Your domain name is one of your most valuable digital assets. Lose it, and you lose your website, your email, your brand identity, and potentially years of SEO equity. Domain hijacking - where a bad actor takes control of your domain without your authorization - is not a theoretical risk. It happens to Canadian businesses every year, and recovery is painful, slow, and sometimes impossible.
The good news: protecting your domain takes less than an hour and costs nothing beyond what you're already paying for registration.
How Domain Hijacking Actually Happens
Understanding the attack vectors helps you defend against them. The most common methods:
Account compromise. If your registrar account is protected by a weak password or reused credentials from another site, an attacker who gets those credentials can log in, change your DNS records, and initiate a domain transfer before you notice anything is wrong.
Social engineering. Some attacks target registrar support staff directly. An attacker calls in pretending to be you, provides enough personal information to pass verification, and requests a transfer or email change. This is harder to execute but has been used against high-value domains.
Email compromise. If the email address on your registrar account is compromised, an attacker can use password reset flows to take over your registrar account, and from there, your domain.
Expired domains. If you forget to renew your domain and it enters the deletion pipeline, someone can register it out from under you.
The Essential Protections
1. Enable Registrar Lock
Registrar lock (sometimes called "domain lock" or "transfer lock") prevents your domain from being transferred to another registrar without you explicitly unlocking it first. This is the single most important protection you can enable, and it's free.
Log into your registrar account, find your domain management settings, and look for a lock or transfer lock option. Enable it. The domain status in WHOIS should show clientTransferProhibited. Some registrars also offer clientUpdateProhibited and clientDeleteProhibited - enable those too if available.
2. Use Two-Factor Authentication on Your Registrar Account
Most major registrars support 2FA. Enable it. Use an authenticator app (Google Authenticator, Authy, 1Password) rather than SMS-based 2FA if possible - SMS is vulnerable to SIM-swapping attacks.
If your registrar doesn't support 2FA in 2026, that is a serious red flag and a good reason to move your domain somewhere that takes security seriously.
3. Secure the Email Address on Your Account
Your registrar account's recovery email is often the weakest link. If someone can reset your email password, they can reset your registrar password. Make sure:
- The email account has its own strong, unique password
- 2FA is enabled on the email account
- The email address is not publicly visible (check WHOIS - more on that below)
4. Enable WHOIS Privacy
WHOIS records for .ca domains are managed by CIRA and have somewhat different privacy rules than generic TLDs. For most registrants, your name, organization, and email are visible in WHOIS by default unless you opt for privacy protection.
Your email address in WHOIS is a target. Spammers harvest it; attackers use it to enumerate your registrar. Enable privacy protection (most registrars include this free for Canadian domains) so your personal contact details aren't exposed publicly.
5. Set Up Auto-Renew and Monitor Expiry
A surprising number of domain losses happen not through hijacking but through simple expiry. Set your domain to auto-renew and make sure the payment method on file is current. Also note your expiry date somewhere outside the registrar - in your calendar, your project management tool, anywhere.
If your domain expires and enters the redemption period, recovery costs significantly more (often $150-$300 CAD or more) and requires contacting your registrar. If it reaches the deletion phase, it's gone and available for anyone to register.
6. Consider a Premium Registrar for High-Value Domains
If your domain is your primary business identity - your brand, your livelihood - consider registering it with a registrar that offers enhanced security features: registry lock (a stronger form of transfer lock that requires phone verification to remove), dedicated account managers, and rigorous identity verification for any account changes.
For most Canadian small businesses, the standard protections above are sufficient. But if your domain generates significant revenue, the extra cost of a premium security tier is justified.
What to Do If You Suspect Your Domain Is Being Hijacked
Act immediately. Contact your registrar's support team by phone (not email, which may already be compromised). Report the unauthorized activity and ask them to place an emergency hold on the domain.
File a complaint with ICANN's UDRP process or, for .ca domains, with CIRA's dispute resolution service. These processes exist specifically for domain ownership disputes, though they take time.
The takeaway: prevention is dramatically easier than recovery. Spend the hour now to lock down your domain. You'll never regret it.
