Tips › Domain Night Watch

Domain hijacking: warning signs worth knowing

Domain hijacking means someone takes control of a domain without the owner's consent. Most cases begin with an access problem at the registrar, and a few early signs are visible from outside.

Records that change on their own

Unexpected changes to name servers or mail servers are the clearest sign. They are visible in public DNS, so anyone checking can see them.

Emails you did not ask for

Messages from the registrar about password resets, contact changes or transfer requests that you did not start deserve a closer look.

A lapsed registration

A domain that is allowed to expire can be registered by someone else. This is not an attack on the owner, but the effect is the same. The period after expiry also differs from registry to registry.

What a check can and cannot do

A regular check of public records shows changes quickly. It cannot see inside the registrar account, which is why strong access protection there still matters.

Related tips

• Why did my domain's name servers change?
• How do I get a reminder before my domain expires?
• What should I monitor on my domain?
• What can domain monitoring not do?
• Should a domain alert wake you up at night?

Domain Night Watch is in testing.

Last reviewed: 2026-11-02

#DNS #SSL #DMARC #SPF #EmailSecurity #DomainMonitoring #SysAdmin #MSP #iOS

This page gives general information and is not legal, financial or medical advice. [email protected]