Domains are rarely stolen by clever technical attacks. They’re taken because somebody got into an email account, and the registrar login was recoverable from it.
That’s worth sitting with, because it changes what protecting a domain actually involves. It’s less about sophisticated defences and more about closing a small number of well-known doors — most of which are standing open at the average small business.
How domains are actually taken
Through the registrant’s email account
The most common route by a distance. An attacker gets into the mailbox listed on the domain, triggers a password reset at the registrar, and now controls the domain. If that mailbox is hosted on the domain itself, one compromise gives them everything at once.
Through an unlocked domain
Registrars offer a transfer lock that blocks a domain being moved without deliberate authorisation. It’s usually free and frequently switched off, particularly on domains registered years ago or moved between providers.
Through a former supplier’s account
Where a domain sits in an agency’s registrar account, its security is entirely their security. If they’re breached, you’re breached — and you may not be told.
Through expiry
The least dramatic and most common way to lose a domain: nobody renewed it, and someone else registered it. Expiring domains are monitored and caught by automated services within seconds of dropping.
Through social engineering at the registrar
Rarer, but it happens. An attacker contacts support with enough plausible detail to have contact details changed. Accounts with strong verification and locks in place are considerably harder to talk past.
The controls that actually prevent it
Transfer locks
Applied to every domain we manage. A locked domain cannot be transferred away without the lock being deliberately lifted.
Two-factor authentication on registrar accounts
Removes the single-password failure mode entirely. Not tied to one employee’s personal phone.
A registrant contact address that isn’t on the domain
Underrated and important. If the domain goes down or is hijacked, you must still be able to receive the emails needed to recover it. Using an address on the same domain creates a circular dependency at precisely the worst moment.
Registration to the company, never an individual
Ownership disputes turn on the registrant record. A domain registered to a director personally becomes complicated if they leave, fall out with the business, or die.
DNSSEC
Cryptographically signs your DNS records so they can’t be forged in transit. Protects against spoofing and cache poisoning — attacks where visitors are sent to an attacker’s server while your domain appears entirely normal.
DMARC
Instructs receiving mail servers what to do with email that fails authentication. Without it, anyone can send mail appearing to come from your domain and nothing stops them. See email deliverability.
Monitoring
Watching for unexpected changes to registration details, nameservers or DNS records — because the earlier an unauthorised change is caught, the more recoverable it is.
Lookalike domains and invoice fraud
Not every domain attack targets your domain. Some target your customers using something that resembles it.
The mechanism behind invoice redirection fraud is straightforward. Someone registers a domain a single character different from yours — a transposed letter, an rn where you have an m, a .co where you have .co.uk. They then email your customer, apparently from you, advising that your bank details have changed.
The money goes. The customer is out of pocket. And the reputational damage lands on you, regardless of fault.
What helps:
- Knowing which lookalikes already exist — most businesses have never checked
- Registering the most plausible variants defensively, where it’s proportionate
- A strict DMARC policy, so mail from your actual domain can’t be faked
- Telling customers you will never change bank details by email — the cheapest control available, and the most effective
A portfolio audit includes a check for registered lookalikes.
What to do if a domain has been compromised
- Secure the email account first. If that’s still accessible to an attacker, everything else can be undone.
- Contact the registrar immediately, by phone. There are procedures for disputed transfers, and they’re time-sensitive.
- Document everything — timestamps, screenshots, WHOIS records before and after. You may need to evidence this.
- Escalate to the registry if needed. Nominet for .uk; the relevant registry or ICANN process for others.
- Report it. Domain theft is a crime, and reporting matters for insurance.
Speed matters enormously. A domain moved to a registrar in another jurisdiction and then sold on becomes dramatically harder to recover.
Where most businesses actually stand
In our experience the typical small business has: no transfer lock, no two-factor authentication, a registrant contact on the domain itself, no DNSSEC, no DMARC policy, and no idea which lookalike domains exist.
None of that reflects carelessness. It reflects that nobody was ever asked to check. Every item on that list is fixable, most of it in an afternoon, and most of it at no cost beyond the time.
Have your setup checked
We can assess your current domain security from public records in about half an hour, and tell you plainly what’s exposed.
Call 01202 835235 or email contact@domainwarden.co.uk.