I am probably completely wrong but what seems as the standard way to point a domain to a site is very insecure.
Say your domain is regestered with Company A and your site is hosted through Company B.
The steps to set it all up are usually:
- Login to Company A and set the DNS record for my-domain.com to point to ns1.company-b.com and ns2.company-b.com
- Login to Company B and add my-domain.com to your account and set up an A record.
But how does Company B know that you are authorized to set up an A record? Just because the domain is using their DNS server? Isn't it possible that someone else who is a customer of Company B is really the owner of the domain and they are the ones that pointed it to Company B's DNS servers -- And since you are also a customer of Company B you can just hijack the domain?
This may not be possible, if so, what is preventing something like this from happening?