How it works
Domain hijacks start at the registrar: someone gets into your registrar account, or social-engineers its support team, and transfers the domain or changes its nameservers. Once a day, we read your domain's registry status through RDAP and check:
- Transfer lock:
clientTransferProhibited(or the registry's equivalent) must be set, so the domain cannot be moved to another registrar without your approval. - Registrar and nameservers: a change is the first visible sign of a hijack. We alert you once, then the new values become the baseline.
- Registry holds: statuses such as
serverHold,clientHold,redemptionPeriodorpendingDeletemean the registry has pulled the domain from DNS.
Statuses
| Status | Meaning |
|---|---|
| OK | The transfer lock is on and nothing changed. |
| Warning | The transfer lock is off, or the registrar or nameservers changed. |
| Failed | The domain is on hold, being redeemed or pending deletion: it no longer resolves. |
By default you are notified of warnings and failures.
Fixing common problems
- Transfer lock is off: turn on "domain lock" or "transfer lock" in your registrar's control panel. Unlock it only while you transfer the domain.
- Unexpected change: sign in to your registrar at once, check the account's contacts and nameservers, change the password and enable two-factor authentication. Contact the registrar's abuse team if you did not make the change.
- On hold: usually an unpaid renewal or unverified contact details. Your registrar can tell you why.