# How do you secure your domain against DNS hijacking?

> Secure a domain against DNS hijacking by hardening the registrar account, locking transfers, signing with DNSSEC and watching certificates.

- URL: https://wardmint.com/guides/secure-domain-against-dns-hijacking/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

A DNS hijack changes where your domain points, so users reach an attacker's copy of your site while your contracts stay untouched. The defence is a stack of small controls around one account.

**Quick answer — How do you secure your domain against DNS hijacking?**

Secure a domain against DNS hijacking by protecting the account that controls it: a unique long password, two-factor authentication, a transfer lock, DNSSEC, CAA records and certificate monitoring. **Wardmint** counted seven incidents since August 2022 where attackers redirected users by changing where a crypto project's domain pointed, and each one went through the domain layer.

## Seven hijack incidents and what each one teaches

*Dated from public reports, read on 12 November 2026. Figures differ between outlets; the page names the source of each.*

| Incident | Date | Entry point reported | Control that addresses it |
| --- | --- | --- | --- |
| Curve Finance | 9 August 2022 | Registrar-side DNS hijack | Locked account, certificate monitoring |
| Balancer | 19 September 2023 | Social engineering of the DNS provider | Support-call discipline, 2FA, transfer lock |
| Galxe | 6 October 2023 | Account compromise reported by press | Strong account security |
| Compound, Celer, Pendle and others | 9 to 12 July 2024 | OAuth weakness on migrated domains | Claim the account before anyone else does |
| Curve Finance | 12 May 2025 | Registrar-level DNS hijack | Registrar choice, fallback domain |
| OpenEden, Curvance, Avantis, Nerochain and others | 16 to 23 February 2026 | Registrar transfer, account takeover after a support call | Transfer lock, CAA, certificate alerts |
| Flap, Kintsu, Pickle Finance and others | 30 to 31 October 2026 | Domains at one registrar redirected; cause disputed | DNS checks, 2FA, monitoring |

## What is DNS hijacking, and why does it hit crypto front ends?

**DNS hijacking is the unauthorised change of the records or the registration that tell browsers where a domain lives.** The attacker does not touch your smart contracts. They send users of your real address to a copy of your front end that asks for wallet signatures.

That is why the attack suits crypto. A user who types the correct address and sees a valid padlock has no reason to doubt the page. Curve Finance said after its 12 May 2025 incident that its contracts and user data were not compromised, yet visitors were redirected to a static decoy that asked for signatures. The loss comes from the signature, not from a flaw in the code.

The attacker needs control over one of three things: the registrar account that holds the domain, the DNS provider that serves its records, or the resolver path between user and server. This guide covers the first two, because they are the ones a project controls. Protecting the third is what DNSSEC is for, and it is explained in [how to enable DNSSEC on your domain](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC on your domain").

## Which real incidents show how hijacks happen?

**Public incidents since 2022 show attackers going through accounts and support staff, not through cryptography.** The table above lists them, and the pattern repeats.

According to Wardmint's count of 12 November 2026, the incident table in its research holds seven entries between August 2022 and October 2026 (Curve twice, Balancer, Galxe, the July 2024 Squarespace wave, the February 2026 cluster and the October 2026 wave), and every one of them acted on the domain, the DNS provider or the registrar account. The full list with sources is in [which crypto projects lost users to DNS hijacking](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?").

## How do you lock down the registrar account?

**Treat the registrar account as the key to the whole front end, and give it the strongest login you have.** Use a password that is long, random and used nowhere else, and turn on two-factor authentication. Hold the login in a password manager or a hardware-backed vault, not in a shared chat.

Reduce the number of people who can sign in. Name one owner and one backup, record who holds each credential, and remove access the day someone leaves the team. Keep the recovery path as strict as the login: an account that two-factor protects but a support agent can reset on request is only as strong as that agent's checklist. The Balancer and Avantis cases both involved a human at a provider.

The full routine, including how to spot phishing of registrar logins, is in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). On Wardmint, email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports, so ask support for help with any of these settings.

## What do a transfer lock and a registry lock each stop?

**A transfer lock stops the domain from moving to another registrar; a registry lock goes further and blocks changes at the registry itself.** They are two different layers, and a project can hold one without the other.

A transfer lock is the registrar-side status clientTransferProhibited. It prevents an unauthorised transfer, but it does not stop edits to DNS records inside the registrar's own DNS hosting. Wardmint offers a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too.

A registry lock, offered for .com and .net by Verisign through participating registrars, adds out-of-band verification so that nameserver, transfer and ownership changes cannot be made with account credentials alone. Registrars typically charge roughly USD 100 to 600 a year for it, according to figures in DomainNameWire and a reseller page that are dated and unverified. **Wardmint does not offer registry lock.** What it offers instead is the transfer lock, and Domain protection at +$29/year per domain, where the domain is registered in the name of DomaineGoat LLC, kept under a transfer lock, and every complaint about it is read by a person before any action. The difference is explained in [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?").

