How to protect your startup's domain from registrar suspension

Last updated: 2026-11-05

Domain registrar suspension takes your website and email offline at the same moment. Four events usually cause one: an unanswered verification or accuracy email, a missed renewal, an abuse report, or a court order.

A few safeguards lower the risk. Use accurate, role-based contacts and turn on auto-renewal. Add phishing-resistant MFA, and use both registrar and registry locks. Keep recovery options that do not depend on the domain itself.

Key facts

In this article

• Why would a registrar suspend your domain?
• Who actually controls your domain, and how does a suspension work?
• How do you protect a domain before anything goes wrong?
• What should you do in the first hour if your domain is suspended?
• How do you get a suspended domain back?
• Should you move registrars, and how?
• What does domain registrar suspension look like in real incidents?
• Where RocketDevs fits
• Conclusion
• Frequently asked questions

Why would a registrar suspend your domain?

Registrars suspend domains for several reasons: contact data that is unverified or looks inaccurate, a lapsed renewal, an abuse report, a terms-of-service breach, or a court order.

Amazon's registrar documentation lists five causes. They are an unclicked verification link, an expired domain with auto-renew off, an unverified change of registrant email, an acceptable-use violation, and a court order.

Namecheap's list of legal and abuse reasons adds phishing and malware. It also names spam and WHOIS inaccuracy. Failure to verify contact information is on the list too.

Most of these causes come from a rule. That rule tells you how much warning to expect.

Unverified or inaccurate contact data

This trigger catches companies that have done nothing wrong. The 2013 Registrar Accreditation Agreement (RAA) is the contract between ICANN and every accredited registrar. It covers generic top-level domains such as .com, .net and .org; country-code domains follow their own registry rules. Under it, a registered name holder must correct contact details within seven days of any change. If you ignore a registrar's accuracy inquiry for more than fifteen days, that is a material breach. The registrar may then suspend or cancel the domain.

The agreement's WHOIS Accuracy Program Specification sets a clock. If the registrar gets no affirmative verification response within fifteen calendar days, it must verify the details manually or suspend the registration. After a willful inaccuracy or fifteen days of silence, the registrar must terminate or suspend the name. It may instead place the name on clientHold and clientTransferProhibited until the information is validated.

That last option matters. The registrar removes the name from DNS and locks it in place at the same moment. A suspended domain is a domain you cannot move.

The clock can be shorter than founders expect. AWS gives you between 3 and 15 days to click the verification link on a new domain, depending on the top-level domain. Namecheap says ICANN requires verification within 15 days of registration. The same deadline applies after a change to the registrant's name or email.

The scale is documented. In June 2014, Tucows CEO Elliot Noss told ICANN's board that at least 800,000 domains had been suspended since 1 January under the verification rule. His figures came from registrars covering about 75% of registrations. DomainIncite reported the same number. Tucows sells domains and argued that the rule did harm, so weigh the framing rather than the count.

The rule is still live. As of May 2026, registrants still have 15 days to verify by clicking an emailed link. A Tucows analysis of one of its wholesale registrars found that nearly half of registrants verified on the day they registered. Another quarter did not verify on time and were suspended.

A false report can set off the same process. ICANN's Security and Stability Advisory Committee lists a WHOIS inaccuracy report filed against the registrant as a threat to a registration account.

A lapsed renewal

A registrar can delete a name once it expires, but it must warn you first. ICANN's Expired Registration Recovery Policy requires at least two expiry notices. One goes out about a month before expiration and the other about a week before.

Registrars may delete a registration at any time after it expires. If a name is deleted within eight days of expiration, the registrar must interrupt DNS resolution from expiration until deletion, where the registry permits.

The warnings go to the contact address on file. If that mailbox is on the expiring domain, nobody will read them. The same is true if it belongs to an employee who has left.

The advisory committee is blunt about who owns the outcome. It says that losing a name in these circumstances results from the registrant's failure to take adequate internal measures to renew domain names promptly.

Abuse reports, risk reviews and court orders

Every accredited registrar must publish an abuse contact. It must also take reasonable and prompt steps to investigate and respond to abuse reports.

Since 5 April 2024, that duty has been stricter. ICANN's contract amendments require registries and registrars to act to stop or disrupt well-evidenced DNS abuse. In the first six months, ICANN reports that its compliance team opened 192 investigations. Its enforcement led to the suspension of over 2,700 abusive domain names. This is ICANN describing its own program. Even so, registrars are clearly under contractual pressure to act on a report, and acting means placing a hold.

Registrars also run their own reviews. Namecheap's help center says a suspension usually starts when the registrar emailed a domain information request and the customer did not respond. For more severe issues, it says a domain could be suspended immediately without warning. That is one registrar describing its own practice. The pattern is an emailed request, a deadline, and a hold if the deadline passes.

