GoDaddy handed over a domain to a stranger without any documentation

A domain used for 27 years was moved from its GoDaddy account to another account with no prior warning, taking the associated website and email offline for 4 days.

The account had two-factor authentication and domain protection enabled, but the audit log showed that Transfer to Another GoDaddy Account had been executed by an Internal User, and no verification had taken place.

Immediately after the transfer, GoDaddy reset the DNS zone to default, and while the nameservers remained unchanged, the zone file was left empty, taking the entire service offline. The affected organization shared this domain across 20 branches nationwide in the US, so the disruption spread widely.

During the support process, the case number and contact channel changed multiple times, and despite 32 phone calls and 17 emails, there was no callback. Even after filing a dispute, GoDaddy kept promising a reply within 48-72 hours, but ultimately closed the case without ever explaining what documentation had been submitted.

Actual recovery didn't come from GoDaddy's support team, but from the party that had mistakenly received the domain — after noticing the wrong domain in their own account, they cooperated directly. Once the account-to-account transfer was performed again, the domain returned to the original account in under 5 minutes, and DNS began to recover as well.

This incident showed that if domain transfers can be approved without documentation, it can lead to risks such as:

• Email interception
• Password reset abuse
• Receiving MFA codes
• Phishing and malware distribution
• Payment route changes

The author also noted that their security report email to GoDaddy had bounced, pointing out that the official channel itself wasn't working properly. As a result, the organization judged it difficult to prevent a similar incident from happening again, and is now keeping open the possibility of moving the domain away from GoDaddy.