If you own a .GH, .SL or .AS domain, review its DNS settings and recent HTTPS certificate records—even if the website appears to work normally. Include domains used for parking, redirects and brand protection, rather than checking only your main website.
On October 6, 2026, Google disclosed domain hijacking incidents involving these three country-code namespaces. Attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates. This does not mean every domain under these extensions was compromised. Google's incident report explains the findings and response.
For domains managed through NiceNIC, start by signing in to your account to identify the names you need to review. Then check with the providers responsible for their DNS, hosting and certificates.
Which Domains Should You Check?
Start with any .GH, .SL or .AS domains you own, including names used for:
- Websites, customer portals and APIs.
- Business email.
- Redirects to another website.
- Domain parking or sale landing pages.
- Brand protection, with no active website.
For each domain, note its purpose, registrar, DNS provider and hosting or parking provider. These may be different companies.
A domain without an active website still belongs in your review. Its intended configuration gives you a baseline for deciding whether a DNS record or certificate is expected.
How Do You Check Your Domain's DNS Settings?
First, compare the domain’s nameservers with the ones supplied by your intended DNS provider. Then open that provider’s DNS dashboard and review:
- A and AAAA records: the destinations used by your website.
- CNAME records: connections to services such as hosting platforms or CDNs.
- MX records: the servers receiving your email.
- CAA records: any restrictions on certificate issuance.
Compare these with your hosting, email and other service providers’ documented settings. If you do not have a previous configuration saved, ask those providers to confirm the expected values.
An unfamiliar value is a reason to investigate, not proof of an attack. Providers can legitimately change infrastructure.
Also distinguish between the settings displayed in a dashboard and the DNS answers being served publicly. If they disagree, ask your DNS provider or technical administrator to investigate.
Correct settings today cannot establish that DNS was unchanged throughout an earlier period. Where available, review change logs and provider notifications as well.
How Can You Check Certificates Issued for Your Domain?
Certificate Transparency, or CT, makes certificate records publicly searchable. It can help you identify certificates that need investigation, but it does not prevent their issuance. Learn how Certificate Transparency works.
For an initial manual review:
- Open crt.sh.
-
Search for your domain, then use a wildcard search such as
%.yourdomain.tldto review subdomain results. - Examine recent entries and open any that you cannot explain.
- Save the result link, covered domain names, issuer and relevant dates.
A public search is a starting point, rather than a complete monitoring service. For ongoing coverage, choose a CT monitoring service and assign someone to review its alerts.
Does an Unfamiliar Certificate Mean Your Domain Was Hacked?
No. An unfamiliar certificate is an investigation lead.
Your hosting company, CDN, parking service or website platform may obtain certificates automatically. Renewals, provider migrations and wildcard certificates can also produce records you did not request manually.
Ask the relevant provider to confirm whether it recognizes the specific certificate. Supply the record link or serial number rather than relying only on the certificate authority’s name.
A CT entry alone does not prove that the certificate was deployed, that visitors reached an attacker’s website, or that information was stolen. Equally, no unexpected search results should be treated as a complete security clearance.
Can CAA Records Prevent This Type of Attack?
CAA—Certification Authority Authorization—lets domain owners specify which certificate authorities may issue certificates for their names.
However, CAA is not a complete defense against DNS hijacking. Google explains that it cannot prevent issuance during an active DNS hijack, while restrictive policies remain valuable after DNS control is restored. Google also recommends considering account and validation-method restrictions. Read Google's recommendations.
Before changing CAA:
- Identify every service that obtains certificates for your domain.
- Confirm which certificate authorities those services require.
- Check wildcard and subdomain requirements.
- Confirm support before adding ACME account or validation-method restrictions.
These details matter because a policy that excludes a legitimate provider can prevent certificate issuance or renewal. Follow your provider's instructions rather than copying a generic record. Let's Encrypt's CAA documentation explains the available controls.
CAA records must be configured with the authoritative DNS provider. Registering a domain with a company does not necessarily mean that company hosts its DNS.
What Should You Do If Something Looks Wrong?
Preserve the evidence and contact the provider responsible for the affected service promptly. Prepare:
- The domain and affected hostname.
- The date, time and time zone of the observation.
- Unexpected DNS values and the expected configuration, if known.
- Certificate record links, serial numbers or fingerprints.
- Screenshots and relevant change notifications.
- Any visible symptoms, such as redirects or email delivery problems.
Contact your registrar about unexpected registration or nameserver changes, your DNS provider about DNS records, and your hosting or CDN provider about website routing and managed certificates. Suspected unauthorized certificates should also be reported to the issuing certificate authority for investigation and possible revocation.
For domains registered with NiceNIC, submit a support ticket with the relevant evidence so the registration-related details can be reviewed. Do not include passwords, private keys or API secrets.
Does Using Chrome Mean No Further Checks Are Needed?
Google blocked identified unauthorized certificates in Chrome and worked with issuing authorities on revocation. Its report nevertheless cautions that the investigation may not have identified every affected domain and that Chrome interventions do not reliably protect users of other clients. Domain owners should therefore complete their own review. See the official response.
Keep a record of what you checked, what your providers confirmed and any changes made. That creates a useful baseline for future DNS changes and certificate alerts.
