Registrar Lock: Preventing Unauthorized Domain Transfers

Introduction

Registrar lock is a domain security setting that helps prevent unauthorized transfers from one registrar to another. When enabled, the domain cannot usually be transferred away until the owner unlocks it.

For most domains, registrar lock should stay enabled by default. It protects against accidental transfers, unauthorized transfer attempts and account-management mistakes. The lock is usually disabled only when you intentionally want to transfer the domain to another registrar.

Quick answer

What is registrar lock?

Registrar lock, also called domain lock or transfer lock, is a registrar-level protection that blocks domain transfers unless the lock is removed.

When registrar lock is active, WHOIS or RDAP may show a status such as:

clientTransferProhibited

This usually means the domain cannot be transferred to another registrar until the owner unlocks it inside the registrar account.

Why registrar lock matters

Registrar lock matters because the domain name is often one of the most important assets behind a website, email system or business identity.

Registrar lock is not a replacement for account security. If someone controls the registrar account, they may still be able to unlock the domain.

What clientTransferProhibited means

clientTransferProhibited is a common domain status code that means the registrar has placed a transfer lock on the domain.

In most cases, this is normal and safe. Many registrars enable this status by default to prevent unauthorized transfers.

If you are planning a transfer, you usually need to unlock the domain first and request an authorization code.

Registrar lock vs other domain statuses

When should registrar lock be enabled?

For most domains, registrar lock should remain enabled all the time.

Keep it enabled when:

• the domain is used for a live website
• the domain is used for business email
• the domain is important for branding
• the domain is managed by a business or agency
• no registrar transfer is planned
• multiple people have access to domain management
• the domain is connected to production systems

Important domains should also use strong registrar passwords, two-factor authentication and monitored contact email addresses.

When should registrar lock be disabled?

Registrar lock should usually be disabled only when you intentionally want to transfer the domain to another registrar.

Before disabling registrar lock, confirm:

• you are transferring the correct domain
• the destination registrar is correct
• you have registrar account access
• you have access to the domain owner email
• the domain is not expired or in redemption
• the domain is eligible for transfer
• you have or can request the EPP/Auth code

Registrar lock and EPP/Auth code

To transfer a domain, most registrars require an authorization code, often called an EPP code, Auth code or transfer code.

Registrar lock and EPP/Auth code work together:

• registrar lock blocks transfer while enabled
• EPP/Auth code authorizes the transfer request
• transfer approval usually happens through registrar emails or account actions

Never share an EPP/Auth code unless you are intentionally transferring the domain.

How to check registrar lock status

Use WHOIS Lookup to review domain status codes. Look for statuses such as clientTransferProhibited, clientUpdateProhibited, clientHold or redemptionPeriod.

Common registrar lock problems

How to manage registrar lock safely

1. Check the current domain status

   Use WHOIS Lookup to see whether the domain shows clientTransferProhibited or another transfer-related status.

2. Confirm registrar account access

   Make sure the correct domain owner can log in to the registrar account and manage security settings.

3. Keep lock enabled by default

   If no transfer is planned, keep registrar lock enabled for important domains.

4. Unlock only for planned transfers

   Disable registrar lock only when you intentionally want to transfer the domain.

5. Protect the EPP/Auth code

   Request and share the EPP/Auth code only with the trusted destination registrar or responsible administrator.

6. Monitor transfer emails

   Watch registrar emails during transfer. Unauthorized transfer requests should be canceled immediately.

7. Re-enable lock after transfer

   After the domain arrives at the new registrar, enable registrar lock again if it is not enabled automatically.

8. Improve account security

   Use strong passwords, two-factor authentication and monitored registrar contact emails.

Registrar lock status example

Domain: example.com
Registrar: Example Registrar Inc.
Status:
  clientTransferProhibited
  clientUpdateProhibited
Expires: 2027-05-12
Nameservers:
  ns1.provider.com
  ns2.provider.com

Meaning:
- Transfer lock is enabled
- Domain is protected against registrar transfer
- Domain is active and not near expiry

whois example.com
dig example.com NS
dig example.com SOA

Safe domain transfer checklist

Before transferring a domain, confirm:

• domain is active and not expired
• domain is eligible for transfer
• registrar lock can be disabled
• correct destination registrar is selected
• owner email is accessible
• EPP/Auth code is requested securely
• nameservers and DNS records are documented
• email and website services are understood
• transfer request is expected
• lock will be re-enabled after transfer

A registrar transfer does not necessarily change DNS records, but mistakes during domain management can still affect nameservers, billing or access.

Registrar lock and domain security

Registrar lock is one layer of domain security. It should be combined with other protections.

Recommended protections:

• strong registrar account password
• two-factor authentication
• monitored account email
• current billing details
• limited account access
• domain expiry monitoring
• registrar lock enabled
• careful handling of EPP/Auth codes

For important business domains, domain security should be treated like server or email security.

Registrar lock and DNS

Registrar lock usually does not stop DNS records from working. A locked domain can still use normal nameservers, DNS records, email and SSL.

However, if the registrar account is compromised, an attacker may try to unlock the domain, change nameservers or initiate a transfer. This is why registrar lock should be combined with account security and DNS monitoring.

• DNS Lookup →
• Domain Health Checker →
• WHOIS Lookup →

Frequently asked questions