after an unauthorized change
- Contact the registrar immediately. Contact the registrar of record and, if the domain has moved, the gaining registrar. Ask for an urgent security review, an account freeze or lock where appropriate, preservation of relevant logs, and restoration of registration and DNS configuration. SSAC recommended emergency channels and restoration procedures in its 2005 report; that recommendation does not guarantee a registrar’s current service level.
- Secure the accounts involved. From a clean, trusted device, secure the registrar account, associated email, and affected identity or recovery accounts. Change compromised credentials and review recovery methods and account access.
- Preserve evidence. Save registrar notices, receipts, timestamps, historical registration details, support correspondence, and DNS-zone backups. Avoid discarding messages that could help establish what changed and when.
- Use the appropriate complaint and dispute routes. If the domain was transferred without permission, follow the registrar’s dispute procedure and submit ICANN’s unauthorized transfer complaint. ICANN says to contact the registrar immediately, but ICANN cannot itself compel a registrar to return a domain; the outcome depends on the circumstances and applicable law.
- Check the five-day lock-removal rule in context. ICANN says a transfer complaint may be submitted if a registrar does not provide a reasonable way to remove a lock within five days of a request. This guidance concerns a lock blocking a legitimate transfer; it is not a five-day deadline or recovery guarantee for a hijacking incident. ICANN’s locked-domain guidance.
- Verify services after control is restored. Check nameservers, DNS records, website, and mail settings against trusted records. Investigate suspected email interception or phishing as a separate security incident.
Why a legitimate transfer can be delayed
Transfer restrictions can block a legitimate move as well as frustrate an attacker. ICANN’s Transfer Policy page says the update was dated 21 February 2024, registrars could implement it from 21 August 2024, and implementation was required no later than 21 August 2025. The policy and ICANN’s registrant FAQ describe restrictions that include locks and 60-day limits following initial registration or certain changes and transfers. The updated policy also describes a 60-day inter-registrar lock after a change of registrant, with applicability and any opt-out or implementation details depending on the policy section and registrar. Check the live policy and your registrar’s process for the specific case rather than assuming every change creates the same restriction. ICANN Transfer Policy · ICANN FAQs for registrants transferring a domain name.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
