Domain transfer lock explained: what it is and how to lift it

The domain transfer lock is a security status set by your registrar that prevents your domain from being transferred to another registrar without explicit action from you. In RDAP and WHOIS terminology, it appears as clientTransferProhibited. It exists to protect against domain theft, and you should only remove it when you are actively initiating a transfer you control. This article covers the lock in detail, for the full transfer process, see how to transfer a domain name.

What is clientTransferProhibited?

clientTransferProhibited is a standardized EPP status code defined in RFC 5731. When your registrar sets this status on a domain, any transfer request initiated at another registrar is automatically rejected by the registry. No auth code, no admin contact approval, the request simply does not go through.

Here is what it looks like in a raw WHOIS response:

Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

And in an RDAP response (JSON format):

{
  "ldhName": "example.com",
  "status": [
    "client transfer prohibited"
  ]
}

The key distinction: clientTransferProhibited is set by the registrar and can be removed by you through your registrar's interface. This makes it different from other protection statuses.

The different domain protection statuses

Status	What it blocks	Who can remove it	Typical use case
clientTransferProhibited	Transfer to another registrar	You, via the registrar	Standard security for all domains
serverTransferProhibited	Transfer (registry-level)	Registry only, not the registrar	Domains in legal dispute or redemption
clientDeleteProhibited	Deletion of the domain	You, via the registrar	Premium or business-critical domains
clientUpdateProhibited	Modification of DNS/contact data	You, via the registrar	Domains where stability is critical

A domain can carry multiple statuses simultaneously. serverTransferProhibited is not something you can turn off through your registrar, if you see it, contact the registry or your registrar's support to understand why it was set.

Why the domain transfer lock exists

Before registrar locks became standard, domain theft was surprisingly easy. An attacker who obtained a valid auth code (through phishing, social engineering on registrar support, or data breaches) could initiate a transfer and move the domain within hours. The rightful owner would have no time to react before the domain was under someone else's control.

Two cases made the problem concrete: the Panix hijacking in 2005 (an ISP's domain was transferred to an Australian registrar without the owner's knowledge) and the Twitter.com transfer attempt in 2009. The registrar lock was designed as a deliberate friction layer, it does not make theft impossible, but it ensures that any transfer requires an explicit action by someone with account access, giving the real owner a window to catch and stop unauthorized activity.

This is also why you should not disable the lock permanently. The lock only costs you 10 minutes when you initiate a legitimate transfer.

How to check if your domain is locked

Three methods, in order of ease:

1. Your registrar's dashboard. Look under domain settings or security settings for a toggle labeled "Transfer Lock" or "Registrar Lock". This is the fastest method.

• Namecheap: Domain List > Manage > Security > Transfer Lock
• GoDaddy: My Products > Domains > Settings > Transfer Lock

2. WHOIS lookup. Check the "Domain Status" field in the WHOIS output for your domain. If you see clientTransferProhibited, the lock is active. You can use any public WHOIS tool or run whois example.com from your terminal.

3. RDAP lookup. RDAP is the modern successor to WHOIS and returns structured JSON. Run:

curl https://rdap.org/domain/example.com

Look for "client transfer prohibited" in the status array in the response. Domain Sentinel runs this check and displays it in a readable format, useful if you want to verify the status without parsing JSON manually.

How to disable the domain transfer lock

Namecheap

1. Log in and go to Domain List.
2. Click "Manage" next to the domain.
3. Go to the "Security" tab.
4. Toggle "Transfer Lock" to Off.
5. The change is immediate, no waiting period.

GoDaddy

1. Log in and go to My Products > Domains.
2. Click on the domain name, then "Manage DNS" or go to Settings.
3. Find "Transfer Lock" and click "Disable".
4. GoDaddy may show a confirmation dialog. Accept it.
5. Allow a few hours before the status change appears in WHOIS.

Cloudflare Registrar

Cloudflare does not use a traditional registrar lock toggle. Instead, transfers from Cloudflare require you to go to the Registrar section of the dashboard, select the domain, and initiate an "Authorization to Transfer". Cloudflare then generates the auth code and flags the domain for outbound transfer. There is no separate "disable lock" step, the authorization flow handles it.

Other registrars

The path is usually: Domains > [domain name] > Security or Transfer > Unlock or Disable Transfer Protection. If you cannot find it, use the registrar's search or contact support, the option is always there, it is just sometimes buried.

When to lift the lock: and when not to

Lift the lock if	Do not lift the lock if
You are initiating a transfer to another registrar you control	You received an unsolicited email asking you to disable it
The request to transfer came from you and only from you	Someone claiming to be "technical support" called and asked you to unlock
You verified the destination registrar is legitimate	You are not actively in the middle of a transfer you started

The social engineering attack pattern is consistent: attackers create urgency ("your domain is about to expire", "we need to migrate your account") and ask the domain owner to remove the lock or share their auth code. Never act on these requests without verifying directly through your registrar's official login page.

After the transfer: re-enable the lock

Once your transfer completes and the domain is settled at the new registrar, re-enable the transfer lock. It takes 2 minutes and protects you from the same attack vectors at the new registrar.

Some registrars automatically re-enable the lock 60 days after a transfer (reflecting the ICANN 60-day rule). Others leave it off indefinitely. Do not assume it was re-enabled, verify in your dashboard. If your new registrar is Namecheap or GoDaddy, the toggle is visible in the same domain settings where you disabled it.

Verify the final status with an RDAP lookup or through Domain Sentinel to confirm clientTransferProhibited is back in place.