The Complete Guide to Domain Transfer Locks

Domain hijacking rarely looks like a dramatic hack. More often an attacker gains access to a registrar account or an email inbox, requests a transfer, and moves the domain to a registrar they control. Once that happens, they control your website, your email and every service that verifies ownership through DNS. Transfer locks are the main technical barrier against this. This guide explains the different kinds of locks, how they interact with the ICANN transfer rules, and how to move a domain safely when you actually want to.

What a domain transfer lock is

Every domain registered in a modern registry carries status codes defined by the Extensible Provisioning Protocol (EPP). These codes tell the registry which operations are allowed. A transfer lock is simply a status that tells the registry to reject transfer requests to another registrar. You can see a domain's current statuses in a WHOIS or RDAP lookup, where they appear as lines such as clientTransferProhibited, usually with a link to an ICANN explanation.

Statuses come in two families. Those beginning with client are set by the registrar, often at your request through the control panel. Those beginning with server are set by the registry itself and override what the registrar can do.

Why is my domain transfer locked?

A transfer lock is usually there on purpose. The most common reasons, and what to do about each:

How to check if a domain is transfer locked

1. Run a WHOIS / RDAP lookup for your domain.
2. Look at the status lines. clientTransferProhibited means the registrar lock is on; serverTransferProhibited means a registry-level lock.
3. If neither appears and the status is ok or active, the domain is unlocked and can be transferred once you have the EPP code.
4. Check the registration date too: a domain created or transferred less than 60 days ago will be refused even without a lock status.

Registrar lock vs registry lock

The terms are often used interchangeably, but they offer very different levels of protection.

Registrar lock

The registrar lock, sometimes called theft protection or domain lock, sets clientTransferProhibited and at many registrars also clientUpdateProhibited and clientDeleteProhibited. It is free, enabled by default at most registrars and can be turned off with a click in your account. That convenience is also its weakness: anyone who gets into the account can turn it off too.

Registry lock

A registry lock sets the server-side statuses serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited. Once applied, the registrar cannot change nameservers, contacts or registrar on its own. To unlock, the registrar must ask the registry, and the request is confirmed through an out-of-band process, such as a call to pre-authorised contacts or a signed request. Registry lock is offered for many major TLDs through participating registrars, usually as a paid service.

Registry lock also blocks nameserver changes, which matters because an attacker does not need to transfer a domain to hijack it. Changing the DNS inside your own registrar account is enough to redirect traffic and intercept email.

The EPP authorisation code

Besides the lock, a gTLD transfer requires an authorisation code, also called an EPP code, auth code or Transfer Authorization Code. It works like a password for that specific domain. The gaining registrar submits it to the registry together with the transfer request, and the registry checks it against the stored value.

• Treat the code like a password: do not paste it into tickets, chats or shared documents.
• Request it only when you are ready to transfer, and transfer promptly.
• If you suspect it has leaked, ask your registrar to generate a new one.

Some country-code registries use different procedures, for example a registry-issued token or a tag change, so the steps vary by extension.

ICANN transfer rules and the 60-day restrictions

For gTLDs, the ICANN Transfer Policy sets the framework that registrars follow. The points owners most often run into are:

• After registration or transfer: a domain generally cannot be transferred to another registrar within 60 days of its initial registration or a previous inter-registrar transfer.
• After a change of registrant: a material change to the registrant name, organisation or email can trigger a 60-day inter-registrar transfer lock. Many registrars let you opt out of this lock before making the change, but you must do so at that moment.
• Losing registrar response: once a transfer is requested, the losing registrar has a short window, typically five days, to deny it on specific permitted grounds. If it does nothing, the transfer completes automatically.
• Renewal included: a gTLD transfer normally adds one year to the registration, and the remaining time is preserved, within the ten-year maximum.

ICANN has been revising the Transfer Policy, including how these locks and notices work, so check your registrar's current terms before a planned move. Domains in the redemption period, under a legal dispute or with an unpaid balance can also be refused.

What happens if you try to transfer a locked domain?

The transfer simply fails. When the new registrar submits the request, the registry rejects it because of the lock status, and the new registrar marks the order as failed or cancelled. Nothing changes on the domain: it stays at the current registrar, the website and email keep working and the expiry date does not move. Most registrars refund or let you retry a failed transfer, so unlock the domain, get a fresh EPP code and start again.

How to unlock and transfer a domain, step by step

1. Check the expiration date. Do not start a transfer in the last days before expiry; renew first or transfer well in advance.
2. Confirm your contacts. Make sure the registrant email works, because transfer confirmations and notices go there.
3. Record your DNS. Export all records. Some registrars stop serving DNS for domains that leave, so move to external DNS or recreate the zone at the new provider first.
4. Remove the lock. Disable the registrar lock. If a registry lock is active, ask the registrar to start the unlock process.
5. Get the auth code and start the transfer at the gaining registrar.
6. Approve any confirmation emails from either registrar.
7. Verify completion. Look up the domain and confirm the new registrar, nameservers and statuses.
8. Re-lock immediately. Enable the lock at the new registrar and request registry lock again if you use it.

Signs that something is wrong

Hijacking attempts usually leave traces. Treat these as urgent:

• an unexpected email about a transfer request, auth code request or contact change;
• status codes in a WHOIS lookup that no longer show a transfer prohibition;
• nameservers or registrar fields that changed without a ticket;
• a password reset or two-factor change on your registrar account you did not make.

If you see any of these, contact the registrar immediately, re-lock the domain, rotate credentials and ask for the pending transfer to be denied. Speed matters because an unanswered transfer can complete on its own.

Locks are one layer of account security

A lock is only as strong as the account behind it. Protect registrar accounts with two-factor authentication, preferably app or hardware key based, unique passwords and a registrant email hosted outside the domain itself. Keep the number of people with access small and remove former staff and agencies promptly. Also watch the expiry date: a domain that lapses can be lost no matter how it was locked. TLDix tracks expiration dates for the domains in your panel so a lock is never undone by a missed renewal.

Common misconceptions about domain locks

A few assumptions cause trouble again and again, so it is worth stating them plainly.

• "Locked means safe." A registrar lock stops transfers, but not DNS changes made inside a compromised account, and it does not stop the domain from expiring. It is one control among several.
• "Unlocking is risky by itself." Removing the lock for a planned transfer is normal. The risk comes from leaving it off afterwards or sharing the auth code carelessly.
• "Privacy protection is the same as a lock." WHOIS privacy hides contact details; it has no effect on transfer or update statuses.
• "Every extension works the same way." Many ccTLDs have their own transfer procedures, lock options and timelines, and some do not use auth codes at all.
• "Registry lock is only for huge companies." Any organisation whose revenue or email depends on one domain can justify it, especially when the cost is compared with a single day of hijacked traffic.

Domain lock checklist

• clientTransferProhibited is active on every domain you are not currently transferring.
• Registry lock is enabled for the domains that carry your brand, email and payments.
• Registrar accounts use two-factor authentication and a role-based contact email.
• Auth codes are requested only at transfer time and never shared in plain channels.
• You know whether a contact change will trigger a 60-day lock and opt out where appropriate.
• Status codes are checked after every change and periodically afterwards.
• Expiration dates are monitored independently of the registrar.