A court can also order a name suspended or redirected. AWS documents that, in a court-ordered suspension, the court might not allow it to notify the registrant contact. You may learn about it only when your site goes dark. This is rare for an ordinary startup. It is also the one case where no registrar support team can help.

Who actually controls your domain, and how does a suspension work?

Control of a domain is split across a chain. The registry holds the master record. The registrar holds your account and talks to the registry. You, the registrant, sit at the end of the chain.

NIST's March 2026 DNS deployment guide describes the registrar's role plainly: registrars are companies authorized to register domain names in a TLD for end users.

• The registry runs the master database for a top-level domain. Verisign runs .com and .net. Your name resolves because the registry publishes a delegation for it.
• The registrar is the accredited company you buy the name from. It talks to the registry over EPP, the Extensible Provisioning Protocol. The IETF describes EPP as an application-layer client-server protocol for managing objects in a shared central repository.
• A reseller may sit in between. The RAA makes the accredited registrar responsible for services a reseller performs. Your support relationship, though, is with the front company.
• You are the registrant, which the RAA calls the registered name holder. You control the account, and the account controls the name.
• Your DNS host is separate from all of the above. If it is the registrar's default DNS, you depend on one company for two jobs.

EPP status codes

The registrar and registry coordinate through status values defined in the IETF's EPP domain mapping, RFC 5731. The registrar is the "client" and can add or remove values prefixed "client". The registry is the "server" and controls values prefixed "server". A client must not change status values set by the server. A server may override values set by a client.

Two statuses stop a domain from working. For a domain in clientHold or serverHold, the standard says DNS delegation information "MUST NOT be published." ICANN's guide says clientHold tells the registry not to activate the domain in the DNS, so the name will not resolve. It is usually used in legal disputes, for non-payment, or while a name awaits deletion. serverHold has the same effect, but the registry operator sets it.

This is why a suspension takes email down along with the website. Namecheap's help center says serverHold effectively disables the domain's DNS zone. That covers the website and email, along with any related services. Your DNS host can be perfectly healthy. The name that points to it has simply been removed from the zone.

The other statuses are locks, and you want them on. This table covers the codes you are likely to meet.

How registry lock changes the picture

A normal client lock is a flag in your registrar account. Anyone who gets into the account can ask the registrar to remove it. A registry lock is set at the registry, using the server-prefixed statuses.

To change a registry-locked .com name, an authorized person at the registrar must submit a request to Verisign. Verisign then phones that person and requires an individual security phrase before it unlocks the name. Verisign says this out-of-band step helps protect against automation errors and system compromises.

You can check the state yourself. Verisign says that if a WHOIS result shows serverUpdateProhibited, the name cannot be changed without out-of-band authentication between Verisign and your registrar. A result showing only clientUpdateProhibited means the registrar locked the name but the registry did not.

Two caveats apply. First, Verisign sells this service, so read its page as a vendor defining its product rather than as a measured outcome. Second, you cannot buy registry lock directly. In December 2020, Verisign told Domain Name Wire that 104 registrars were contracted to offer it, but did not name them. ICANN's guide notes that some registry operators offer a registry lock service. Coverage therefore depends on your top-level domain.

Why one registrar account is the whole attack surface

Research on DNS hijacking keeps pointing to the same weak link. At the 2022 ACM Internet Measurement Conference, Akiwate and colleagues described attacks that typically start by compromising the holder's registrar account. They noted that such attacks can bypass the protections of TLS and DNSSEC.

A 2026 arXiv study looked at the ten most popular .nl registrars. It found that all of them have relatively effective security measures. They fall short, however, on advanced controls such as properly implemented two-factor authentication. The study adds that a domain takeover can have significant impact, potentially equalling that of a ransomware attack. It is a preprint covering one country's registrars, so treat it as a signal and not a ranking.

Security agencies agree. In March 2025, the UK's National Cyber Security Centre published guidance designed to minimize malicious domain registrations and hijacking. It tells registrars to treat MFA and change notifications as a priority. It also tells them to use EPP status fields to lock registry data.

After a wave of DNS hijackings, the US Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies 10 business days to implement multi-factor authentication. The requirement covered every account that can change their DNS records.

RDAP, and how to read the state of a domain

The IETF describes the Registration Data Access Protocol (RDAP) as a successor to the very old WHOIS protocol. Since 28 January 2025, ICANN says RDAP has been the definitive source for gTLD registration information. It replaces the sunsetted WHOIS services. ICANN points people to its lookup tool at lookup.icann.org.

