Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend:
Second, we add some NS records in DigitalOcean's interface:
My question: assuming an attacker knows I've set my nameservers to DigitalOcean, what's to stop them from adding my domain to their DigitalOcean account, thus directing users to their servers instead of mine? That is, how does DigitalOcean know that I own my domain, and not someone else?
Note: I've seen this question, but I don't think the accepted answer full addresses how an attacker who know's I've set my nameservers to DO would be thwarted.