Registry lock is the strongest protection a domain owner can buy against hijacking, and most owners have never heard of it. The term is often confused with the ordinary transfer lock that every registrar offers, but the two work at different levels of the domain name system and protect against different things. This guide explains what registry lock is, how it differs from a registrar lock, which registries offer it, what it protects against and what it does not, and how to get it. It is part of our domain name security guide.
Registrar lock versus registry lock
To understand the difference, it helps to recall how a domain registration is structured. The registry operates the top-level domain and holds the authoritative record for every name in it. The registrar is the retailer that sells you the name and sends change requests to the registry on your behalf through EPP (Extensible Provisioning Protocol, the automated channel between registrars and registries). Each domain carries status codes, visible in WHOIS or RDAP (the public registration records), that tell the registry which operations to refuse.
Registrar lock: the client status codes
Registrar lock, often labeled transfer lock or domain lock in a control panel, consists of status codes that the registrar sets: clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited. The “client” prefix means the registrar, as the registry’s client, applied them. They are effective against outside interference. A transfer request from another registrar fails because the registry sees clientTransferProhibited and refuses it. The weakness is in who can remove them. Anyone who can log in to your registrar account can clear the codes with a click, and the registrar’s own staff can clear them if persuaded that the request is legitimate. Registrar lock therefore offers no protection once the registrar account itself is compromised, which is how most domain theft happens. Our registrar account security guide addresses that layer.
Registry lock: the server status codes
Registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) places a different set of codes on the domain: serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited. The “server” prefix means the registry itself applied them, and only the registry can remove them. No action in the registrar control panel, and no EPP command the registrar sends, can clear a server-side code. To make any change to a registry-locked domain, the registrar must contact the registry through a separate, pre-arranged channel, typically a phone call or a signed authorization between named individuals at the registrar and the registry, with passphrases agreed in advance. A person at the registry verifies the request, temporarily lifts the lock, the change is made, and the lock is reapplied.
That out-of-band, human verification is the mechanism. The lock works because the thing an attacker usually has, which is a stolen password or a compromised email address, is not sufficient to trigger it. The attacker would need to defeat a separate identity check performed by people who are expecting exactly that kind of attempt.
Who offers registry lock
Registry lock is a service of the registry, so availability depends on the top-level domain. Verisign offers it for .com and .net, and it is the version most organizations encounter first. Many country-code registries offer an equivalent under their own names, and many of the newer generic top-level domain registries include a lock service in their contracts with registrars. A few registries do not offer one at all, which is worth knowing when choosing an extension for a critical property.
Registries do not sell the service directly to domain owners. It is sold through registrars, and here the market splits. Corporate registrars, meaning the firms that serve brand owners and large enterprises, offer registry lock as a standard product with established verification procedures. A smaller number of retail registrars offer it, sometimes under a premium tier, and many retail registrars do not offer it at all. If your registrar cannot provide registry lock for a domain you consider critical, the practical options are to transfer that domain to a registrar that can, or to engage a management service that works with one.
What registry lock protects against
Registry lock answers the three attack paths that account for most domain hijacking. The first is registrar account takeover. An attacker who obtains your password, or who resets it by compromising the registrant email, can log in and attempt to transfer the domain or change its nameservers. With registry lock in place, both operations fail at the registry, and the attacker has nowhere to go.
The second is insider change. A disgruntled employee, a departing contractor, or an agency with lingering access can make a damaging change from inside a legitimately held account. Registry lock requires that the change be verified with the named lock contacts, who are usually a small number of senior people. The insider cannot act alone.
The third is social engineering of the registrar’s support desk. Attackers routinely impersonate domain owners to registrar support staff, armed with details scraped from public records and breached data, and persuade them to reset credentials or push a transfer. A support agent cannot clear a server-side status code, so even a successful deception at the registrar stalls at the registry.
In each case the protection comes from the same property: the lock lives above the registrar, so compromising the registrar relationship is not enough.
What registry lock does not protect against
Registry lock protects the registration record. It does not protect the DNS records that the registration points to. If your DNS is hosted at a provider separate from the registrar, such as a cloud DNS service, an attacker who compromises that provider account can change A, MX and TXT records and redirect your website and email without ever touching the registry. The nameserver delegation stays locked; the zone behind it does not. DNS provider hardening and DNSSEC are the controls for that layer, and our guide to securing a domain name walks through both.
Registry lock also does nothing about expiration. A locked domain that is not renewed still passes through the expiration lifecycle and is eventually deleted; the lock is removed as part of that process. Renewal governance and expiration monitoring are separate controls.
Finally, registry lock is only as strong as its contact list. If the named lock contacts leave the organization and are not replaced, or if the verification passphrases are stored where an attacker can find them, the human verification step weakens. Review the contact list at least annually.
Cost and operational friction
Registry lock costs more than a standard registration, with pricing set by the registrar and varying with the registry and the level of service. For a domain whose loss would stop the business, the fee is small against the exposure; for a large portfolio of defensive registrations, it is usually applied only to the critical names.
The more significant cost is time. Because every change requires out-of-band verification by people, changes to a locked domain take hours and sometimes a business day rather than seconds. Nameserver migrations, contact updates and registrar transfers all need to be scheduled. Organizations occasionally decline registry lock for that reason, and that is a mistake. The delay is the control. An attack that depends on moving quickly, before anyone notices, cannot succeed against a process that refuses to move quickly for anyone. Plan DNS changes in advance, keep the lock contacts reachable, and treat the friction as the feature it is.
How uncommon registry lock still is
Given how directly registry lock addresses hijacking, adoption is low. CSC found that 24 percent of Forbes Global 2000 companies use registry lock, up from 17 percent in 2020, and that the figure rises to 45 percent among companies that use enterprise-class registrars, according to the CSC 2024 Domain Security Report. The gap between those two numbers is instructive. Companies at corporate registrars are offered the lock and often take it; companies at retail registrars frequently are not offered it and never learn it exists. ICANN’s Security and Stability Advisory Committee recommended registry lock as an additional layer above the client status codes as long ago as its 2010 report SAC044, according to the SSAC’s Registrant’s Guide to Protecting Domain Name Registration Accounts, so the advice is not new. What has changed is how routine account takeover has become, which is the subject of our domain hijacking hub.
How to get registry lock
Start by identifying the domains that qualify. The primary website domain, the email domain, any domain used for customer logins or payment pages, and any domain whose loss would halt operations belong on the list. Then ask your registrar whether it offers registry lock for each of those extensions. If it does, the registrar will collect the names and contact details of the people authorized to approve changes, set up the verification procedure, and request the server-side codes from the registry. Confirm the lock by checking the domain’s RDAP record for serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited.
If your registrar does not offer it, the domain can be transferred to one that does. Our domain name management service arranges registry lock as part of consolidating and hardening a client’s portfolio, and we handle the registrar relationship, the contact list and the change scheduling so the lock stays in place and stays usable.
What DNAccess does
DNAccess recovers hijacked domains, and in the recoveries we handle, registry lock is the control that would most often have prevented the theft. Through our domain name management service we place critical domains at registrars that support registry lock, configure the verification contacts, and manage changes on the client’s behalf. When a domain has already been moved by an attacker, we pursue recovery through registrar escalation, ICANN’s transfer dispute procedures and, where necessary, litigation. To discuss locking your critical domains, contact DNAccess.