RDAP has limits. A 2024 study examined 164 million WHOIS and RDAP records for 55 million domains. It found that 7.6% of the domains showed inconsistent data in fields such as creation date and nameservers. Check your domain's status at the registry and at your registrar, and do not trust either source alone.

How do you protect a domain before anything goes wrong?

Treat the domain like production infrastructure. Harden the account that controls it, and lock the name at the registrar and at the registry. Keep the contact data accurate and the renewal paid. Keep your DNS and recovery paths outside the registrar's reach.

None of this is exotic. Most of it is a setting or a shared mailbox, and the rest is a calendar entry. The checklist below puts the steps in order, with the biggest risks first. The sections after it explain the reasoning.

Secure the account first

The registrar account is the lock on everything else. ICANN's advisory committee says registrar accounts can be attacked like any online account. Attackers can guess credentials or capture them from a compromised host. They can also intercept credentials as they are typed or sent.

The UK's NCSC tells registrars to treat multi-factor authentication as a priority. CISA's directive recommends factors that resist phishing.

In practice, that means hardware keys. The Security Alliance's registrar framework was written for crypto projects. It says to use hardware security keys (FIDO2/WebAuthn) for registrar accounts. It also says to treat registrar access like a root production credential. If your registrar offers only SMS or app codes, enable the strongest option it has. Then shortlist a registrar that supports hardware keys for your next move.

Next, count the people who can act. Cloudflare's documentation warns that anyone with super-admin or admin permissions on a zone can also unlock domains and obtain authorization codes to transfer them. The lesson applies everywhere: every account role that can touch the registrar is a way in. Give a contractor DNS-record rights if the work needs them. Do not give them the registrar login.

Make the contacts survive staff turnover

ICANN's advisory committee advises that you identify points of contact by role. That way, the registration is not tied to a named employee. Use a shared mailbox such as domains@, and make sure at least two people read it. Deliver it somewhere that does not depend on the domain being registered. This is the registrar-account version of the bus factor problem in a small team.

The last point matters. A write-up of the October 2026 Namecheap thread notes that the account's contact email lived on the disabled domains. The lock therefore also cut the channel the registrar uses to reach the customer. Use a mailbox on a different domain for the registrar account.

Then keep the data true. The RAA expects corrections within seven days of any change. Namecheap says ICANN requires contact verification within 15 days of registration. The same applies after a change to the registrant's name or email. A staff change is exactly when a verification email goes to a mailbox nobody checks.

Pay ahead and watch the calendar

Turn on auto-renew, and renew well before the date. ICANN's policy gives you two notices, about a month and about a week before expiry. Registrars may delete a name at any time after it expires.

Those notices land in the contact mailbox. If you followed the previous step, they reach real people. An expired corporate card also gets caught while there is still time. Put the expiry date in a shared calendar owned by a team, not by one person.

Lock it twice

There are two layers of locking, and most companies have set up only the first.

Registrar lock. ICANN says that asking your registrar to set clientTransferProhibited and clientDeleteProhibited can help prevent unauthorized transfers or deletions. Setting clientUpdateProhibited can help prevent unauthorized updates. AWS documents that registries for all generic TLDs and many geographic ones support transfer locking. Turn on all of these locks.

This stops a casual attack and an accidental click. It does not stop someone inside your registrar account, because the lock is only a switch in that account.

Registry lock. ICANN's advisory committee encourages registry locks as a complement to registrar locks. They add a second level of security against unauthorized transfer, deletion, or change.

Cisco Talos investigated the Sea Turtle campaign. It recommended that organizations use a registry lock service that requires an out-of-band message before any DNS record change. Where the registrar offers no such service, it recommended multi-factor authentication instead. Verisign adds that locking the name server hosts as well as the domain is critical, because attacks often try to change the name servers.

Is it worth it? For the domain that carries your revenue, yes. Domain Name Wire's Andrew Allemann wrote in 2020 that Registry Lock is critical for important websites. He said the cost is nominal compared with the protection. CSC is a corporate registrar that sells the service. It describes the lock as requiring extra verification steps between registrar and registry, which is a vendor describing its own product.

The tradeoff is friction. A legitimate nameserver change now needs a phone call, so name the people who are authorized to make one.

Registry lock has some limits. It is sold through registrars, and Verisign did not publish which of its 104 contracted registrars offered it in 2020. Ask yours. Coverage also depends on the TLD.

Registry lock does not stop a suspension, either. A hold for failed verification or an abuse finding is a different mechanism. That is why the other controls matter as much as the locks.

Keep DNS, mail and communications outside the chain

Do not let the registrar be the only link you control. Put authoritative DNS at a dedicated DNS host. Give that host its own account and its own MFA.

