Hacked Email Account? First Steps for Custom-Domain Mail
A compromised email account can expose private messages, hide security alerts, send scams or help an attacker reset passwords elsewhere. The right recovery steps depend on who hosts the mailbox. This guide focuses on email addresses at your own domain, such as name@yourcompany.com, when the mailbox is managed by a web host or mail administrator.
Confirm who hosts the mailbox
Your website, DNS and email may be managed by different companies. Check the domain’s mail settings or ask your administrator or hosting provider which system stores and delivers the mailbox. Outlook, Apple Mail and a phone are usually apps that connect to a mailbox; the app itself may not be the email provider.
If the mailbox is hosted by Google Workspace, Microsoft 365 or another large mail provider, use that provider’s official recovery process and contact its administrator if it is a work account. The control-panel steps in this article apply only when the mailbox is hosted by your web host or mail server.
Secure the mailbox and the account that manages it
If you can still sign in, change the mailbox password to a unique one from a device you trust. Update that password in legitimate mail apps and devices, and remove clients or devices you do not recognise. If the hosting or control-panel account may also be compromised, secure that account separately and ask the provider to check its access.
If you are locked out, contact the person or provider that administers the mailbox. A mailbox owner may not have the access needed to reset credentials, revoke active connections or review mail logs. Avoid sending your password or one-time security codes to someone who contacts you unexpectedly.
Check for mailbox changes
Review forwarding addresses, aliases, inbox filters, automatic replies and connected apps. Look for rules that send a copy to an unfamiliar address, move security alerts, mark messages as read or delete particular messages. Check Sent, Drafts, Trash and Archive for activity you do not recognise.
Record unfamiliar settings before removing them if the account may need investigation. If the issue affects several addresses, ask the administrator to inspect domain-level routing and other mailboxes too.
Ask the provider to check server activity
If suspicious sending continues, incoming mail disappears, or an unknown rule returns, ask the mail provider or server administrator to review recent authentication, active connections, server-side forwarding and the outgoing mail queue. Share the affected address, approximate times, example message headers and what you have already changed.
Do not change server-wide settings or run server commands unless you administer the system and understand the effect. Your provider may need to contain the account, investigate a website or application that sends mail, or check whether other accounts were affected.
Choose the guide for your mail system
Control-panel menus differ. Use instructions for the panel that actually hosts your mailbox, and follow your provider’s version-specific guidance. The cPanel, Plesk and HestiaCP recovery guides on this site cover their respective mailbox settings.
Once the provider confirms that access is under control, test sending and receiving, check that only intended forwarding remains, and warn contacts through a trusted channel if suspicious messages were sent from the account.
Official guidance
Federal Trade Commission — https://consumer.ftc.gov/articles/how-recover-hacked-email-or-social-media-account
Australian Cyber Security Centre: recover from email and online account compromise — https://www.cyber.gov.au/guidance/recover-from-email-and-online-account-compromise