DNS & domain

What is Registrar lock? Transfer, delete and update locks explained

Registrar locks are status flags on a domain that prevent an unwanted transfer, deletion or nameserver change – an important protection against domain hijacking.

How Registrar lock works

The locks are EPP status codes: clientTransferProhibited blocks moves to another registrar, clientDeleteProhibited blocks deletion and clientUpdateProhibited blocks changes such as new nameservers. They are set at the registrar, often with a switch in the customer area.

A registry lock (serverTransferProhibited etc.) is even stronger: it is set at the registry and can only be lifted through a separate procedure. It is worth it for especially important domains.

For an intended transfer, the transfer lock is lifted briefly and the auth code is needed. Afterwards it should be active again.

Example

Domain Status: clientTransferProhibited
Domain Status: clientDeleteProhibited
Domain Status: clientUpdateProhibited

This is how the three locks appear in RDAP or WHOIS data.

Common mistakes

The transfer lock is not re-enabled after a transfer.
A weak password or no two-factor login at the registrar – the lock can then simply be switched off.
Only the transfer lock is set, but no update lock against nameserver changes.

How the Domain Trust Check rates Registrar lock

Criterion “Domain registration” (weight 3 of 5): Registration data via RDAP (successor of WHOIS): expiry date plus transfer, delete and update locks against domain hijacking.

Standard: RFC 5731 (EPP domain mapping)