Keep your status page and customer communications on a domain or service that does not share the registration you are protecting. Put your incident channel there too. Also keep a working email address that is not on the broken domain.

This is our recommendation, not a standards-body rule. It follows from how the chain fails: a hold removes the name from the zone, and everything under it goes too. The logic matches our cloud region data-loss backup plan. Keep the copy you need for recovery somewhere the failure cannot reach.

Then monitor. CISA's directive had agencies audit their public DNS records to verify that they resolve to the intended location. It prioritized NS and MX records. The advisory committee encourages routine checks of registrar locks.

Write a small job that reads the domain's statuses through RDAP. Have it compare your NS and MX records to the expected values. Send its alerts to a channel that is not on the domain.

Treat DNSSEC as a change with a long tail

DNSSEC signs your DNS records so that tampering is detectable. ICANN said in 2019 that attacks making unauthorized changes to domain delegation only work when DNSSEC is not in use. The IMC 2022 paper, however, says registrar-level hijacks can bypass it. We read DNSSEC as raising the cost of an attack without removing the registrar-account risk. It complements locks and does not replace them.

DNSSEC also carries its own risk. Slack's engineering blog records that its 30 September 2021 outage, caused by an attempt to enable DNSSEC, lasted 24 hours for under 1% of its users. The same post notes that the .com zone asks resolvers to cache a DS record for 24 hours by default, and zone owners cannot change that. Geoff Huston described it as a change that could not be undone for that period. Treat each DS record change as a change with a 24-hour tail, and plan the rollback before the rollout.

Ask your registrar the right questions

ICANN's advisory committee published lists of questions that registrants should ask registrars and registries. They cover registration processes and protection mechanisms. Here is a short version for a startup, written by us:

• Does the account support hardware security keys, and can I require them for every user?
• Can I get registry lock on my TLD? What does it cost, and who is authorized to unlock?
• Will I get a notification when a record, contact, or lock changes?
• What happens when a verification email goes unanswered, and what is the exact deadline?
• When something is suspended, is there a named human escalation path, and not only a ticket form?

What should you do in the first hour if your domain is suspended?

In the first hour, do four things. Confirm what happened, find out who set the hold, and reach a human at the registrar. Then move your communication off the dead domain. A suspension is a hold on the name, so the real work is getting to the person who can lift it.

Minutes 0 to 10: confirm and classify

Check that the domain is the problem, not your host. Look up its status at ICANN's RDAP-based lookup at lookup.icann.org, and read the statuses.

A clientHold means the registrar set it. A serverHold means the registry did. That prefix tells you whom to call. Under RFC 5731, a client cannot alter statuses set by the server.

AWS describes the same check. A clientHold in the console or in WHOIS means the domain has been suspended and is unavailable on the internet.

Next, separate a hold from a hijack. Treat it as a takeover if your records changed, if someone else accessed the registrar account, or if the domain moved to another registrar. ICANN's guidance for an unauthorized transfer is to contact the previous registrar immediately and ask it to review the claim. ICANN also notes that its authority does not include investigating illegal activity.

Minutes 10 to 20: find the message

Registrars usually email the registrant contact when they suspend a domain. AWS says it generally does so, unless a court order bars notice.

Search the contact mailbox, including spam. Look for a verification request or a payment failure. If the mailbox is on the suspended domain, use the secondary address you set up.

Minutes 20 to 40: reach a human and send what they need

Use the registrar's support channel and its abuse or risk contact. Quote the status code and the domain name.

Have your documents ready. These include proof that the company exists, the account owner's identity, and recent invoices. Keep your message short and factual, and send it in writing.

Do not request a transfer to another registrar. The RAA's specification puts the name on clientHold and clientTransferProhibited together. A suspended name therefore cannot be moved until the registrar validates the information.

Minutes 40 to 60: communicate and contain

Post the incident on the status page you keep off the domain. Message customers from an address that still works. If you have a fallback, switch over any email, support, and login callbacks that depend on the domain.

If it looks like a takeover, follow the sequence CISA required of agencies. Audit DNS records, change passwords on every account that can change them, and add MFA. The directive gave agencies 10 business days to finish these steps. A company under attack should do them in the first hours.

Capture screenshots of the status, the emails, and the account log before anything changes.

How do you get a suspended domain back?

The route back depends on who set the hold and why. You may need to complete a verification or payment step, or answer the registrar's review. You may need to restore the name from redemption before the 30 days end. A dispute or court order calls for a formal process.

A verification or payment hold

Complete the verification the registrar asked for, or pay the invoice, and the registrar lifts the hold. The RAA says the name stays suspended until the registrar has verified the contact information. The registrar's own queue therefore sets the pace.

