They would have to expend hashing power solving a previously solved block puzzle while continuing to build the blockchain off their new branch and ensure that its total difficulty is greater than any competing chain.

So suppose you immediately buy up TLD "foo", get a single confirmation on it, and publish it to your fanbase. The 51% attacker would be able to a) use their hashing power to publish their different solution to the block where your TLD got included, b) include their own purchase of "foo" in their alternate block, and c) continue building on their alternate chain to make it the canonical state of the transaction db. So your fanbase would look for "foo" and get the attacker's zone.

However, if we're five years into Handshake's existence and you hold one of the very first TLDs published in their blockchain, the attacker cannot immediately take over your TLD. They'd have to go back to the block where you made your purchase (or I guess when you renewed) and solve puzzles all the way up until the total difficulty of their chain exceeds the current canonical chain. Which they can do with 51% given enough time.

Also note that an attacker can begin/develop a 51% attack without publishing anything at all to the network.