diff --git a/src/domaindb.js b/src/domaindb.js
index 9b7e01277..cc44fe031 100644
--- a/src/domaindb.js
+++ b/src/domaindb.js
@@ -81,6 +81,7 @@ function del(domain, callback) {
     assert.strictEqual(typeof callback, 'function');
 
     database.query('DELETE FROM domains WHERE domain=?', [ domain ], function (error, result) {
+        if (error && error.code === 'ER_ROW_IS_REFERENCED_2') return callback(new DatabaseError(DatabaseError.IN_USE));
         if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
         if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
 
@@ -103,4 +104,4 @@ function addDefaultDomain(callback) {
         if (error && error.reason !== DatabaseError.ALREADY_EXISTS) return callback(error);
         callback();
     });
-}
\ No newline at end of file
+}
diff --git a/src/domains.js b/src/domains.js
index a5cf3e639..11e9f89ad 100644
--- a/src/domains.js
+++ b/src/domains.js
@@ -49,6 +49,7 @@ DomainError.ALREADY_EXISTS = 'Domain already exists';
 DomainError.EXTERNAL_ERROR = 'External error';
 DomainError.BAD_FIELD = 'Bad Field';
 DomainError.STILL_BUSY = 'Still busy';
+DomainError.IN_USE = 'In Use';
 DomainError.INTERNAL_ERROR = 'Internal error';
 DomainError.ACCESS_DENIED = 'Access denied';
 DomainError.INVALID_PROVIDER = 'provider must be route53, gcdns, digitalocean, cloudflare, noop, manual or caas';
@@ -196,10 +197,9 @@ function del(domain, callback) {
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    // TODO check if domain is still used by an app
-
     domaindb.del(domain, function (error) {
         if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainError(DomainError.NOT_FOUND));
+        if (error && error.reason === DatabaseError.IN_USE) return callback(new DomainError(DomainError.IN_USE));
         if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
 
         return callback(null);
@@ -283,4 +283,4 @@ function waitForDNSRecord(fqdn, value, type, options, callback) {
 
         api(provider).waitForDns(fqdn, zoneName, value, type, options, callback);
     });
-}
\ No newline at end of file
+}
diff --git a/src/routes/domains.js b/src/routes/domains.js
index 47638ab5a..2547e535e 100644
--- a/src/routes/domains.js
+++ b/src/routes/domains.js
@@ -77,6 +77,7 @@ function del(req, res, next) {
 
     domains.del(req.params.domain, function (error) {
         if (error && error.reason === DomainError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error && error.reason === DomainError.IN_USE) return next(new HttpError(409, 'Domain is still in use'));
         if (error) return next(new HttpError(500, error));
 
         next(new HttpSuccess(204, {}));
diff --git a/src/test/database-test.js b/src/test/database-test.js
index 4b7e0b63d..3526e576c 100644
--- a/src/test/database-test.js
+++ b/src/test/database-test.js
@@ -185,6 +185,46 @@ describe('database', function () {
             });
         });
 
+        var APP_0 = {
+            id: 'appid-0',
+            appStoreId: 'appStoreId-0',
+            dnsRecordId: null,
+            installationState: appdb.ISTATE_PENDING_INSTALL,
+            installationProgress: null,
+            runState: null,
+            location: 'some-location-0',
+            domain: DOMAIN_0.domain,
+            manifest: { version: '0.1', dockerImage: 'docker/app0', healthCheckPath: '/', httpPort: 80, title: 'app0' },
+            httpPort: null,
+            containerId: null,
+            portBindings: { port: 5678 },
+            health: null,
+            accessRestriction: null,
+            lastBackupId: null,
+            oldConfig: null,
+            newConfig: null,
+            memoryLimit: 4294967296,
+            altDomain: null,
+            xFrameOptions: 'DENY',
+            sso: true,
+            debugMode: null,
+            robotsTxt: null,
+            enableBackup: true
+        };
+
+        it('cannot delete referenced domain', function (done) {
+            appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.portBindings, APP_0, function (error) {
+                expect(error).to.be(null);
+
+                domaindb.del(DOMAIN_0.domain, function (error) {
+                    expect(error).to.be.a(DatabaseError);
+                    expect(error.reason).to.equal(DatabaseError.IN_USE);
+
+                    appdb.del(APP_0.id, done);
+                });
+            });
+        });
+
         it('can delete existing domain', function (done) {
             domaindb.del(DOMAIN_0.domain, function (error) {
                 expect(error).to.be(null);
diff --git a/webadmin/src/views/domains.html b/webadmin/src/views/domains.html
index 9ba753688..6a1bad0cf 100644
--- a/webadmin/src/views/domains.html
+++ b/webadmin/src/views/domains.html
@@ -109,7 +109,7 @@
                   <label class="control-label">Provide your password to confirm this action</label>
                   <div class="control-label" ng-show="(domainRemoveForm.password.$dirty && domainRemoveForm.password.$invalid) || (!domainRemoveForm.password.$dirty && domainRemove.error)">
                       <small ng-show=" domainRemoveForm.password.$dirty && domainRemoveForm.password.$invalid">Password required</small>
-                      <small ng-show="!domainRemoveForm.password.$dirty && domainRemove.error">Wrong password</small>
+                      <small ng-show="!domainRemoveForm.password.$dirty && domainRemove.error">{{ domainRemove.error }}</small>
                   </div>
                   <input type="password" class="form-control" ng-model="domainRemove.password" id="domainRemovePasswordInput" name="password" required autofocus>
               </div>
diff --git a/webadmin/src/views/domains.js b/webadmin/src/views/domains.js
index e8a89d084..181965a74 100644
--- a/webadmin/src/views/domains.js
+++ b/webadmin/src/views/domains.js
@@ -187,7 +187,7 @@ angular.module('Application').controller('DomainsController', ['$scope', '$locat
             $scope.domainRemove.error = null;
 
             Client.removeDomain($scope.domainRemove.domain.domain, $scope.domainRemove.password, function (error) {
-                if (error && error.statusCode === 403) {
+                if (error && (error.statusCode === 403 || error.statusCode === 409)) {
                     $scope.domainRemove.password = '';
                     $scope.domainRemove.error = error.message;
                     $scope.domainRemoveForm.password.$setPristine();