How to Check Whether Your Domain Has Been Compromised
A compromised domain can damage customer trust, expose employees to phishing, and cause legitimate messages to land in spam. Attackers may misuse your domain through stolen credentials, altered DNS records, forged email headers, or a hijacked mailbox.
Checking domain security involves more than looking for unusual website content. You should review authentication records, sender reputation, account activity, DNS changes, and signs that criminals are impersonating your organization.
The process below helps domain owners, administrators, and security teams identify suspicious activity and decide when containment or professional investigation is necessary.
Recognize The Warning Signs
Unexpected password reset emails, unfamiliar forwarding rules, and messages sent from accounts that users do not recognize are common indicators of compromise. A sudden increase in bounce messages or complaints can also mean that attackers are sending mail through an abused account or server.
Watch for changes in your website, certificate warnings, unexplained DNS updates, and new subdomains. Search engines may display security warnings, while customers may report receiving invoices, login requests, or payment instructions that your organization never issued.
A domain can also appear compromised when the domain itself is intact but a related mailbox, cloud service, or third-party email platform has been breached. This is why investigation should cover both infrastructure and user accounts.
Review DNS And Email Authentication
Start with the DNS zone for unauthorized modifications. Pay particular attention to MX, TXT, SPF, DKIM, and DMARC records, as well as nameservers and mail-routing entries. An attacker who changes these records may redirect email, weaken authentication, or authorize an unfamiliar sending service.
SPF should identify approved mail systems, while DKIM confirms that messages carry a valid cryptographic signature. DMARC connects these controls with a policy for handling messages that fail authentication. A missing, overly permissive, or recently altered record deserves careful review.
Use a trusted domain checker to inspect current records and sender reputation. Compare the results with known-good configurations and with historical DNS records held by your registrar, DNS provider, or monitoring system.
Check Reputation And Spoofing Activity
A poor sender score does not automatically prove that your domain was breached. It may result from an incorrectly configured mail service, a shared hosting provider, a compromised sender, or attackers spoofing your visible From address. Still, a sudden reputation decline should be investigated promptly.
Review DMARC aggregate reports for unauthorized sending sources and examine forensic reports where available. Look for IP addresses, mail streams, and providers that your organization does not recognize. Consistent unauthorized activity can reveal a compromised account, abused infrastructure, or a gap in SPF and DKIM coverage.
For organizations with many domains or subsidiaries, bulk domain trust checks can reveal inconsistent authentication and reputation problems faster than checking every property manually.
Compare Evidence From Multiple Sources
No single scan can establish that a domain has been compromised. Combine DNS results, mail logs, identity-provider alerts, endpoint detections, and reports from customers or partners. Preserve timestamps, message headers, suspicious IP addresses, and copies of altered records before making major changes.
The following checks provide a practical way to separate likely causes:
| Finding | Possible meaning | Immediate focus |
|---|---|---|
| Unknown SPF include | Unauthorized sender or forgotten vendor | Verify the service and remove unapproved entries |
| New DKIM selector | Added mail platform or attacker-controlled key | Check who created it and when |
| DMARC failures from one account | Spoofing or compromised mailbox | Review login and sending activity |
| Unexpected MX record | Mail redirection or DNS takeover | Contact the DNS provider and inspect registrar access |
| Reputation decline without account alerts | Spoofing, shared infrastructure, or configuration error | Analyze headers, reports, and outbound logs |
Correlate events rather than treating each alert in isolation. For example, a new DKIM selector followed by suspicious outbound messages is more significant than either finding alone.
Contain A Confirmed Breach
If evidence points to an account takeover, disable active sessions, reset passwords, revoke application tokens, and require multifactor authentication. Inspect mailbox forwarding rules, delegates, OAuth applications, and newly created users. Attackers often establish persistence through settings that remain after a password reset.
If DNS or registrar access was abused, secure the registrar account, rotate credentials, enable registry lock where appropriate, and ask the provider to investigate unauthorized changes. Restore verified DNS records carefully, because rushed edits can interrupt legitimate mail or web services.
For suspicious messages, preserve full headers and coordinate with your email provider, incident-response team, and affected recipients. Avoid deleting evidence until logs and forensic data have been collected.
Prevent Future Domain Abuse
Prevention depends on layered controls and continuous monitoring. Maintain an inventory of domains, subdomains, mail platforms, DNS administrators, and third-party senders. Remove obsolete services and unused accounts, since forgotten assets are common entry points.
Set DMARC to monitoring mode while identifying legitimate senders, then move toward a stronger enforcement policy once the results are understood. Use separate DKIM selectors for different services, rotate keys according to policy, and keep registrar and DNS permissions limited.
Domain owners can use the Domain Admin resource to support ongoing checks and identify authentication issues before they affect delivery or trust.
Recommended Actions For Domain Owners
- Review registrar, DNS, email, and identity-provider logs for unauthorized changes.
- Confirm that SPF, DKIM, and DMARC records match current sending services.
- Investigate unknown senders shown in DMARC reports and message headers.
- Reset compromised credentials, revoke sessions, and remove suspicious forwarding rules.
- Monitor sender reputation and domain status regularly, especially after DNS changes.
A compromised domain can often be contained quickly when evidence is collected systematically. Run a current trust and authentication check, document every unfamiliar finding, and escalate confirmed intrusion activity to your security provider or incident-response team.