A registry hijack is unauthorized control of registry-managed domain settings or records. In practice, this means an attacker gains access to the systems that define how a domain or top-level domain resolves, such as delegation data, nameserver records, DNSSEC settings, or renewal and contact information. Because the registry is part of the trust foundation for DNS, a compromise there can affect many domains at once, not just one website.
Registry hijacks matter because they can enable redirection, impersonation, service disruption, or takeover of a domain namespace. Attackers may use stolen credentials, abused support processes, or misconfigurations to change records without permission. Defenders reduce the risk with multi-factor authentication, strong approval workflows, registry locks, audit logging, and out-of-band verification of critical changes. Monitoring for unexpected delegation or DNS changes is also important, because the earliest sign of a registry hijack is often a change in records rather than visible malware.