How to Detect a Hijacked Domain Used for Spam
A compromised domain can be turned into a delivery platform for phishing, malware, fake invoices, and high-volume promotional spam. Attackers may gain access to a mailbox, web server, DNS account, or email service while leaving the domain owner unaware that messages are being sent in their name.
The warning signs are often visible before a major incident develops. Sudden reputation decline, unfamiliar authentication records, unexplained bounce notifications, and complaints from recipients can reveal that a domain’s identity or infrastructure has been abused.
Early investigation helps distinguish a true account compromise from ordinary spoofing. Spoofed messages use a forged sender identity without controlling the domain, while a hijacked domain may involve stolen credentials, altered DNS, compromised mailboxes, or unauthorized sending applications.
Watch for Unusual Email Activity
A sudden increase in outbound volume is one of the clearest indicators of abuse. Review mail logs for unfamiliar recipients, strange sending times, unexpected geographic locations, and messages that do not match the organization’s normal business activity. Pay particular attention to bursts of mail sent through newly created accounts or unknown applications.
Delivery reports can provide additional clues. Repeated bounce messages, spam complaints, automated replies from unfamiliar recipients, and notices from major mailbox providers may indicate that attackers are using the domain for a spam campaign. Search shared inboxes and abuse contacts for reports mentioning suspicious links or attachments.
Check SPF, DKIM, and DMARC
Inspect the domain’s DNS records for unauthorized changes. SPF should identify approved mail servers, while DKIM allows recipients to verify that messages were signed by an authorized system and were not modified in transit. A new include statement, unfamiliar sending service, or unexpected DKIM selector deserves investigation.
DMARC reports can reveal whether messages pass authentication and align with the visible From address. A domain with frequent DMARC failures may be experiencing spoofing, misconfiguration, or active compromise. Use the platform’s domain checking guide to review authentication results and interpret trust signals before changing records.
Review Reputation and Sending Patterns
A domain reputation check can show whether major providers or security systems have associated the domain with malware, phishing, spam, or poor mailing practices. Reputation data should be considered alongside authentication results, because a clean domain can still be spoofed and a correctly authenticated domain can still be abused by a stolen account.
Look for changes over time rather than relying on one score. A sharp decline after years of stable activity, a new blacklist listing, or a sudden rise in complaint rates suggests an event that requires prompt investigation. The sender score FAQ explains how reputation indicators should be interpreted and why individual signals should not be viewed in isolation.
Compare Evidence Across Key Signals
No single test proves that a domain has been hijacked. Stronger conclusions come from matching technical evidence with sending behavior, user reports, and infrastructure changes. The following comparison helps separate likely compromise from common configuration or spoofing issues.
| Signal | Possible meaning | What to investigate |
|---|---|---|
| SPF failure | Unauthorized server or spoofed message | Review SPF changes and sending IPs |
| DKIM selector unfamiliarity | New provider or unauthorized signing key | Check DNS history and mail services |
| DMARC alignment failure | Spoofing, forwarding, or poor configuration | Review From, envelope sender, and policy |
| Sudden reputation decline | Spam, phishing, malware, or volume spike | Examine logs, complaints, and campaigns |
| Unknown mailbox activity | Stolen credentials or compromised account | Reset access and inspect sign-in records |
| New DNS or MX record | Possible control-plane takeover | Review registrar and DNS audit trails |
Cross-check message headers whenever possible. The Received chain, Return-Path, Authentication-Results, DKIM-Signature, and sending IP can identify where a message originated and whether it passed through an approved service.
Investigate Accounts, DNS, and Applications
Start with the domain registrar, DNS provider, email host, and cloud identity platform. Review recent logins, password resets, multifactor authentication changes, newly issued API tokens, forwarding rules, OAuth grants, and administrator accounts. Attackers often preserve access through a hidden forwarding rule or an old application password.
Inspect DNS history for changes to MX, SPF, DKIM, DMARC, and subdomain records. Also check website files, contact forms, cron jobs, server accounts, and email plugins if the domain uses self-hosted infrastructure. A compromised website can contain a mail-sending script even when employee mailboxes appear secure.
Contain the Abuse and Restore Trust
Revoke suspicious sessions and tokens, reset affected credentials, enforce multifactor authentication, and remove unauthorized forwarding rules. Disable compromised mailboxes or sending applications until they have been examined. Preserve headers, logs, malware samples, and provider notices so the investigation has a reliable timeline.
After containment, correct DNS records and publish a protective DMARC policy appropriate to the organization’s mail flow. Remove malicious content, patch exposed systems, and contact hosting or mailbox providers when necessary. Reputation recovery may take time, so maintain consistent authentication and monitor complaint, bounce, and delivery data.
Prioritize These Response Steps
- Confirm which accounts, servers, or services sent the suspicious messages.
- Remove unauthorized DNS records, mailboxes, forwarding rules, tokens, and applications.
- Reset credentials and require multifactor authentication for privileged access.
- Review authentication reports, message headers, reputation listings, and provider alerts.
- Notify affected customers or partners when phishing or malware may have reached them.
A documented response process makes future incidents easier to detect. Establish a baseline for normal sending volume, approved providers, DNS records, and administrative access, then alert on meaningful deviations rather than waiting for a blacklist notice.
For organizations handling customer data or regulated communications, keep an incident record and review relevant legal notices when planning disclosures, monitoring, or third-party verification activities. Clear ownership between IT, security, marketing, and domain administrators also reduces delays during containment.
Use Trusted Sender Score to examine domain reputation, authentication status, and anti-spoofing signals before suspicious activity becomes a larger delivery or security incident. Regular checks, strong account controls, and continuous monitoring can help protect the domain’s identity and preserve recipient trust.