How do I stop my domain from being hijacked?

Domain hijacking is when someone gains control of your domain and redirects your website and email to servers they own - and it almost always comes through your registrar account, not a clever technical attack. A handful of controls close the usual doors:

• Secure the registrar account - turn on two-factor authentication and use a strong, unique password; this is the account that controls everything.
• Turn on a registrar lock - a transfer lock stops the domain being moved to another registrar without your say-so.
• Keep contact details current - renewal and transfer warnings go to the registered email, so a stale address means you miss the alarm.
• Consider DNSSEC - it signs your DNS answers so they cannot be quietly forged; only 2% of Australian small business domains enable it^*.

The lock that matters most is two-factor authentication on the registrar account - that is the door nearly every hijack walks through.