Whoever controls your domain's nameservers controls your website, your email and every certificate issued for it. Most domains are protected only by the password to a registrar account. Registry lock adds a check that a stolen password can't pass: changes need a human, out-of-band confirmation at the registry itself.
Transfer lock and registry lock aren't the same
| Transfer lock (registrar lock) | Registry lock | |
|---|---|---|
| Status codes | clientTransferProhibited (and sometimes clientUpdateProhibited, clientDeleteProhibited) |
serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited |
| Set by | your registrar, from its control panel | the registry (Verisign for .com and .net), at your registrar's request |
| Removed by | anyone logged in to your registrar account, in one click | a verified request: for Verisign, a phone call to a named person who gives a security phrase |
| Stops | accidental and unauthorised transfers | transfers, deletion and nameserver changes, even from a compromised account |
A transfer lock is free and should always be on. But anyone who gets into the account can switch it off, or simply change the nameservers, which a transfer lock doesn't prevent at all. Changing nameservers is how most hijacks work: the attacker points your domain at their servers, gets a certificate and reads your email.
Why it matters: real hijacks
In 2019 Cisco Talos described Sea Turtle, a state-sponsored campaign that hijacked the DNS of at least 40 organisations in 13 countries, including a registry, by getting into registrar and DNS provider accounts. Its top recommendation was registry lock. The US government's Emergency Directive 19-01 the same year ordered federal agencies to audit their DNS records and turn on multi-factor authentication for DNS accounts after similar attacks.
How Verisign Registry Lock works
For .com, .net, .cc and .name:
- Your registrar asks Verisign to lock the domain, which sets all three
server*statuses. - To change anything, an authorised person at the registrar asks Verisign to unlock it.
- Verisign calls the registrar's contact, who must give an individual security phrase.
- The change is made and the domain is locked again.
Nameserver host records are locked separately, and Verisign recommends locking both. Other registries run similar services for their domains.
Who offers it
Registry lock is sold by registrars, not registries, and many don't offer it. Of the popular registrars:
- Namecheap sells it through Domain Vault.
- Cloudflare offers it on the Enterprise plan as Custom Domain Protection.
- Corporate registrars such as MarkMonitor and CSC offer it to their clients.
- Porkbun and Gandi don't publish a registry lock offer.
See our registrar comparison.
Do you need it?
Use it for the domains whose loss would stop the business: the one your email runs on, your main website, and anything handling payments or logins. For everything else, the essentials matter more:
- A transfer lock on every domain.
- Two-factor authentication on the registrar account, ideally a security key or passkey rather than SMS.
- The registrar account in a shared company mailbox, not one person's.
- Monitoring that tells you when nameservers, the registrar or the domain's status change.
Check your domain
whois example.com | grep -i status
or look it up at ICANN Lookup. server* statuses
mean a registry lock is on. The
domain expiry checker shows your domain's
status, registrar and expiry date. Nameward's monitoring alerts you if the
transfer lock is turned off, or the registrar or nameservers change. If
they already have, see
nameservers changed without permission.