How to Recover a Domain Name, Password and Access If Lost, Stolen or Deleted

Losing control of your domain name whether through a forgotten password, a hacked account, an expired registration, or an outright theft can feel catastrophic.

Your domain is often the foundation of your website, email, and brand. The good news is that recovery is possible in many cases if you act quickly and follow the right steps.

This guide covers every major scenario: lost passwords, stolen domains, expired domains, deleted domains, and lost access to associated email accounts.

You’ll learn exactly what to do, what evidence you need, and how to prevent future loss.

 

Lost Password or Login Access to Your Domain Registrar

If you can’t log in to your domain registrar account (e.g., GoDaddy, Namecheap, Google Domains, Cloudflare), you need to regain access before you can manage your domain.

A. You Have Access to the Email on File

1. Use the “Forgot Password” link on the registrar’s login page.

2. Check your spam/junk folder if the reset email doesn’t arrive.

3. Try alternate email addresses if you used more than one.

4. Use backup codes if you had two-factor authentication (2FA) enabled and lost your phone.

B. You Lost Access to the Email on File

This is more serious because the reset link goes to an email you can’t open.

1. Contact the registrar immediately via phone, live chat, or a support ticket from a different email address.

2. Prepare proof of ownership, which may include:

• Government-issued photo ID (passport, driver’s license).

• Domain purchase receipt or invoice.

• Credit card or PayPal transaction records.

• WHOIS historical records showing your name or organization.

• Any previous emails from the registrar about the domain.

3. Answer security questions if you set them up.

4. Request identity verification some registrars may ask for a notarized statement or a copy of a utility bill.

Never use a domain-related email address as the only recovery email for that domain. If the domain expires or is stolen, you lose both the domain and the ability to reset your registrar password.

 

Domain Account Hacked (Unauthorized Access)

If someone has logged into your registrar account, changed the password, email, or domain settings, treat it as an emergency.

Immediate Steps

1. Call the registrar’s abuse or security team right now. Do not rely only on email, phone support is faster for urgent security issues.

2. Report the unauthorized access and ask them to lock the account and freeze all domain transfers.

3. Provide proof of prior ownership (same documents as above).

4. Check all domains in the account for unauthorized changes:

• Contact information changes

• Nameserver changes

• DNS record modifications

• Transfer locks disabled

5. Change passwords on any other accounts that share the same credentials.

6. Enable two-factor authentication once you regain access.

7. Scan your computer for malware/keyloggers.

If the Domain Was Transferred to Another Registrar

If the hacker initiated a transfer to a different registrar, you must act within the transfer window (usually 5 days for most gTLDs).

1. Contact the losing registrar and request a transfer dispute.

2. Contact the gaining registrar and report fraud.

3. File a Transfer Dispute Resolution Policy (TDRP) complaint with ICANN if the registrar does not help.

4. Gather evidence: original registration date, IP addresses used, payment history, and any emails showing the unauthorized transfer.

If the domain was stolen through phishing or hacking, this is a criminal act. You may also file a report with your local police and the Internet Crime Complaint Center (IC3).

 

Domain Expired (Grace Period & Redemption)

Domains do not disappear immediately after expiration. There are several stages, and your recovery options depend on which stage you are in.

How to Recover

1. Log in to your registrar account and renew immediately if the domain is in grace period.

2. Update your payment method if auto-renew failed.

3. If you can’t access the account, contact support with proof of ownership before the redemption period ends.

4. During redemption, the domain will not resolve and email will fail. You must pay the redemption fee to restore it.

5. Do not wait once the domain enters pending delete, there is no way to recover it from the registrar.

Enable auto-renew and keep a backup credit card on file to avoid accidental expiration.

 

Domain Deleted (Permanently Removed)

If your domain has already been deleted (passed through pending delete), it is no longer under your registrar’s control. However, you may still have a chance to get it back.

If Deleted After Expiration

1. Check availability using a WHOIS lookup or a registrar search.

2. If the domain is still in “pending delete”, you cannot register it yet, but you can place a backorder.

3. Use drop-catching services like:

• SnapNames

• DropCatch.com

• NameJet

• GoDaddy Auctions

4. Place backorders with multiple services to increase your chances, but be aware that only one can win the domain.

5. Monitor the drop date domains typically drop 5 days after pending delete begins.

Drop-catching is competitive. If the domain is valuable, expect other buyers to bid on it in auction.

If Deleted by the Registrar (e.g., for abuse or terms violation)

1. Contact the registrar’s compliance or abuse team and appeal the deletion.

2. Provide evidence that the domain did not violate their terms or that the violation was unintentional and has been corrected.

3. If the registrar refuses, you may file a complaint with ICANN if the deletion violated ICANN policy.

4. If the domain was deleted due to a court order or UDRP decision, recovery is only possible through legal appeal.

 

Domain Stolen via Unauthorized Transfer (Hijacking)

Domain hijacking occurs when someone gains control of your domain and transfers it to another registrar or changes the ownership details without your permission. This often happens through:

• Phishing emails that trick you into revealing registrar credentials.

