In order to prevent domain hijacking, please make sure that the owner of a domain must prove the ownership of a custom domain e.g. by creating a short.io provided TXT record in the Domain DNS Zone, before the domain can be created in short.io . Many providers do a similar verification, in order to ensure the correct ownership of the domains, e.g. facebook-domain-verification, google-site-verification, adobe-idp-site-verification, atlassian-domain-verification.