Academy › Publishing › Domain and email
The first two hours after it's already happened
You'll walk away knowing who to call in what order, what to ask each one for, and what to write when someone has already gotten into your domain or your email.
By Yodai · Published on September 6, 2026 · Updated on October 12, 2026
You can have a password that's never reused, a recovery email outside your domain, an app instead of SMS, transfer lock turned on, and a trained eye for phishing emails. Even with all that, it can still happen. It's ten at night and your domain's email stops accepting your usual password. Or you get a notice from your registrar saying the domain is about to change owners. Or a customer emails asking about an invoice you never sent. In that moment, you don't need to know who got in or how. You need to know which call to make first.
The next two hours decide whether you lose the domain for good or just lose an afternoon fixing it. It's not an official deadline, it's a way to measure urgency: as long as you don't act, a transfer can keep moving forward and a hidden forwarding rule keeps copying everything that lands in your inbox. The longer you wait to react, the less room you have to choose how to fix it, and the more you're stuck accepting whatever's already happened.
The first minute: check what you still have
Don't start by changing passwords blindly. Start by checking two things: whether you can still log into your registrar's panel with your password, and whether you can still log into your email panel. The answer decides everything that comes next.
If you can get into either one, that access is your anchor. Don't close that session while you work, and don't waste it sending one extra email: use it to act directly in the panel, which is faster than waiting on a support reply.
If you can't get into either one, don't waste ten minutes trying old passwords just in case. Go straight to contacting emergency support, which is the step at minute thirty.
Look at the difference between two sample businesses. One spots the problem at ten at night, and by ten thirty has already deleted the forwarding rule and locked the domain transfer. The other spots it at the same time, but spends forty minutes trying to guess the new password before telling anyone. The first one loses a night of sleep. The second one, in the worst case, loses the domain.
- Minute 0Check whether you can still log into your registrar panel and your email panel with your password. If you can get into either one, that's your anchor: don't close the session.
- Minute 5If you can get into email, change the password and check the automatic forwarding rules. If there's a rule copying incoming mail to an address you don't recognize, delete it before anything else.
- Minute 15If you can get into the registrar, turn on or confirm the transfer lock and check the nameservers. If they've changed, switch them back to yours.
- Minute 30If you can't get into either one, contact registrar support and email support through their emergency channel, with your ID and the domain's purchase date on hand.
- Minute 60Tell your bank or payment processor to review transactions if your domain email is listed on the account, and if that email is used to verify or recover any other business account, like WhatsApp Business, change it in the settings to one you control.
- Minute 120If the email was compromised, send a short notice to your recent customers: tell them to ignore any payment message from you in the last few hours other than this one.
Who to notify, and in what order
The registrar is the one who can stop the domain from changing owners. Your email provider is the one who can shut the door that the intruder is still using to read your messages. They're two different companies, with two different support teams, and you need to contact both, even if the problem started with only one of them.
If you use your domain email to get payment alerts or for your WhatsApp Business number, add two more steps: tell the bank or payment processor to review the last few hours of transactions, and if your WhatsApp Business account uses that email to verify or recover itself, change it in the settings to one you control.
If your email ended up in someone else's hands, even for just a few hours, also notify any customers you exchanged emails or invoices with during that time. You don't need a long explanation. One line telling them to ignore any payment message that doesn't come from this notice is enough.
The message you send to registrar support doesn't need to be long, and you don't need to apologize for writing in the middle of the night. It needs three things: what you're asking for, when you first noticed the problem, and what proof you have.
The mistake that drags the problem out for weeks
When you finally get back into your email, the temptation is to put the scare behind you right then and there: new password, done. It's not that simple.
While you're doing all this, keep a record. A screenshot of the strange alert, the exact time you got locked out, the name of the forwarding rule you deleted. This isn't extra paperwork: it's what the registrar's support team will ask for before they believe you, and it's what you'll need if your bank asks about a charge you don't recognize.
If you had transfer lock turned on, don't assume it's still there: whoever gets into your registrar account can turn it off just as easily as you can, so it only slows the transfer down as long as nobody touches it. As soon as you regain access, check that it's still on. The one setting that can't be turned off from the account is registry lock, which requires manual verification with the registrar. Also check that the recovery email where reset notices land isn't another account inside the same compromised domain: if it is, whoever got in controls it just as much as you do.
- You know what to check in the first minute: whether you can still log in to the registrar, and whether you can still log in to your email.
- You have the order for alerts: registrar, email, bank or payment processor, customers.
- You have the exact wording you'll send to emergency support.
- You know to check the forwarding rules before considering the problem closed.
Test yourself
Answer before opening each one. If one gives you trouble, go back to the section that explains it.
1. You can get into your email dashboard with no problem, but the registrar no longer accepts your password. What do you do first?
You use your email access as your anchor: change the password, check for and delete any hidden forwarding rules, and from there email the registrar's emergency support with your ID and purchase invoice, instead of wasting time trying old registrar passwords.
2. You've been locked out of both dashboards for two hours, but you turned on the transfer lock three months ago. Does it still help?
Less than you'd think: if whoever got in controls your registrar account, they can remove the lock from there. What buys you time is that a transfer isn't instant: your registrar has to notify the owner, and it takes a few days before it's approved automatically. That's why you contact emergency support right away to stop it. If you had registry lock on, that one holds, because it can't be removed from the account.
3. You've gotten your email back and changed the password. Can you consider the issue resolved?
Not until you check the forwarding rules and auto-replies. If whoever got in left a rule that copies incoming mail to another address, they're still reading everything you get, including future password resets for other accounts, even though they no longer have your old password.
In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.
NextThe new addition: under your website, or next to it?