A registrar lock (also called domain lock) is a protective status applied to a domain name that blocks transfer, update, and delete operations at the registry level until the lock is intentionally removed by the registrant or registrar.
The lock is implemented using EPP (Extensible Provisioning Protocol) status codes, most commonly clientTransferProhibited, which tells the registry to reject any transfer request unless the status is removed first. When enabled, the lock appears in WHOIS and RDAP records and applies regardless of which registrar attempts to process a transfer.
How it works
When you register or renew a domain, your registrar typically enables the lock by default. To transfer the domain away, you must first:
- Log into your registrar's control panel
- Locate the domain's lock setting
- Disable or "unlock" the lock
- Request an EPP Code (Auth Code) from your current registrar
- Provide that code to your new registrar to complete the transfer
Without removing the lock, any transfer request is automatically rejected by the registry, even if you have the EPP code.
When it matters
Registrar locks are mandatory under ICANN policy and are one of your primary defenses against unauthorized domain theft. They're especially important during the first 60 days after registration or a registrant change, when transfers are restricted. However, registrars must provide a straightforward way to unlock domains on demand—excessive friction here is a compliance violation.
TipAlways unlock your domain before initiating a transfer, and verify the lock status has cleared before the new registrar attempts the handoff, to avoid delays or failed transfers.