An expired domain

Renew it immediately. If the registrar has already deleted it, the Expired Registration Recovery Policy requires every non-sponsored gTLD registry to offer a 30-day Redemption Grace Period. During that period, the registrar that deleted the name can restore it at your request.

ICANN's guide says the name is held in redemptionPeriod for 30 days. Five calendar days after that, it is purged and becomes available for registration.

The IETF's grace-period mapping, RFC 3915, keeps the EPP status at pendingDelete while the grace-period status changes to pendingRestore. ICANN warns that if the registrar does not supply the documentation in time, the domain reverts to redemptionPeriod. Watch the status after your registrar says it has restored the name.

Registrars with a registration website should state their recovery fee up front.

A risk or abuse review

Answer the registrar's questions with evidence. If a registrar fails to investigate and respond to an abuse report, ICANN accepts complaints about that failure. It also accepts complaints about transfer, renewal, and redemption problems.

ICANN says plainly that it does not have the authority or the technical ability to return a lost domain name to you. A complaint puts pressure on the registrar to follow its contract. It does not order a restore.

A country-code domain

ICANN has no contractual authority over complaints about ccTLDs. Go to the registry that runs the TLD. ICANN points complainants to the IANA root database, where you can find the relevant ccTLD manager.

A trademark dispute

If someone files a UDRP complaint against your name, the registrar will cancel or transfer the name on the panel's decision, a court order, or your own instruction, according to ICANN's policy. After a panel orders a transfer or cancellation, the registrar waits ten business days before implementing it. It stops if you file a lawsuit in that window.

This is a busy process. WIPO reports that it managed over 6,200 domain name cases in 2025, its highest number on record. Domain Name Wire counted 6,282.

Enforcement can also lag the decision. A 2026 NDSS study of 90,153 UDRP proceedings found that 2,751 malicious domains stayed in attackers' hands for up to four months after a panel ordered their transfer. Respond within the deadline, and take counsel early.

A hijack

The Transfer Policy lets a registrar deny a transfer while a dispute about a previous transfer is pending under the Transfer Dispute Resolution Policy. A transfer dispute is therefore a real route. Start with the previous registrar, and bring evidence of the unauthorized access.

A court order

Hire a lawyer. A registrar complying with an order will not lift it on request.

How long will it take?

We found no number in the policies above for how fast a hold must be lifted once you comply. The contracts cover other duties. One is reviewing well-founded law enforcement reports within 24 hours. Another is responding promptly to abuse reports. Neither says how quickly a registrar must undo a suspension. Plan for hours to days, and make your documentation easy to act on.

Should you move registrars, and how?

Move when you are not in an incident, and plan the move as a change with a checklist. A suspended domain carries a transfer lock. A hurried move is also where DNS and DNSSEC mistakes happen.

Moving can be the right call. A registrar without a human escalation path is a standing risk. So is one without hardware-key MFA, or without registry lock for your TLD. If the registrar itself is the dependency that worries you, our vendor lock-in exit plan shows how to price a move. The move has its own rules, though.

Check the 60-day windows

Cloudflare's documentation summarizes the ICANN rules that block a transfer. A transfer is blocked if the domain was transferred, registered, or had its registrant WHOIS information modified in the last 60 days. This applies even if the information was redacted.

The Transfer Policy itself lets a registrar deny a transfer within 60 days of creation. It may also deny one within 60 days after the domain was last transferred. A third case is where the registrar imposed a 60-day lock after a change of registrant and the holder did not opt out.

The practical consequence is this: if you plan to change the registrant and also move registrars, do the transfer first. The policy advises the prior registrant to request the inter-registrar transfer before the Change of Registrant. That avoids triggering the 60-day lock.

Unlock and get the transfer code

Unlock the domain at the old registrar, and copy the authorization code. The IETF notes in RFC 9154 that password-based authorization information raises issues of security, complexity, storage, and lifetime. It defines short-lived random values as the safer practice. Treat the code as a credential until the transfer completes.

Know the default

This detail matters for security. Under the Transfer Policy, the registry notifies the losing registrar of a transfer. If that registrar does not respond within five calendar days, the transfer is approved by default.

Locks stop a transfer from being started. Your monitoring should also flag any pending transfer you did not request.

The policy also says a registrar may not deny a transfer for nonpayment of a pending or future registration period. A billing dispute is therefore not a reason the old registrar can hold your name.

Handle DNSSEC first

This is where most self-inflicted outages happen. Cloudflare's documentation says that if you onboard an existing domain, DNSSEC must be disabled at the old registrar before you change name servers. Otherwise the domain will experience connectivity errors.

To roll back, remove the DS record at the registrar. Keep zone signing enabled until the DS TTL has fully expired at the parent zone. Slack's 24-hour DS cache, described earlier, is why you should take this seriously.

