A domain lock is a status flag that stops your domain from being transferred to another registrar or having key ownership details changed without authorization. Registrar locks are usually yours to toggle in a dashboard, while registry locks and the ICANN-mandated 60-day rule follow stricter, sometimes manual, removal processes. None of these locks touch DNS resolution or renewal. A locked domain still resolves, still serves email, and still renews on schedule.
TL;DR:
- Registrar locks are controlled by your domain registrar and can usually be toggled through your account dashboard to prevent unauthorized transfers.
- Registry (server) locks require manual request at the registry level and are typically used for domains at high risk of hijacking, offering stronger protection.
- The ICANN 60-day transfer lock automatically applies after registrant changes or new registrations, and cannot be bypassed by support or registrars.
- While locked, domains remain reachable for website hosting, email, and renewal processes, but transfers and some ownership edits are blocked.
- Regularly check WHOIS status codes and keep contact details current to ensure your domain's lock status is correctly reflected and maintained.
Table of Contents
- What Is a Domain Lock, and What Do the Status Codes Mean?
- The Four Lock Types Every Domain Manager Should Know
- What a Domain Lock Actually Blocks (and What It Doesn't)
- How to Check If Your Domain Is Locked
- How to Unlock a Domain and Prepare It for Transfer
- Best Practices for Keeping Your Domains Secure
- Where I See Domain Security Actually Fail
- Managing Domains and Locks With inSave Hosting
- Sources
- FAQ
What Is a Domain Lock, and What Do the Status Codes Mean?
A domain lock is a security flag attached to your domain's record that blocks specific actions, most commonly transfers to another registrar. It works through EPP (Extensible Provisioning Protocol) status codes visible in any WHOIS lookup, and where that flag lives determines who can remove it.
Registrar lock is the version most account holders deal with. It shows up as clientTransferProhibited or clientUpdateProhibited, and the "client" prefix means your registrar set it, so your registrar (or you, from the dashboard) can usually clear it. Registry lock is a different animal entirely.
- Registrar lock (client statuses): Set and removed by your registrar; typically toggled from your account dashboard.
- Registry lock (server statuses): Codes like
serverTransferProhibitedandserverUpdateProhibitedare set at the registry level, per Wikipedia's overview of registrar-lock mechanics, and removing them usually requires a manual request or a registry-level workflow, not a dashboard click. - Both types coexist: A domain can carry client and server statuses at the same time, each blocking different actions.
None of this makes your site go dark. Locking is an ownership control, not an outage.
The Four Lock Types Every Domain Manager Should Know
Not every lock does the same job, and mixing them up leads to unnecessary panic when a transfer stalls. Four distinct categories cover almost everything you'll encounter.
- Registrar (client) lock: The default, user-controlled protection most registrars apply automatically to prevent casual hijacking or accidental transfers.
- Registry (server) lock: A stronger, often premium safeguard, per the same registrar-lock documentation, that requires direct registry interaction to remove, making it appropriate for domains that would cause real damage if hijacked.
- Verification and policy holds: Applied when contact information fails verification or a legal/compliance issue arises. Some of these, like a
serverHold, actually pull the domain out of the DNS zone, which is the one case where a "lock" causes a real outage. - ICANN 60-day transfer lock: A mandatory, automatic restriction, not a discretionary one. It typically applies after a change of registrant, a fresh registration, or an inbound transfer, and it exists specifically to give the real owner a window to notice and contest suspicious changes.
Registrars can't waive that last one. It's baked into ICANN's transfer policy, not a setting anyone controls from a support ticket.
What a Domain Lock Actually Blocks (and What It Doesn't)
The confusion around locks usually comes down to overestimating what they stop. A lock is narrow by design.
Blocked while locked:
- Transfers to another registrar
- Certain contact or registrant detail edits, depending on which status codes are set
- Deletion of the domain, when
clientDeleteProhibitedorserverDeleteProhibitedis present
Unaffected while locked:
- DNS resolution, so your website and email keep working
- Renewals, which you can still process normally
- In-registrar management tasks that don't touch transfer or ownership fields
The one exception worth flagging: serverHold and clientHold are different beasts entirely. Those statuses actually remove a domain from the DNS zone, which does take your site offline. That's a policy or compliance action, not a routine transfer lock, and it's rare outside of legal disputes or ICANN compliance escalations.
How to Check If Your Domain Is Locked
Start with the easiest option before digging into raw WHOIS data.
- Log into your registrar dashboard. Most show a lock toggle or padlock icon directly on the domain management page. This tells you the registrar-level status instantly.
