What is domain hijacking?
Domain hijacking means someone without authorisation takes control of a domain or its central settings. The attacker may try to transfer the domain, change name servers or alter DNS so web traffic and email are directed elsewhere.
A hijacking can start with a stolen login, weak access management or social manipulation. Protection therefore needs to cover people, processes and technology.
Protect the domain in layers
Start with a complete view of company domains, the registered holder and the people who can make changes. Use individual accounts, strong authentication and least privilege. Monitor renewals and contact details as well.
Registry lock can add registry level controls for prioritised domains. For .se, the Swedish Internet Foundation describes protection against actions including redelegation, deregistration, holder changes and registrar changes. For .com, Verisign distinguishes registry level and registrar level statuses. The exact commercial service and process must be confirmed with the provider.
- Correct holder and current contact details
- Individual accounts and strong authentication
- Controlled renewals and change management
- Registry lock for critical domains
DNSSEC does not replace registry lock
DNSSEC and registry lock solve different problems. DNSSEC makes it possible to verify DNS response integrity while registry lock protects certain administrative actions at the registry. A company may need both, together with secure DNS operations and control over who can change individual DNS records.
Registry lock does not automatically protect the web application or every record at the DNS operator.
Prepare for an incident
Document who should be contacted if a domain changes unexpectedly, what evidence should be preserved and how the organisation should communicate. A recovery plan should include provider contacts, authorised people and priorities for web and email.
If you suspect hijacking, avoid changing more settings than necessary before documenting the situation. Contact the domain provider through a known and trusted channel and involve internal IT and security owners.