Cloudflare also notes that with Cloudflare Registrar, DS records are submitted through CDS/CDNSKEY scanning. That process can take one to two days.

Re-apply the locks

After the move, turn the client locks back on. Ask the new registrar for registry lock as well. A name that has just been transferred can itself be held for 60 days, so you cannot hop straight back.

In short

Pick a registrar that offers hardware-key MFA and registry lock for your TLD. Check the 60-day conditions, and plan any DS change with a rollback. Then transfer the domain. Afterward, verify your name servers, MX records, and certificates. Finally, re-apply the locks and monitoring.

What does domain registrar suspension look like in real incidents?

A Reddit post titled "Namecheap just seized and disabled all my domains" had drawn 695 points and 365 comments on Hacker News by 1 November 2026. It is one of several documented cases where a domain went offline because of an administrative trigger, an account takeover, or a legal order. Each case lines up with a control described earlier. Where a case rests on one person's account, we say so.

October 2026: a Namecheap account lock, as the poster describes it

The r/sysadmin post reached Hacker News on 18 October 2026. The Hacker News API record shows the same counts as the thread page. We could not read the original Reddit post, and a 19 October write-up said the same. What follows is therefore the poster's account as relayed by others, not a verified timeline.

Registrar Watch is an affiliate site that earns commission from competing registrars. It reported that the poster, a twelve-year customer, missed an email demanding ID verification within 72 hours, and that every domain in the account was then disabled, including the ones his company email ran on.

A DEV Community write-up says the quoted email called the action a routine account information accuracy check-up. A 19 October post added that Namecheap had given no public response. We found no statement from Namecheap either. The thread does not establish why the account was reviewed.

Comments describe similar experiences, but they are anecdotes. One commenter wrote that Namecheap fully turned off their business domain because they did not reply to a phishing email within 48 hours. They said it took over 6 hours to turn back on after they responded.

Whatever the facts turn out to be, the account shows the failure mode that matters here. As relayed, the request came by email with a short deadline, the penalty covered the whole account, and the contact address lived on the domains that went down. You control each of these factors.

May 2026: a .in domain suspended for three hours

Developer captnemo reported that his .in domain was suspended for three hours on 4 May 2026. The dashboard gave the reason as invalid whois. He quotes Namecheap's reply, which said WhoisGuard contacts were assigned to transferred-in domains because of a bug. The .in registry did not allow this.

This is a single-source account, but the lesson is useful. A registrar-side bug can break a correct registration. The fix then depends on how fast you can reach support.

July 2024: Squarespace and the unclaimed accounts

Krebs on Security reported that at least a dozen organizations with domains at Squarespace had their websites hijacked in the week before 15 July 2024. Squarespace had bought Google Domains' assets a year earlier. A change of hands is a risk of its own, as our piece on what to do when a vendor is acquired argues.

Experts said attackers could take over any migrated account that nobody had yet registered. They needed only an email address tied to an existing domain. The Register reported the researchers' theory that the flaw let attackers guess admin email addresses and register the account themselves. It advised migrated organizations to enable two-factor authentication, because it was not on by default.

The accounts of the cause differ. BleepingComputer reported that multi-factor authentication was turned off on accounts during the transition. Blockaid's report said 2FA was disabled for all migrated accounts.

Squarespace's own post-mortem, quoted by Krebs, said all compromised accounts were using third-party OAuth. It also said Squarespace fixed a weakness related to OAuth logins within hours. This contradicts the researchers' account, and we cannot resolve the disagreement.

The shared lesson stands. An unclaimed or weakly protected registrar account is a way to change your records. A registry lock would have added an out-of-band step that a login alone cannot supply.

2019: Sea Turtle and a compromised registrar

Cisco Talos reported that at least 40 organizations across 13 countries were compromised in the Sea Turtle campaign. One was Netnod, a Swedish non-profit whose name server was redirected to harvest administrators' credentials. Krebs reported that Netnod's DNS infrastructure was hijacked in December 2018 and January 2019, after attackers gained access to accounts at its domain name registrar.

CISA responded with an emergency directive. Talos recommended registry lock. On DNSSEC, the sources disagree, as noted above. The control they agree on is protecting the account that makes the change.

November 2022: a court-ordered seizure

US authorities seized Z-Library's domains. According to BleepingComputer, the seizure notice cited a warrant under 18 U.S.C. 981(b) and 21 U.S.C. 853(f) from the Eastern District of New York. TorrentFreak counted more than 130 associated domain names caught up in the action. They were spread across registrars including Tucows and GoDaddy.

