Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend:

Namecheap backend

Second, we add some NS records in DigitalOcean's interface:

DigitalOcean backend

My question: assuming an attacker knows I've set my nameservers to DigitalOcean, what's to stop them from adding my domain to their DigitalOcean account, thus directing users to their servers instead of mine? That is, how does DigitalOcean know that I own my domain, and not someone else?

Note: I've seen this question, but I don't think the accepted answer full addresses how an attacker who know's I've set my nameservers to DO would be thwarted.

  • I'm not sure this is a security question. This looks more like a hosting question.
    – schroeder
    Jan 20, 2016 at 22:50
  • Isn't it a matter of security if someone could direct unsuspecting victims to the wrong servers? Jan 20, 2016 at 22:52
  • That's a security impact of a configuration, yes, but the configuration itself is another matter.
    – schroeder
    Jan 20, 2016 at 22:53
  • Either way, I'm interested in how this configuration is actually secure. Jan 20, 2016 at 22:55
  • 1
    I feel that this is absolutely security related, as an attacker could manage to hijack a site (by DNS-poisoning the authoritative DNS server for the domain) the way that the OP describes.
    – mti2935
    Jan 21, 2016 at 1:31

2 Answers 2


This question, and this exact scenario, actually came up on Serverfault a few months ago. See https://serverfault.com/questions/744147/can-someone-using-the-same-dns-server-as-me-hijack-my-domains


While I am not sure exactly how DigitalOcean handles it, as their code is proprietary, if I were to design a similar system I would only allow the domain to be in the system exactly one time. If someone did try to register it again I would not allow it. However, if the domain is really theirs, they could contact support and prove it. After proving it to support, the old records would be removed and replaced with the appropriate one.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .