Registrar lock vs registry lock: what each one stops

Nearly every domain has some kind of lock. The question is which kind, and who can lift it. Plenty of owners see “Domain locked: yes” in their dashboard and consider the job done. But a registrar lock protects against a different scenario than a registry lock, and you only notice the difference once your own account is in someone else’s hands.

What is a registrar lock?

A registrar lock is a status your registrar sets at the registry. The protocol registrars use to talk to registries is called EPP, and its status values are defined in RFC 5731. The values beginning with client are set by the registrar:

In everyday use, “registrar lock” usually means clientTransferProhibited. You switch it on and off yourself in your account. That is also its limit: whoever takes over your account can switch it off just as quickly.

What is a registry lock?

With a registry lock, the registry sets the server versions of those statuses:

The key point is confirmation outside your customer account. Even if an attacker has your password, your email and your second factor, they can’t change nameservers or registrant data without that extra route.

What it looks like in practice

Large companies typically have both. The WHOIS record for google.com shows it clearly:

whois google.com | grep "Domain Status"

Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

Three locks from the registrar, three from the registry. The link after each status leads to ICANN’s explanation of EPP status codes. For most domains the first relevant line, clientTransferProhibited, is enough.

Country-code domains work differently

Not every registry uses the same model. Some country-code registries have no client transfer lock at all and instead rely on the auth code: a transfer only happens if the new registrar presents a valid code, which your current registrar generates only on request. The German registry DENIC works this way for .de and offers a separate paid .de Registry Lock, where a named person must approve every change with a token sent to their phone. Other registries offer comparable products. Your registrar can tell you what exists for the extensions you hold.

Is a registry lock worth it?

For most personal and small business domains: no. A transfer lock, two-factor login and a separate email address for your registrar account cover the common cases.

For domains carrying revenue, customer data or company email, the sums change. A hijacked main domain means website and email down, intercepted password resets and possibly phishing under your real name. Against the most serious form, DNS hijacking through swapped nameservers, a registry lock is the strongest protection available.

The price is friction. Every nameserver change takes longer. If you switch DNS providers often or change nameservers through automation, you have to plan for it.

Before you order a registry lock

A registry lock is quick to order and painful if it is badly planned. Settle four questions first.

Who confirms changes? Pick people who are reachable when changes are due. A contact on holiday or about to leave the company leaves you stuck. Find out how to replace a contact before you need to.

Which domains? Typically the main domain, the email domain if it differs, and domains that handle payments or logins. Campaign sites and redirect domains rarely need it.

How often do nameservers change? If rarely, as for most companies, the friction hardly matters. If often, a registry lock may get in the way.

What happens in an emergency? If your DNS provider has an outage and you need to move fast, the lock will slow you down. Ask your registrar how quickly a release can go through in the best case, and document the process somewhere several people know about.

What locks don’t cover

None of these locks protects individual DNS records if your zone sits with a DNS hosting provider. If someone edits the A record there, the domain registration itself is unchanged. The only defence is a well-secured DNS account with two-factor login.

Nor do locks protect against expiry. A domain that isn’t renewed gets deleted, lock or not. How to avoid that is in prevent domain expiry.

Next step

Run a WHOIS lookup on your most important domain. If a .com, .net or .org doesn’t show clientTransferProhibited, switch the lock on in your account. At betadomain you get .com domains with DNSSEC at a fixed yearly price, and the terms for other extensions are on the price list. While you’re tidying up, check whether the main variants of your domain name are still free.

Step by step

1. Check the statusRun a WHOIS lookup and see which Domain Status values are set, such as clientTransferProhibited.
2. Turn on the transfer lockEnable the transfer lock in your registrar account for every gTLD domain where it is off.
3. Pick critical domainsDecide which domains matter enough to justify a paid registry lock.
4. Order the registry lockRequest registry lock through your registrar and name reliable contacts for confirmations.
5. Document the processWrite down who can approve changes and how long it takes, so nobody has to search during an emergency.