Two Levels of Locks
Registrar lock (clientTransferProhibited) is set by registrar and prevents outbound transfers. Registry lock is set at the central registry and blocks deletes, updates, and transfers even if registrar is compromised.
Client vs Server Status Codes
- clientDeleteProhibited – registrar forbids deletion
- serverDeleteProhibited – registry forbids deletion
- clientUpdateProhibited – registrar forbids DNS changes
- serverTransferProhibited – registry forbids any transfer
How to Enable
Registrar lock: toggle in dashboard or contact support. Registry lock: usually requires printed form, notarized ID, and phone verification. Process takes 24-72 hours to activate or remove.
Pros and Cons
Locks stop hijacks but slow legitimate changes. If you need frequent DNS edits or plan to sell soon, use registrar lock only. For 6-figure domains, registry lock is mandatory insurance.
Transfer Process with Locks
1) Remove registry lock (fax + phone), 2) disable registrar lock, 3) obtain EPP code, 4) initiate transfer, 5) re-lock after completion. Budget 3-5 extra days in escrow timeline.
Corporate Policy Template
“Any domain valued above $10k must have registry lock. Removal requires two officers’ signatures and legal counsel approval.” Embed in infosec handbook to avoid rogue staff disabling protection.
Registrar Differences
Cloudflare offers free registry lock on supported TLDs (.com, .net, .org). GoDaddy brands it “Domain Protection Ultra” for $39.99/year. Compare cost vs domain value before bulk-enabling.
Monitoring Lock Status
Use whois CLI or DomainTools API to poll status codes daily. Sudden removal triggers email/SMS alert so you can re-enable before attacker proceeds.
Legal Override
Court orders can force registry to remove server locks. Ensure your legal contact info is up-to-date so you receive notice and can contest fraudulent orders.
Bottom Line
Registrar lock is seatbelt, registry lock is airbag. Use both for high-value names and accept the minor inconvenience—recovering a stolen domain costs 100× more than the extra approval steps.