Registry lock vs registrar lock: which domain lock to enable

A domain can be locked at three levels. The transfer lock is set by your registrar at your request and only blocks an outgoing transfer. The registrar lock, in its wider sense, adds the same kind of switch for updates and deletion; all three are undone in a click by anyone who has your registrar account. The registry lock is set by the registry itself, above the registrar, and removing it requires a manual procedure with a human on the phone. The rule that follows: transfer lock on every domain you own, registry lock on the few domains whose loss would stop the business. The rest of this article is the comparison table, how each lock reads in RDAP, and which one fits which domain.

Three locks, three levels

Lock	Who sets it	EPP statuses	What it blocks	How it is removed	Cost
Transfer lock	Registrar, at the registrant's request	clientTransferProhibited	An outgoing transfer to another registrar	One click in the registrar account	Free, usually on by default
Registrar lock	Registrar, at the registrant's request	clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited	Transfer, contact or nameserver changes, deletion	One click in the registrar account, or a support ticket	Free
Registry lock	The registry, through a registrar that offers it	serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited	The same operations, refused by the registry even if the registrar asks	Offline verification with named contacts, then a delay of one to three days	Paid yearly, per domain

The prefix tells you the level: client statuses are managed by the registrar, server statuses by the registry. The full list of statuses is in the guide to domain status codes.

The registrar lock protects against mistakes, not against a stolen account

The client* statuses live in your registrar account, and whoever controls that account controls the locks. That includes you on a distracted afternoon, a colleague with shared credentials, and an attacker who phished the password or reset it through the registrant email. In every documented domain hijack of the last decade, the registrar lock was either off or switched off by the attacker seconds before the transfer.

So the registrar lock is worth enabling everywhere, because it stops the accidental transfer and the "I did not know that button did that" incident, and it is free. It has to come with two-factor authentication on the registrar account and on the email address the registry holds for the registrant, since that address is where password resets and transfer approvals land. The guide to the domain transfer lock covers checking and disabling it when you actually want to move the domain.

The registry lock: the registry itself refuses the change

With a registry lock, the server* statuses are set by the registry (Verisign for .com and .net, AFNIC for .fr, Nominet for .uk, EURid for .eu) and your registrar cannot remove them on its own. To change nameservers or transfer the domain, you ask your registrar, the registrar contacts the registry, and the registry verifies the request out of band: a call to a named contact, a passphrase, sometimes a signed form. The lock comes off, the change is made, the lock goes back on. Count one to three days.

That friction is the feature. A compromised registrar account cannot move the domain, a social engineering call to the registrar's support cannot move it either, and an internal error at the registrar is caught by the registry. Verisign's Registry Lock for .com and .net is sold through registrars that distribute it (corporate registrars such as MarkMonitor or CSC, GoDaddy's corporate offering, Cloudflare's Custom Domain Protection on its enterprise plan), AFNIC sells .fr Lock, and Nominet and EURid have equivalents. Ask your registrar whether it offers it; many retail registrars do not. It is billed yearly per domain and priced for domains that matter.

What it does not cover: the records inside your DNS zone at your DNS host, which is the target of most DNS hijacking; the expiry date, since a locked domain still expires; and the registrant email account, which stays the weakest link.

What the 60-day lock is not

After a registration, a transfer or a registrant change, ICANN rules block outgoing transfers for 60 days. This is a policy, not a protection you choose, and it does not show up as a status in RDAP. It is explained in the guide to the 60-day domain transfer rule. Do not mistake it for a registrar lock: when it expires, nothing replaces it.

Reading the locks in RDAP

An RDAP response lists the statuses of the domain in a status array. A lookup on a domain with a registrar lock and a registry lock shows something like this:

"status": [
  "client transfer prohibited",
  "client update prohibited",
  "client delete prohibited",
  "server transfer prohibited",
  "server update prohibited",
  "server delete prohibited"
]

Read the prefix: client means the registrar set it, server means the registry did. Three client* and no server* is the usual state of a well-configured domain without a registry lock. One caveat: a server* status is not always a registry lock. serverHold or serverUpdateProhibited alone can come from a dispute, a court order or a registry compliance action, and in that case the domain is not protected, it is frozen. The difference between registry, registrar and registrant explains who can act at each level.

Which lock for which domain

Domain	Locks to enable
Side project, secondary or defensive domain	Transfer lock, and two-factor authentication on the registrar account
The main domain of a company (site, email, API)	All three client* locks, plus a registry lock if the registrar offers one
Brand portfolio	Registry lock on the one to five domains that carry the business, client* locks on the rest

The decision is about the cost of losing the domain for three days, not about the price of the lock. If a hijacked domain means email down, customers phished and a week of recovery, the registry lock is cheap.

Checking that the locks stay in place

A lock is only useful while it is on. Put the critical domains in a watchlist: each is checked daily against the registry, and a status change raises an email at the next check. A clientTransferProhibited that disappears without any action on your side is the signal to act on immediately, because it usually precedes a transfer request. The check is daily, not real time, and it observes rather than blocks; the blocking is the lock's job. The brand protection page shows how this fits with the rest of the monitoring.

What to do today

Look up your main domains and read their status array. Turn on the three client* locks at your registrar where they are off, and enable two-factor authentication on the account and on the registrant email. For the domains you could not operate without, ask your registrar for a registry lock. Then watch the statuses, so that a lock that comes off is something you learn from an email and not from a customer.