What to Do If Your Domain Is Hijacked? Emergency Response Steps and Preventive Measures

　　Your website suddenly becomes inaccessible; users report that visiting the domain redirects them to an unfamiliar page, yet your own tests show normal access in some regions and issues in others. This type of intermittent, location-dependent failure is likely not a server outage, but rather domain hijacking.

　　Domain hijacking and DNS pollution are concepts easily confused. DNS pollution typically occurs during the resolution and transmission process, where an attacker tampers with the response between the user and the DNS server. Domain hijacking, however, has a broader scope; an attacker might directly control your domain's DNS records or compromise your domain registrar account, fundamentally altering where the domain points. While the former affects only a subset of users, the latter can redirect all users to an incorrect address.

　　Regardless of the scenario, the core response strategy remains the same: confirm the issue, take immediate steps to mitigate damage, investigate the root cause, and finally, establish long-term safeguards.

　　I. Rapid Confirmation: Is It Actually Hijacking?

　　Before taking any action, spend a few minutes confirming the nature of the problem. A misdiagnosis could lead to wasted effort or even disrupt valid configurations.

　　Step 1: Check for anomalous resolution results

　　Open a command prompt or terminal and execute the following command:

nslookup yourdomain.com

　　Note down the returned IP address. Then, specify the use of a public DNS to query again:

nslookup yourdomain.com 223.5.5.5
nslookup yourdomain.com 8.8.8.8

　　If different DNS servers return inconsistent IP addresses—or if the returned IP is not your server's IP at all—you can generally confirm that DNS hijacking is occurring.

　　Step 2: Test across multiple network environments

　　Access your domain using a mobile network (4G/5G) and test it using broadband connections from different ISPs. If anomalies appear on only some networks, the hijacking may be occurring at the ISP level; if anomalies appear across all networks, the issue likely lies with the domain resolution records themselves.

　　Step 3: Check the domain resolution management console

　　Log in to your domain registrar or DNS provider's management console and verify that the A records, CNAME records, and NS records match your expected configuration. Finding unfamiliar resolution records or an NS server address you do not recognize is direct evidence that the domain has been hijacked.

　　II. Emergency Response: Mitigate Damage First, Troubleshoot Later

　　Once hijacking is confirmed, time is of the essence to minimize losses. Below are emergency response steps prioritized by urgency.

　　1. Immediately change account passwords and enable two-factor authentication

　　Domain hijacking often occurs when domain registration or DNS management accounts are compromised. Attackers obtain account credentials through methods like phishing or credential stuffing, then log in to the management console to alter resolution records.

　　Immediately log in to your domain registrar and DNS provider consoles to change your login passwords. New passwords should be sufficiently complex, combining uppercase and lowercase letters, numbers, and special symbols. More importantly, enable two-factor authentication (2FA/MFA) immediately. Once enabled, attackers cannot log in without your mobile device or authenticator app, even if they have your password.

　　2. Restore correct resolution records

　　After securing your account, check and restore the DNS resolution records. Delete any unfamiliar A or CNAME records and revert the NS server addresses to the correct ones. If you previously backed up your DNS configuration, you can import the backup to restore settings quickly.

　　After restoring the records, it takes time for the DNS changes to propagate globally—usually ranging from a few minutes to several hours, depending on the TTL (Time to Live) settings. If the TTL was previously lowered maliciously, it may take longer for full recovery.

　　3. Temporarily suspend DNS resolution (extreme cases)

　　If an attacker continues to tamper with your DNS records and you cannot immediately regain control of your account, consider temporarily suspending the domain's DNS resolution service. While this renders the website inaccessible, it at least prevents users from being redirected to malicious pages.

　　4. Contact the domain registrar

　　If you cannot log in to your account or discover that the domain has been maliciously transferred to another registrar, contact your domain registrar's customer support immediately. Have proof of domain ownership ready (such as the registered email address, proof of identity, etc.) and request their assistance in freezing the domain or restoring control.