This case shows the one cause that no registrar setting prevents: a legal order that names the domain.

Where RocketDevs fits

Our standing advice applies whenever a developer joins your team, whether through us or not. Keep the domain, DNS, and registrar accounts in your company's name. The developer should work through delegated roles that you can revoke, never through a shared registrar login. A handover then becomes a role change and not a password reset. The keys belong to the company.

If you are adding engineers, we vet every developer through 6-8 hours of assessment, and we accept only the top 2%. Associate rates start at $9.99/hr. Every engagement comes with a 14-day risk-free trial that is money-back and 100% honoured.

The point is access, not price. One person holding every credential is a risk, whether that person is an employee or a contractor.

You can build a vetted team with RocketDevs. A pre-launch security review is the right place to add the registrar account to scope.

Conclusion

Your domain is a chain of parties, and each link can take you offline. A hold at the registry or the registrar removes the name from DNS. Your website and your email go down with it.

Suspensions are usually procedural. The cause is typically an unverified contact, a missed renewal, an abuse report, or a request nobody answered. Hijacks are usually account takeovers. Controls that cost an afternoon can prevent most of both.

Do these steps in order:

• Put the domain in a company account behind hardware keys.
• Register role-based contacts on a mailbox that is not on the domain.
• Turn on auto-renew, and renew early.
• Set the three client locks. Then ask for registry lock on the domain that carries revenue.
• Keep DNS and incident communications separate.
• Write the first-hour runbook.

If something does go wrong, you will then know whom to call and what to say.

Frequently asked questions

Why was my domain suspended?

A registrar suspends a domain for one of several reasons. These include unverified or inaccurate contact data, a lapsed renewal, an abuse report, a terms-of-service breach, or a court order.

Amazon's registrar documentation lists five causes. They are an unclicked verification link, an expired domain with auto-renew off, and an unverified change of registrant email. The other two are an acceptable-use violation and a court order.

Check the registrar's email first. Then check the domain's status codes at lookup.icann.org.

What does clientHold mean?

clientHold means your registrar has told the registry not to activate your domain in the DNS. The name stops resolving, so your website and email go down together.

ICANN's guide says it is usually used in legal disputes, for non-payment, or when a domain is subject to deletion. The registrar can lift it once you fix the cause it names. A serverHold is the registry's version of the same hold.

What is registry lock, and is it worth it?

Registry lock is set at the registry and not only in your registrar account. Changing the domain then requires an out-of-band check.

Verisign says that to unlock a registry-locked .com name, an authorized registrar contact must give a security phrase by phone. This helps protect against automation errors and system compromises.

For the domain that carries your revenue, it is worth it. It blocks the takeover path that a stolen registrar login opens. It does add friction to legitimate changes, and you buy it through a registrar.

How long does a registrar have to respond?

A registrar must take reasonable and prompt steps to investigate reports of abuse. It must review well-founded reports of illegal activity from law enforcement and similar authorities within 24 hours. It also has five calendar days to answer a transfer notification, after which approval is automatic.

We found no policy that sets a time limit for lifting a suspension once you comply. Build in a margin, and keep escalating.

Can a registrar take my domain?

A registrar can suspend a domain, and it can cancel one for specific reasons. The contract limits when it may do so.

Under the RAA, failing to answer an accuracy inquiry for more than fifteen days is a basis for suspension or cancellation. A domain that is not renewed can be deleted after it expires.

A UDRP panel or a court can also order a name cancelled or transferred. ICANN cannot return a lost domain. Your real protections are prevention and fast, documented contact with the registrar.

James Hitch, COO at RocketDevs.LinkedIn

Sources

Pages without a publication date were read on November 1, 2026.

Standards and ICANN policy documents

• IETF, RFC 5731, Extensible Provisioning Protocol (EPP) Domain Name Mapping, 2009
• ICANN, 2013 Registrar Accreditation Agreement, with specifications
• ICANN, ICANN's DNS Abuse Mitigation Program: Key Updates from 2024, 2024
• ICANN, Expired Registration Recovery Policy
• ICANN, Transfer Policy
• ICANN, Submitting a Complaint to ICANN Contractual Compliance
• ICANN Security and Stability Advisory Committee, SAC 044, A Registrant's Guide to Protecting Domain Name Registration Accounts, November 2010
• IETF, RFC 5730, Extensible Provisioning Protocol (EPP), 2009
• ICANN, EPP Status Codes: What Do They Mean, and Why Should I Know?
• IETF, RFC 7480, HTTP Usage in the Registration Data Access Protocol (RDAP), 2015
• ICANN, ICANN Update: Launching RDAP; Sunsetting WHOIS, January 27, 2025
• ICANN, ICANN Calls for Full DNSSEC Deployment, Promotes Community Collaboration to Protect the Internet, February 22, 2019
• ICANN Security and Stability Advisory Committee, SAC 044 executive summary, November 2010
• ICANN, Lost Domain Names
• IETF, RFC 3915, Domain Registry Grace Period Mapping for the Extensible Provisioning Protocol (EPP), 2004
• IANA, Root Zone Database
• ICANN, Uniform Domain Name Dispute Resolution Policy
• IETF, RFC 9154, Extensible Provisioning Protocol (EPP) Secure Authorization Information for Transfer, December 2021

