Your domain now uses different nameservers. They decide where the website, email and everything else on the domain point, so an unexpected change can take it all offline or hand it to someone else.
What it means
Nameservers are the DNS servers in charge of your domain, usually run by your DNS host, registrar or a CDN such as Cloudflare. They change during a planned move, but an unplanned change is what a hijacked domain looks like.
What triggers it
DNS & email security looks up the domain’s nameservers once a day through public DNS. When they differ from the previous lookup, a High issue shows the old and new nameservers, and owners and admins are alerted straight away.
Common causes
- A planned move to a new host, DNS provider or CDN.
- A change made by a colleague, agency or developer without telling the team.
- Someone who got into the registrar account taking over the domain.
How to fix it
- Ask whoever manages the domain and hosting whether they made the change.
- If it was planned, check that the website and email still work, then mark the action done.
- If nobody made it, contact the registrar straight away, change the account password, turn on two-factor authentication and lock the domain.
When it clears
It stays for 7 days after the change, then clears on its own. Another change raises it again.