Attackers took over three country registries, changed DNS, and obtained 12 valid TLS certificates for Google domains. Important lessons on domain locks and CAA.
Late September 2026 was a reminder that a domain's security does not depend on its owner alone. Attackers breached the registries — the central operators — of three country extensions: Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as). From there they changed the DNS of several domains, including Google's and YouTube's, and obtained 12 browser-trusted TLS certificates.
How the attack worked
Every domain extension has a registry that records "which DNS servers are authoritative" for each domain. Whoever controls the registry can change that record. Once DNS pointed to the attackers' servers, they could prove "ownership" to certificate authorities — because domain validation is done through DNS or the web — and get SSL certificates that look legitimate.
| Date | Event |
|---|---|
| 22–27 Sep 2026 | The .gh, .sl, and .as registries are breached; authoritative DNS for several domains is changed. |
| Same period | 12 trusted TLS certificates are issued for Google/YouTube domains. |
| 6 Oct 2026 | Google discloses the incident and stresses its own systems were not breached. |
Full analysis is available from BleepingComputer and Akamai.
What CAA can (and cannot) prevent
CAA is a DNS record listing which CAs may issue certificates for your domain. Google noted that CAA cannot stop issuance while DNS is hijacked — because the attacker can change the CAA record too — but it limits reuse of the validation afterwards. CAA is still useful, just not a complete defence.
DNSSEC adds cryptographic signatures to DNS answers. As of January 2025, about 93% of top-level domains were signed according to ICANN's tracker, but adoption at the level of individual domains remains low.
How to protect your domain
- Turn on registrar lock so the domain cannot be transferred without your approval.
- Turn on two-step verification at your registrar — that account is the master key to your domain.
- Add a CAA record that only allows the CAs you actually use.
- Enable DNSSEC if your registrar and DNS provider support it.
- Remove DNS records pointing to services you no longer use (prevents subdomain takeover).
- Monitor certificates issued for your domain through Certificate Transparency logs.
FAQ
Could this happen to .id domains? Registry-level risk exists for any extension. What you control is your account security, transfer lock, and your own domain's DNS configuration.
Sources
- Hackers hijack Google domains after breaching ccTLD registries — BleepingComputer — bleepingcomputer.com
- DNS trust breaks: counterfeit Google certificates reveal — Akamai — akamai.com
- ITHI metric M7: DNSSEC deployment — ICANN — ithi.research.icann.org
Written from the sources above as of 31 October 2026. Third-party policies and figures can change — check the original sources for the latest.
All news