Government, standards bodies and agencies

• NIST, SP 800-81r3, Secure Domain Name System (DNS) Deployment Guide, March 2026
• UK National Cyber Security Centre, Good security practice for domain registrars: make strong security available
• US Cybersecurity and Infrastructure Security Agency, Emergency Directive 19-01, Mitigate DNS Infrastructure Tampering, January 2019
• WIPO Arbitration and Mediation Center, 2025 Marks Record-Breaking Year for WIPO Domain Name Disputes, 2026

Research

• Akiwate et al., ACM Internet Measurement Conference, Retroactive Identification of Targeted DNS Infrastructure Hijacking, 2022
• van Hove, van der Ham and van Rijswijk-Deij, arXiv, Domijn: The Security of Domain Registrars and the Risk of a Domain Name Takeover (preprint), 2026
• Fernandez et al., Passive and Active Measurement, WHOIS Right? An Analysis of WHOIS and RDAP Consistency, 2024
• Adjibi et al., NDSS Symposium, Repairing Trust in Domain Name Disputes Practices: Insights from a Quarter-Century's Worth of Squabbles, 2026

Incident reporting and analysis

• Domain Name Wire, Over 800,000 domain names suspended due to 2013 RAA, June 24, 2014
• DomainIncite, A million domains taken down by email checks, June 24, 2014
• Domain Name Wire, Tucows: shorter domain verification window could create more problems than it solves, May 27, 2026
• Domain Name Wire, Important online business? Add Registry Lock to your domain, December 8, 2020
• Infosecurity Magazine, NCSC Urges Domain Registrars to Improve Security, March 27, 2025
• Nikoloz Turazashvili, DEV Community, Namecheap account locked after an ID check: why every domain went down, October 19, 2026
• Cisco Talos, DNS Hijacking Abuses Trust In Core Internet Services (Sea Turtle), April 2019
• Slack Engineering, What Happened During Slack's DNSSEC Rollout, 2021
• Geoff Huston, The ISP Column, DNS OARC 36, December 2021
• Domain Name Wire, WIPO handles record number of domain disputes in 2025, January 15, 2026
• Hacker News, Namecheap just seized and disabled all my domains (thread), October 18, 2026
• Hacker News Algolia API, Search record for story 50142866
• Registrar Watch, What Happened With Namecheap in October 2026, October 19, 2026
• Kael Zhang, Namecheap has been accused of shutting down all users' domain names overnight; the official side gave no response, October 19, 2026
• captnemo, A Namecheap bug got my domain suspended, May 5, 2026
• Brian Krebs, Krebs on Security, Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks, July 15, 2024
• The Register, Squarespace fingered for DNS hijackings, July 15, 2024
• BleepingComputer, DNS hijacks target crypto platforms registered with Squarespace, July 2024
• Blockaid, Squarespace Domain Hijacking Incident: Attack Report, July 14, 2024
• Brian Krebs, Krebs on Security, A Deep Dive on the Recent Widespread DNS Hijacking Attacks, February 2019
• BleepingComputer, Z-Library eBook site domains seized by U.S. Dept of Justice, November 4, 2022
• TorrentFreak, Z-Library Aftermath Reveals The Feds Seized Dozens of Domain Names, November 7, 2022

Registrar and vendor documentation

• Verisign, Registry Lock Service, registrar resources
• Amazon Web Services, Amazon Route 53 Developer Guide, My domain is suspended (status is ClientHold)
• Namecheap, Why has my domain been suspended?
• Namecheap, What to do if my domain was suspended due to ICANN's Whois verification process?
• Namecheap, Why was my domain suspended with a serverHold or clientHold status?
• Security Alliance (SEAL), Registrar Security & Registry Locks framework, v0.0.2
• Cloudflare, Cloudflare Docs, Transfer domain out from Cloudflare, last updated April 24, 2026
• Amazon Web Services, Amazon Route 53 Developer Guide, Locking a domain to prevent unauthorized transfer to another registrar
• CSC, Registry Lock and DNS Explained, January 21, 2025
• Cloudflare, Cloudflare Docs, DNSSEC, last updated June 24, 2026