Update: changes affecting how to escalate a registrar lock to secure a .ca domain

A .ca domain disappears from your account overnight. The registrar's portal shows a new registrant. Transfers out of Canada have already begun. For brand owners and domain holders in the Canadian namespace, the mechanics of escalating a registrar lock — and the evidence trail that supports it — have grown more consequential as CIRA and its accredited registrars refine their compromise-response workflows.

To escalate a registrar lock to secure a .ca domain after suspected theft or unauthorized transfer, the registrant must act immediately: contact the losing registrar to freeze outbound transfers, document the account compromise with timestamped evidence, and determine whether CIRA's CDRP (Canadian Domain Name Dispute Resolution Policy) or a Canadian court action is the appropriate escalation path. CIRA's CDRP governs bad-faith registration disputes; domain theft after account compromise is generally a matter for the registrar's abuse desk, CIRA's registrar compliance process, and — where those channels fail — the Canadian courts.

Below: what has shifted in practice, who is affected, and what to do within the critical first hours.

What Changed?

CIRA's registrar compliance expectations have tightened around unauthorized transfer events. Registrars accredited under CIRA's Registrar Agreement are now expected to respond faster to verified compromise reports and to apply a registrar lock — preventing any outbound transfer — on receipt of credible evidence. In practice, we have seen some registrars extend the window for reversal requests, while others have introduced stricter identity verification requirements before reinstating access, which can paradoxically slow a legitimate owner's ability to reclaim control. The net effect is that the first 24 to 48 hours after discovering unauthorized access have become the decisive window for preservation.

At the same time, CIRA updated procedural guidance for its CDRP. The CDRP addresses abusive registrations — situations where a domain is registered in bad faith by a third party who is not the original owner. It does not, as a matter of procedure, address account-takeover theft where the original registrant's credentials were stolen. That distinction has sharpened. Registrars and CIRA compliance staff are more consistently redirecting theft-based claims toward the courts rather than the CDRP.

Who Is Affected?

Any person or organization holding a .ca domain is potentially affected. The risk is highest for domains with strong secondary-market value — established brands, short dictionary words, and legacy registrations. Registrants who rely on shared hosting accounts, reuse passwords across platforms, or have not enabled multi-factor authentication on their registrar account face materially higher exposure. Corporate brand owners with .ca holdings should treat this update as a portfolio-level review trigger, not a single-domain concern.

Note: the CIRA CDRP requires the complainant to meet CIRA's Canadian Presence Requirements. A foreign brand owner may hold trademark rights but still lack the eligibility to register — or to receive — a .ca domain. Verify eligibility before initiating any recovery proceeding.

What Should You Do Now?

The evidence of compromise is the foundation of every recovery route. Gather it first — before contacting the registrar, before filing anything. That means: login logs showing the unauthorized access event, email headers from any transfer-confirmation messages sent without your authorization, and WHOIS/RDDS records showing the timestamp of the registrant change. Screenshot and preserve everything with timestamps.

Once preservation is done, the path branches. Where the registrar acts promptly on a credible compromise report, a registrar-lock escalation and internal transfer-reversal request can resolve the matter without litigation. Where the registrar is slow, unresponsive, or the domain has already moved to a third-party registrar — particularly one outside Canada — a Canadian court application for an interim injunction blocking further transfer becomes the operative tool. In our practice, we have advised registrants on both paths; the choice turns on where the domain sits and how quickly the registrar responds to documented evidence. A court route, while more costly and slower than a registrar-desk resolution, carries enforcement weight that a registrar complaint alone does not.

For a domain already caught in a CDRP proceeding by an opportunistic third-party claimant — rather than a theft scenario — the analysis shifts to the CDRP's bad-faith test and the registrant's legitimate-use evidence. The two situations call for different strategies. Conflating them wastes time that, in theft cases, is the critical variable.

For an assessment of your .ca domain situation, contact info@cognomenlaw.com.

Related at COGNOMEN

• Court recovery and domain theft response across gTLDs and ccTLDs
• Enforcing a UDRP decision or pursuing a court application where arbitration cannot reach
• Case study: checking ccTLD eligibility before committing to a recovery strategy

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.