- Run a WHOIS lookup on your domain and scan the status field. Look for
clientTransferProhibited,serverTransferProhibited,clientUpdateProhibited, orclientDeleteProhibited. Registrar documentation from providers like Amazon Route 53 confirms that a locked domain will showclientTransferProhibitedin public WHOIS output. - Give it a few minutes to update. WHOIS records don't always refresh instantly after a change. If the status still looks wrong after 15 to 30 minutes, contact registrar support directly instead of assuming the toggle failed.
Pro Tip: Bookmark a WHOIS lookup tool and check it right after any registrar account change, admin turnover, or domain purchase. Catching a stale or unexpected status code early saves you a frantic call to support during an actual transfer window.
How to Unlock a Domain and Prepare It for Transfer
Unlocking follows a fairly standard sequence, but the ICANN 60-day rule is the part people miss, and it isn't optional.
- Disable the registrar lock from your dashboard, or ask your current registrar to remove it if you don't have self-service access.
- Request your authorization code (also called an EPP code or transfer key), which the gaining registrar needs to start the process.
- Initiate the transfer with the new registrar and approve the Form of Authorization if one is required.
- Check for the 60-day restriction first. If you recently changed the registrant contact, registered the domain, or completed a transfer, ICANN's mandatory 60-day rule blocks any further inter-registrar transfer, and registrars cannot remove it early, no matter how urgent your request feels.
- Run a pre-transfer checklist: confirm your contact email is current and can receive the transfer approval message, verify there are no open disputes or server-level locks, and re-check WHOIS to confirm
clientTransferProhibitedhas actually cleared before you submit anything.
Time transfers around known registrant changes rather than after them. If you're planning a move, inSave Hosting's guide to transferring a domain without downtime walks through the sequencing in more detail, and inSave Hosting's own domain transfer service handles the coordination for you.
Best Practices for Keeping Your Domains Secure
Domain security is mostly about defaults, not heroics. A few habits prevent almost every hijacking scenario.
- Leave the registrar transfer lock enabled by default, and re-lock immediately after any legitimate transfer completes. Some registrars re-lock automatically after a set window, but don't count on that everywhere.
- Use a unique password and two-factor authentication on every registrar account. Account takeover, not lock evasion, is how most domain theft actually happens.
- Buy registry lock for domains that matter. If losing a domain would mean real revenue or reputational damage, the extra manual-removal friction of registry lock is worth the cost, and it's worth pairing with an internal approval requirement before anyone changes the registrant record.
- Keep WHOIS contact details current. Stale contact info triggers verification holds you didn't ask for, and those can quietly restrict your domain until you respond to a confirmation email you might not even notice.
Choosing a strong, defensible domain name in the first place also reduces the odds you'll need to fight over one later, a point covered in inSave Hosting's guide to securing a domain name.
Pro Tip: After any bulk contact update or admin handoff, run a fresh WHOIS check on every domain in the portfolio, not just the one you touched. Verification holds have a way of showing up on domains nobody meant to change.
Where I See Domain Security Actually Fail
The failures I keep seeing aren't technical. They're procedural: a domain left unlocked after a routine admin swap, a WHOIS verification email nobody read before it expired into a hold. Escalate to support the moment a lock won't clear on schedule, and buy registry lock the moment a domain becomes genuinely valuable. Lock it, secure the account, keep contacts accurate, and check WHOIS after every change.
— Ihor
Managing Domains and Locks With inSave Hosting
Domain registration and transfer support is available, including guidance on when to unlock a domain safely and how to schedule around the ICANN 60-day window to avoid issues.
This support is complemented by infrastructure features such as SSL certificates and managed backups designed to maintain security during domain-level changes. If you're evaluating where to register or move a domain, check inSave Hosting's domain names page for current TLD options, or start a transfer directly through the domain transfer service and get help confirming your lock status before you submit anything.
Sources
FAQ
Is Domain Flipping Illegal?
Buying and reselling domain names is legal in most cases, but registering names that infringe on trademarks or that you register in bad faith to profit off someone else's brand can expose you to legal claims under trademark and anti-cybersquatting law.
How Do I Tell If My Domain Is Locked?
Check your registrar dashboard for a lock toggle, or run a WHOIS lookup and look for status codes like clientTransferProhibited or serverTransferProhibited in the results.
How Long Is a Domain Locked After a Transfer?
ICANN's policy imposes a mandatory 60-day lock after a completed transfer or a registrant contact change, and registrars cannot remove that restriction early.
What Should You Avoid When Choosing a Domain Name?
Avoid names that closely mimic existing trademarks, use confusing hyphens or numbers that invite typos, or rely on a TLD with unclear long-term availability, since any of these can complicate transfers, renewals, or legal standing later.