Registrar Lock vs Registry Lock Explained

Registrar lock and registry lock both block unauthorized domain transfers, but they operate at different levels and defend against different threats. A registrar lock is a free, default setting you toggle inside your account; a registry lock is a paid, premium service that requires manual, out-of-band authorization at the registry itself before anything can change. For most domains the free lock is enough — registry lock earns its cost only on names whose loss would be catastrophic.

This guide explains exactly what each lock does at the protocol level, how to read the status codes on your own domain, and where the line sits between "the default is fine" and "this name is worth paying to protect."

What a Registrar Lock Actually Does

A registrar lock (sometimes called a "domain lock" or "transfer lock") is applied by your registrar — Porkbun, Namecheap, Cloudflare, GoDaddy, and the rest — and it is switched on by default the moment you register most domains. Technically it sets one or more EPP status codes that begin with the word client:

• clientTransferProhibited — blocks transfers to another registrar
• clientUpdateProhibited — blocks edits to contact and nameserver records
• clientDeleteProhibited — blocks deletion of the domain

The word "client" is the tell: these flags are controlled by the registrar (the client of the registry), which in practice means anyone who can log into your registrar account can flip them off in a couple of clicks. That is exactly why a registrar lock stops accidents and opportunistic mischief but does little against an attacker who has already phished your password or hijacked your account.

What Registry Lock Adds at the Registry Level

Registry lock is enforced one level up, at the registry that actually runs the TLD — Verisign for .com and .net, and equivalent operators for other extensions. Instead of client-side flags it sets the server equivalents: serverTransferProhibited, serverUpdateProhibited, and serverDeleteProhibited. These cannot be removed from your registrar dashboard at all.

Lifting a registry lock is a deliberate, manual procedure. The registry, working through your registrar's dedicated desk, verifies your identity out of band — a phone callback to a pre-agreed number, a security passphrase, or confirmation from named authorized contacts — before it will unlock the name for a specific, time-boxed change. That out-of-band step is the whole point: a stolen password, a compromised email inbox, or a social-engineered support agent is no longer enough, because the final authorization happens on a channel the attacker does not control.

Registrar Lock vs Registry Lock: The Core Differences

Both locks share a goal — no unauthorized transfer, deletion, or record change — but they sit at different layers and cost very different amounts:

• Who enforces it: registrar lock is set by your registrar; registry lock is set by the registry operator.
• Status codes: client* codes versus server* codes, both visible in any WHOIS or RDAP lookup.
• How it is removed: a self-service toggle in your account versus a manual, verified, out-of-band request.
• Cost: registrar lock is free and usually on by default; registry lock is a paid add-on, typically billed annually and offered only by registrars that support it.
• Threat it stops: accidents and casual hijacking versus full account compromise, insider action, and support-desk social engineering.

When a Basic Registrar Lock Is Enough

For the overwhelming majority of domains, the free registrar lock plus good account hygiene is the correct answer. If your name is a hobby project, a personal site, a small-business brochure page, or any domain you could re-register or recover without serious financial or reputational damage, paying for a premium lock is over-engineering. What matters far more at this tier is that the free lock is actually switched on and that the account controlling it is hard to breach:

• Confirm clientTransferProhibited shows on the domain.
• Turn on app-based (authenticator) 2FA — not SMS, which is exposed to SIM-swapping.
• Use a registrar account email hosted on a different domain, so losing one name can never lock you out of the account that controls it.

Remember, too, that ICANN already imposes a 60-day transfer lock after any registration or change of registrant, so freshly bought or updated names get a built-in cooling-off window regardless of your settings.

When Registry Lock Is Worth Paying For

Registry lock earns its annual fee on names where an unauthorized transfer or even a few hours of DNS hijacking would be a genuine emergency: revenue-critical e-commerce, anything handling logins or payments, high-traffic media properties, and premium brandable domains you have paid real money for. Context helps calibrate the stakes. The typical aftermarket domain changes hands for roughly $2,000-$3,000, .com names drive about 80% of that market's volume, and the very top end is extraordinary — the record-setting AI.com sale reportedly closed at $70 million in February 2026. When a single name is effectively a five-, six-, or seven-figure asset, a lock that removes the "one phished password loses everything" scenario is cheap insurance.

This is also why the acquisition path matters. If you are buying a premium, brandable name on a curated marketplace such as Atom.com — where listings come with a free AI valuation, a USPTO trademark screen, secure escrow, and a designed logo shipped with the domain — you are treating that name as a core business asset from day one. Lock it to match: registrar lock immediately, registry lock once it becomes the anchor of a brand you cannot afford to lose.

How to Check Your Domain's Lock Status

You do not have to trust a dashboard toggle — the status codes are public. Run an RDAP or WHOIS lookup on your domain and read the "Domain Status" field:

1. See clientTransferProhibited (and ideally clientUpdateProhibited and clientDeleteProhibited)? Your registrar lock is on.
2. See serverTransferProhibited, serverUpdateProhibited, or serverDeleteProhibited? A registry lock is active.
3. See only ok or active? The domain is unlocked and freely transferable — fix that immediately.

The same lookup is worth running before you buy any name, so you know what state it is in and how quickly it could be moved into your control.

Locks Are One Layer, Not the Whole Wall

A lock only protects what it covers, so treat both types as part of a stack rather than a complete defense:

• DNSSEC signs your DNS answers so they cannot be silently forged in transit — a separate protection from transfer locks, and worth enabling on important names.
• Authenticator 2FA on the registrar account is the single highest-value control, because account access is what most locks ultimately depend on.
• Registry lock's out-of-band step is what survives even a full account takeover — which is precisely why high-value names justify the expense.

Match the lock to the stakes: free registrar lock and strong 2FA for everyday domains, registry lock layered on top for the handful of names you genuinely cannot afford to lose.

Frequently asked questions

Is registry lock the same as registrar lock?

No. A registrar lock is set by your registrar using client* EPP codes and can be toggled off from inside your account. A registry lock is set by the registry using server* codes and can only be removed through a manual, out-of-band identity check — a different, stronger layer of protection.

Does a registrar lock stop domain hijacking?

Partly. It stops accidental transfers and casual, opportunistic attempts. It does not stop an attacker who has already compromised your registrar account, since anyone logged in can disable it. For that threat you need registry lock plus authenticator-based 2FA.

How much does registry lock cost?

It is a paid premium service, usually billed annually, and only some registrars offer it. Pricing and per-change fees vary by registrar and TLD, so check directly with the registrar that manages your high-value names before committing.

Which EPP status means my domain is unlocked?

If a WHOIS or RDAP lookup shows only "ok" or "active" with no clientTransferProhibited or serverTransferProhibited codes, the domain is unlocked and can be transferred freely. Enable at least the registrar lock right away.

Can I add registry lock to any domain?

Only if the TLD's registry supports it and your registrar offers the service. It is widely available on .com and .net and several other extensions, but not universal, so confirm availability for your specific domain and registrar.