What to do if your domain or DNS is hijacked

• Your website shows someone else's content, a parked page, or a certificate warning.
• Email stops arriving, or arrives late, or customers say replies go somewhere else.
• You get registrar emails about a password change, contact change, transfer request or nameserver change you didn't make.
• You can't sign in to the registrar account, or the account email has changed.
• DNS lookups show nameservers or MX records you don't recognize.

Your registrar is the company you pay for the domain (not necessarily your web host). Call them, not just email, and ask for the security or abuse team. Explain that the domain has been hijacked, ask them to freeze changes and transfers, and ask what proof of ownership they need: usually invoices, ID, and historical account details. Keep a record of every conversation.

If the domain has been transferred to another registrar, ICANN's transfer policy provides dispute processes between registrars for generic domains such as .com. For .ca domains, CIRA (the Canadian Internet Registration Authority) runs the registry; your registrar is still the first contact, and CIRA's support pages explain how to find your registrar if you bought the domain through another provider.

Once you have control back, restore your DNS records: nameservers, A/AAAA records for your website, MX records for mail, and TXT records for SPF, DKIM and DMARC. This is much easier if you kept an export of your zone file or have screenshots from before. Your email provider's admin centre (Microsoft 365 or Google Workspace) lists the records it expects.

Remember DNS changes take time to propagate because resolvers cache old answers, so some users may see the attacker's records for a while after you fix them.

If the MX records pointed elsewhere, even briefly, mail sent to your domain during that window may have gone to the attacker. That can include password reset emails, invoices, client documents and anything containing personal information. Identify the window as precisely as you can from registrar and DNS history, and work out what mail should have arrived.

Check whether the attacker used intercepted password-reset emails to take over other accounts tied to your domain: banking, cloud services, social media, and your email platform itself. If mail containing personal information was exposed, assess and record the privacy breach.

• Turn on MFA for the registrar account, using an authenticator app or security key rather than SMS.
• Make sure the account email is on a domain you control, but not the same domain the account manages, so a hijack can't lock you out of the reset email.
• Enable registrar (transfer) lock.
• For important .ca domains, consider CIRA's Registry Lock, offered through participating registrars, which requires manual verification before changes are made at the registry.
• Use DNSSEC where your registrar and DNS provider support it.

• Keep domain ownership in the company's name, with at least two authorized people.
• Keep the auto-renew and payment details current; expired domains get snapped up.
• Monitor DNS and certificate changes for your domains.
• Publish DMARC at an enforcement policy (RFC 7489 defines DMARC; M3AAWG publishes best practice) so attackers can't simply spoof your domain once you've recovered it.
• Document who your registrar, DNS host and web host are. Call our 24/7 line at (289) 582-9930 if you need help assessing what was intercepted.