• Weak passwords that are guessed or brute-forced.

• Malware/keyloggers on your computer.

• Social engineering attacks on registrar support staff.

Recovery Steps

1. Contact the losing registrar’s abuse department immediately. Ask them to place a registrar lock and investigate.

2. Contact the gaining registrar and notify them of the fraudulent transfer. Provide proof of prior ownership.

3. Gather all evidence:

• Historical WHOIS records showing your name/email before the theft.

• Purchase receipts, invoices, and payment confirmations.

• Email correspondence about the domain.

• IP addresses and login timestamps from your own records.

4. File a Transfer Dispute Resolution Policy (TDRP) complaint with ICANN if the registrars do not reverse the transfer.

5. Consider legal action domain theft is a crime in many jurisdictions. You can also file a Uniform Domain-Name Dispute-Resolution Policy (UDRP) complaint if the thief is using the domain in bad faith (e.g., cybersquatting).

Time matters: The sooner you report, the higher the chance of reversal. Transfers can sometimes be undone if fraud is proven within days or weeks.

 

Lost Access to Associated Email or DNS Hosting

Your domain name itself might be safe, but you may have lost access to the email account used for registrar login, or to your DNS/hosting control panel.

Recovering Email Account

1. Use the email provider’s account recovery process.

2. Provide backup email/phone if you set them up.

3. Answer security questions.

4. If the email is hosted on your own domain (e.g., example@yourdomain.com) and the domain has expired or DNS is broken, you must first recover the domain. Once domain DNS is restored, your email will work again.

Recovering DNS/Hosting Control Panel

1. Reset the password through the hosting provider’s website.

2. If you lost access to the email on file, contact hosting support with proof of account ownership (invoice, ID, domain ownership).

3. Check your domain’s nameservers if they were changed by a hacker, you may need to reset them in your registrar account.

 

Domain Owner Deceased or Incapacitated

If you need to recover a domain owned by a deceased family member or business partner, the process varies by registrar.

1. Gather legal documents:

• Death certificate.

• Letters of administration or probate.

• Will or trust documents naming you as heir.

• Your government-issued ID.

2. Contact the registrar’s legal or compliance department.

3. Explain the situation and provide the documents.

4. Some registrars may transfer ownership to the legal heir after verification. Others may allow you to renew the domain while you sort out ownership.

5. If the domain is valuable, consult an attorney who specializes in digital assets and estate planning.

 

Prevention: How to Avoid Losing a Domain in the First Place

The best recovery is prevention. Follow these security practices:

1. Use a strong, unique password for your registrar account.

2. Enable two-factor authentication (2FA) preferably using an authenticator app or hardware key, not just SMS.

3. Enable registrar lock (transfer lock) on all domains. This prevents unauthorized transfers.

4. Keep your contact information up to date in WHOIS and your registrar account.

5. Use an email address for registrar login that is not hosted on the domain itself (e.g., use Gmail, not you@yourdomain.com).

6. Enable auto-renewal and keep a valid payment method on file.

7. Monitor expiration dates set calendar reminders 60, 30, and 7 days before expiry.

8. Keep records of all purchase receipts, renewal confirmations, and WHOIS snapshots.

9. Beware of phishing emails that look like registrar renewal notices or domain suspension threats. Always log in directly to the registrar’s website.

10. Use a password manager to store credentials securely and share access with trusted team members.

 

Quick Recovery Checklist

If you realize your domain or access is lost, follow this checklist immediately:

• Identify the exact problem: password loss, email loss, hack, expiration, or transfer.

• Contact the registrar’s support by phone if possible.

• Gather proof of ownership: ID, receipts, WHOIS history, credit card statements.

• Request a freeze/lock on the account and domain if you suspect unauthorized access.

• Check the domain’s WHOIS status to see if it is in grace, redemption, pending delete, or transferred.

• File a dispute with ICANN (TDRP or UDRP) if the registrar cannot help.

• If the domain is deleted, place backorders immediately.

• After recovery, change all passwords and enable 2FA.

• Review all DNS, nameserver, and contact settings for unauthorized changes.

 

Frequently Asked Questions

Can I recover a domain after it has been deleted?
Only if it has not yet been released for public registration. Once it drops, you must try to catch it via a drop-catching service or register the domain normally if still available.

 

How long does the redemption period last?
For most gTLDs (e.g., .com, .net, .org), the redemption period is 30 days after the grace period. Some ccTLDs have different timelines.

 

What if my registrar goes out of business?
ICANN has a process for transferring domains to a new registrar. You should receive instructions from ICANN or the registry operator. Keep your contact information updated to receive these notices.

 

Is domain theft a crime?
Yes, in many jurisdictions, unauthorized access to a computer system or domain theft can be prosecuted under computer fraud and abuse laws. Report it to local police and the FBI’s IC3 if you are in the U.S.

 

Can I recover a domain if I lost the 2FA device?
Yes, most registrars offer backup codes or a manual identity verification process. Contact support with your proof of ownership.