Google says attackers hijacked domains under several country-code top-level domains and then obtained unauthorized TLS certificates for some services, including Google domains. The incident highlights the link between registry control, DNS, and trust in certificate authorities.
Registry control and DNS at the center
The affected suffixes include .gh, .sl, and .as. Google says control of domain names allowed DNS records to be changed and certificates to be obtained for some names. This does not mean Google’s internal systems were compromised: the issue concerns name resolution and certificate issuance.
Certificates revoked and blocked in Chrome
Google says identified certificates were revoked and Chrome distributed CRLSets to block certificates associated with the incident. This reduces risk for Chrome users, but revocation checks and timing also depend on browsers and certificate authorities.
Why a padlock is not enough
A valid TLS certificate encrypts a connection and binds a name to a key under the issuing authority’s validation process. It does not prove a site operator is legitimate if domain control was hijacked. Unplanned DNS changes and unexpected certificates should be treated as incident signals.
Actions for organizations
Monitor DNS and registrar changes, enable multifactor authentication on relevant accounts, and lock domain transfers. Inventory certificates through transparency logs and revoke compromised certificates with the issuer. After DNS control is restored, publish a restrictive CAA policy that limits authorized certificate authorities and, where possible, binds issuance to authorized ACME accounts. These rules cannot prevent issuance during an active DNS hijack; they strengthen protection once control has been restored. Review registrar alert channels and limit who can change critical zones.
How Soclyde fits
Registrar and DNS accounts are sensitive access points. Soclyde can help store their credentials in an encrypted vault and share them with authorized people; it does not monitor DNS changes. See our team password sharing guide or contact us.
What to remember
Enable registrar MFA and alerts, lock transfers, and monitor DNS changes and certificates issued for your domains. For team access practices, see our password-sharing guide.