Nameservers changed without permission: what to do

Your nameservers decide who answers for your domain. Whoever controls them controls your website, your email and who can get certificates for your names. If they changed and nobody on your side did it, treat it as a hijack until you know otherwise.

First: check it wasn't one of you

Ask before you escalate. Common innocent causes:

a colleague, agency or MSP moving DNS to Cloudflare or a new host;
the registrar parking the domain after it expired (see domain expired);
a hosting provider changing nameservers during a migration.

Look up the current state:

dig +short NS example.com
whois example.com

If the nameservers belong to a provider nobody on your side uses, and no one can explain it, act now.

The first hour

Call your registrar's support or abuse line. ICANN's advice is to contact the registrar immediately: someone may have got into your account. Phone is faster than a ticket.
Get back into the registrar account. Reset the password, remove any login methods you don't recognise, and turn on two-factor authentication with an app or security key, not SMS.
Put the nameservers back to your real DNS provider.
Check the contact email on the domain. Attackers change it so transfer and reset emails go to them. Put yours back.
Check whether the domain is being transferred away. If the registrar shows a pending transfer, ask them to stop it.

If you use DNSSEC, the DS record at the registry must match your real DNS provider. If the attacker changed or removed it, put it back too, or validating resolvers will treat your domain as broken.

Then: undo what they did with it

While the attacker's nameservers were answering, they could:

receive your email by pointing MX at their server: password resets, invoices, anything sent to you;
get certificates for your names. Check CT logs with the certificate finder and revoke anything you didn't request: see certificate issued that I didn't request;
serve a copy of your site or a phishing page.

Reset passwords for accounts that send resets to that domain, warn staff and customers if mail or the site may have been abused, and check your DNS zone for records you didn't add.

If the domain was transferred to another registrar

Your registrar can start a dispute with the new one. Registrars must keep an emergency contact that answers within 4 hours, and only the registrar can file a Transfer Dispute Resolution Policy case. If your registrar won't act, you can file an unauthorised transfer complaint with ICANN. ICANN can't order a domain returned itself.

ICANN adopted a revised Transfer Policy in June 2026. It hasn't taken effect yet, so today's rules still apply.

Lock it so it can't happen again

Registrar locks. clientTransferProhibited and clientUpdateProhibited stop transfers and changes until you lift them in your account. They don't help if the attacker is in your account.
Registry lock. serverUpdateProhibited and serverTransferProhibited are set at the registry, and changes need a manual check with your registrar. See registry lock.
Two-factor login on the registrar account, and a contact email on a different domain, so a hijacked domain can't receive its own recovery email.

For moving to a registrar with better security, see the best registrar for security and transfer a domain safely.

Get alerted next time

Nameward records your registrar and nameservers on its first check and alerts you as soon as either changes, until someone confirms "It was us". The free scan shows your domain's locks, expiry and nameservers today.

My domain's nameservers were changed without permission