　　III. Identifying the Root Cause: How the Attacker Got In

　　Restoring access is merely the first step; identifying the entry point is essential to prevent future hijacking.

　　1. Check the Domain Registration Account

　　Review recent activity for unusual login alerts or password reset emails. Check if the registered email account has been compromised, as many domain operations rely on email verification. If the registered email account is insecure, an attacker could use the "Forgot Password" function to reset your domain account password.

　　2. Check the DNS Provider

　　If you use a smaller DNS provider, their systems may have security vulnerabilities. Check the login logs in the DNS management dashboard for any logins from unfamiliar IP addresses. If the DNS provider itself has been compromised, consider migrating to a larger provider with stronger security capabilities.

　　3. Check Servers and Local Environments

　　If DNS records appear normal but users are still being redirected, the issue may lie on the server side. Check the server for malicious programs or unauthorized 301 redirect rules. Additionally, check the website application for known vulnerabilities and promptly update your CMS and plugins.

　　For enterprise networks, also check internal DNS servers for misconfigurations or weak passwords.

　　IV. Long-Term Protection: Building a Multi-Layered Defense System

　　Domain security is not a one-time task but an ongoing process requiring continuous maintenance. The following measures are listed from highest to lowest level of protection.

　　1. Account Layer: Securing the Entry Point

　　Enable Multi-Factor Authentication (MFA): This is the most cost-effective security measure. Adding a verification layer beyond the username and password ensures that unauthorized access is prevented even if the password is compromised.

　　Enable the Transfer Lock: This feature prevents the domain from being maliciously transferred to another registrar. Once enabled, the domain status changes to `clientTransferProhibited`, and any transfer requests will be rejected.

　　Enable the Update Lock: This prevents critical settings—such as contact information and DNS server details—from being tampered with. This feature is supported for mainstream extensions such as .com, .net, and .cn.

　　2. Resolution Layer: Cryptographic Verification

　　Enable DNSSEC: DNSSEC verifies the authenticity of DNS resolution records using digital signatures. Even if an attacker tampers with data packets during transmission, the browser will reject the incorrect resolution results because the attacker cannot forge the signature.

　　Use High-Protection DNS Services: Major service providers possess superior resilience against attacks and capabilities for detecting hijacking. They typically offer intelligent traffic routing, automatically switching to healthy nodes when anomalies are detected.

　　3. Application Layer: Encrypted Transmission

　　Enable HTTPS Site-wide: Configure a valid SSL certificate and set the HSTS response header. This ensures that even if a user is redirected to a fraudulent page, the browser will display a certificate warning, preventing the user from inadvertently entering sensitive information.

　　HSTS can be configured in Nginx as follows:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

　　4. Monitoring Layer: Detecting Anomalies Promptly

　　Regularly inspect DNS records: Check DNS resolution configurations weekly to ensure they match expected settings. Automated monitoring tools can be used to trigger alerts whenever changes in resolution results are detected.

　　Monitor domain status: Pay close attention to any change notifications sent by the domain registrar. If you receive a notification regarding a change you did not initiate, log in to the management console immediately to verify the situation.

　　Summary: Managing domain hijacking involves four stages: confirming the issue, immediate damage control, root cause analysis, and long-term protection.

　　The core of the confirmation stage is comparing resolution results using multiple DNS tools to determine whether the hijacking is localized or affects the entire network. Key actions for immediate response include rapidly regaining account control, restoring correct DNS records, and enabling two-factor authentication (2FA). The analysis stage requires tracing the attack vector and plugging security vulnerabilities. Finally, the protection stage involves building a defense-in-depth strategy across four areas: account security, DNS configuration, application security, and monitoring.

　　For enterprise users, it is recommended to incorporate domain security into standard daily operations and conduct regular emergency response drills. Individual webmasters should, at a minimum, take three steps: enable domain locking, activate two-factor authentication, and use a trusted DNS service provider. These measures incur no additional cost yet can thwart the vast majority of attacks.