The Anatomy of a Domain Hijack

The high-profile domain hijacks you read about in security news β€” entire companies losing control of their domain for hours or days β€” almost always trace to one of four root causes:

  1. The registrar account password was reused or compromised.
  2. Two-factor authentication was not enabled.
  3. Registrar lock was off.
  4. The auth code was leaked, guessed, or generated and stored insecurely.

The first two are well-publicized. The last two β€” registrar lock and auth codes β€” are the quiet enablers that turn a credential compromise into a full domain transfer.

What Registrar Lock Actually Does

Registrar lock (sometimes called "transfer lock", "domain lock", or "60-day lock") is a flag on your domain at the registry level. When set, it prevents:

  • Outbound transfers to another registrar
  • Changes to the registrant contact information at some registries
  • Updates to nameservers at some registries (less common)

The lock does NOT prevent:

  • Renewal (you can always renew a locked domain)
  • DNS record changes (A, MX, TXT records β€” those are at your DNS provider, not the registry)
  • Logging in and seeing the domain in your account

Most major registrars enable the lock by default. Some β€” particularly cheap registrars and some hosting bundles β€” do not. Verify yours is on, no matter who you registered with.

How to Verify Your Lock Status

Quick check: run a WHOIS lookup on your domain. Look for the "status" field. You should see one or more of:

  • clientTransferProhibited β€” your registrar has locked the domain (good)
  • serverTransferProhibited β€” the registry has locked the domain (very good β€” see Registry Lock below)

If you see ok or active with no transfer-prohibited flag, your domain is unlocked and transferable. Fix this immediately by enabling lock in your registrar dashboard.

Auth Codes: The Master Key You Probably Forgot About

An auth code (also called EPP code, transfer code, or auth-info code) is a per-domain secret that authorizes a transfer. To move a domain from one registrar to another, the receiving registrar requires the auth code. Whoever has the code can initiate a transfer.

This means: your auth code is functionally a master key for your domain. Treat it like one.

Best practices:

  • Do not generate the auth code until you actually plan to transfer. Most registrars regenerate the code on demand β€” you do not need a "saved" copy lying around.
  • Never email the auth code in plaintext. If you must share it (transferring to a colleague's account), use a password manager's secure share feature or an end-to-end encrypted channel.
  • Treat any old auth code in your notes or password manager as already-leaked. Regenerate before transferring.
  • Reset the auth code immediately after a transfer attempt fails or is canceled. The previous code may be compromised.

Registry Lock: The Tier Above Registrar Lock

For high-value domains, registry lock is a second, stronger layer. It is enforced at the registry (Verisign for .com, etc.), not the registrar. To unlock, you typically need to:

  • Make a phone call to a registry-approved support line
  • Authenticate via a secret phrase or callback to a pre-registered phone number
  • Wait a fixed delay (often 24–72 hours)

This makes registry lock effectively impossible to bypass via a registrar account compromise alone. Major brands (Google, Facebook, Twitter) use registry lock for their primary domains. It costs $50–500/year depending on the registrar offering it.

For domains where a few hours of downtime would cause material damage, registry lock is worth it. For most personal and small-business domains, registrar lock + 2FA + auth-code hygiene is sufficient.

The Transfer Notification Path

When someone initiates an outbound transfer of your domain, the registrar sends an email to the registrant contact on file. If you click "approve" β€” or if you ignore it for 5 days β€” the transfer proceeds.

The hijacker's playbook often relies on the registrant email being:

  • An old work address from a former employer
  • A personal address you no longer monitor
  • A generic "info@" alias forwarded to several people, none of whom take responsibility

Audit the registrant email on your domain right now. WHOIS will show you what is registered. Update it to an address you actively monitor.

The 5-Minute Hardening Checklist

  1. Log into your registrar. Enable 2FA if you have not.
  2. Verify registrar lock is ON for every domain.
  3. Run WHOIS on your domain. Verify clientTransferProhibited appears in the status.
  4. Verify the registrant email is current and monitored.
  5. Make sure NO copy of any auth code is sitting in your email, Slack, or notes app.
  6. For domains worth more than your monthly revenue: consider registry lock.
  7. Set a calendar reminder to redo this audit annually.

What If You Suspect a Hijack Attempt?

If you receive an unexpected transfer notification:

  1. Do not click any links in the email. They may be spoofed.
  2. Log into your registrar dashboard directly (type the URL).
  3. If a transfer is pending, reject it. Most registrars surface pending transfers prominently.
  4. Change your registrar password and 2FA secret immediately.
  5. Regenerate the auth code (this invalidates any leaked code).
  6. Contact registrar support to flag the attempt and ask them to investigate.

The 2-Minute Habit

Domain hijacks are dramatic when they happen, but they are almost always preventable. Lock + 2FA + clean auth-code hygiene + monitored registrant email closes 95% of the attack surface. None of it costs money. Most of it takes minutes to set up.

The remaining 5% β€” registry lock, custom DNSSEC chains β€” is for domains where downtime would be catastrophic. For everyone else, the basics are enough, but only if you actually do them.