Free · live registry data · no login

Domain Hijack Risk Scan

Lock, DNSSEC, registrar security and contact exposure in one score.

How it works

Domain hijack risk scan: lock, DNSSEC, privacy and expiry in one score

Domains are stolen through unlocked transfers, hijacked registrar accounts, spoofed DNS and lapsed renewals. This scan pulls the live registry record and DNS for a domain and scores the five signals an attacker looks at: transfer and update locks, DNSSEC signing, whether registrant contacts are exposed, how close the name is to expiry, and whether the nameservers and registrar are consistent. You get a 0 to 100 score, the specific gaps, and the fix for each one.

Results appear here after you click Scan risk.

How this works

1
Pull the registry record
RDAP gives us the EPP status codes, registrar, dates, nameservers and DNSSEC flag straight from the registry.
2
Cross-check DNS
We query DS, NS and CAA records over DNS-over-HTTPS and compare the delegation with what the registry says.
3
Weight the signals
Transfer lock 30, DNSSEC 20, privacy 15, expiry 15, update lock 10, consistency and CAA 10; a pending transfer caps the score.

Frequently asked questions

How do domains get hijacked?: The common routes are a phished or reused registrar password, an unlocked domain transferred with a stolen auth code, a compromised email account used to reset the registrar login, and simply letting the domain expire. Locks, 2FA, privacy and auto-renew close each of these.
Is DNSSEC really necessary?: It is not a lock, but it stops attackers from forging DNS answers to send your visitors or email elsewhere. It is free on MailShrine, Cloudflare and most modern DNS providers; the main risk is breaking DNS if you change providers without updating the DS record.
What is a good hijack risk score?: 90 or above means every public control is in place. 70 to 89 is typical for a domain with transfer lock and privacy but no DNSSEC or CAA. Below 40 usually means the transfer lock is off, which should be fixed the same day.
What is Registry Lock and do I need it?: Registry Lock sets server-side locks that the registry only lifts after manual verification, so even a fully compromised registrar account cannot move or alter the domain. It costs extra and is worth it for a domain your business cannot operate without.
Can you check my registrar account security?: No tool can see inside your account. After running this scan, log in and confirm two-factor authentication is on, the recovery email is one you control, and no unknown users or API keys have access.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.