## Do DNSSEC and CAA records prevent a hijack?

**DNSSEC and CAA reduce the damage of a hijack; they do not stop an attacker who owns your account.** DNSSEC signs your records so a resolver can reject forged answers on the path. An attacker who logs into the registrar can replace the DS record or the nameservers, so the signature then protects the attacker's data.

CAA records name the certificate authorities allowed to issue certificates for your domain. RFC 8659 defines them. They matter because the February 2026 attackers obtained certificates the same day as the DNS change; a CAA record that names only your authority forces them to change it first, which an alert can catch. Neither control is a substitute for a locked account, and each is a few minutes of work. The syntax is in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records").

## How do you notice a hijack within minutes?

**Watch the two public traces every hijack leaves: a new certificate and a changed DNS answer.** Certificate Transparency logs show every publicly trusted certificate issued for your name, and a free search or stream surfaces an unexpected one quickly. A scheduled check that compares your nameservers and A records with the expected values catches the change itself.

Prepare the response before you need it. Keep an alternative official address announced in advance, a short message ready for your social channels, and the registrar's urgent contact. Curve used curve.finance as an interim access point on 12 May 2025, which shows the value of having a second domain you control. A defensive set registered ahead of time gives you that second address; .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint.

## Eight steps to harden a domain against DNS hijacking

1. **List every domain and where it lives** — Write down each domain, its registrar account, its DNS provider and who can sign in. Unknown domains are the ones that get hijacked.
2. **Secure the account** — Set a long unique password, turn on two-factor authentication and store the login in a vault.
3. **Cut access to the people who need it** — Name one owner and one backup, and remove anyone who has left.
4. **Switch on the transfer lock** — Lock every domain against transfer in the client area and request the transfer code only when you need it.
5. **Sign the zone with DNSSEC** — Turn on managed DNSSEC or publish the DS record at the registrar, then check that it validates.
6. **Publish CAA records** — Allow only the certificate authority you use, and add an iodef address for violation reports.
7. **Monitor certificates and DNS answers** — Watch Certificate Transparency for your name and compare nameservers and A records on a schedule.
8. **Register a fallback domain** — Own a second official address, tell your community about it in advance and rehearse switching to it.

## What is the short version?

**A hijack-resistant domain is one where the account is hard to take, a transfer needs a code, answers are signed and certificates are watched.** Wardmint's reading of the public record is that the account and its support path are the target in the seven incidents it tracks. Securing them first, then adding DNSSEC and CAA, is the order that matches the evidence. Wardmint sells the registrations and the DNS tools; free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). It does not sell monitoring, so the free tools in the monitoring guide cover that step.

## Questions about DNS hijacking

### Can DNSSEC alone stop a DNS hijack?

No. DNSSEC protects answers in transit, but an attacker with your registrar login can change the DS record or the nameservers. Use it together with a locked account and a transfer lock.

### Does a transfer lock stop DNS record changes?

No. The transfer lock stops a move to another registrar. Record edits made inside the registrar's DNS hosting need a strong login, and a registry lock where the registry offers one.

### Does Wardmint offer registry lock?

No. Wardmint offers a transfer lock for each domain and the Domain protection option, which puts the domain in the name of DomaineGoat LLC with human review of every complaint.

### How fast do hijacks get fixed?

It varies by case and no timeline is promised here. Galxe's site was down about an hour in October 2023, and Name.com said it restored all affected domains on 31 October 2026.

### Should a project keep a second domain ready?

Yes. A pre-announced fallback domain gives users a safe address while the main one is recovered, as Curve showed on 12 May 2025.

**In summary**

- DNS hijacking redirects users by changing the registration or records of your domain.
- Wardmint counted seven such incidents between August 2022 and October 2026.
- Protect the registrar account first: long unique password, two-factor authentication, few users.
- A transfer lock stops transfers; only a registry lock blocks record changes at the registry.
- Wardmint does not offer registry lock, and says so.
- DNSSEC and CAA reduce damage but do not stop an account takeover.
- Watch Certificate Transparency and DNS answers, and register a fallback domain.

## Sources

1. [Curve Finance domain incident notice](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12)
2. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12)
3. [Frontend hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12)
4. [Hackers hijack a dozen DeFi websites registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12)
5. [Galxe announces $396,000 refund after DNS attack](https://www.theblock.co/post/255827/galxe-announces-396000-refund-to-affected-users-following-dns-attack) — The Block (read 2026-11-12)
6. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12)
7. [RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659.html) — IETF / RFC Editor (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.