# Registry lock: protect your domain from hijacking

Whoever controls your domain's nameservers controls your website, your email
and every certificate issued for it. Most domains are protected only by the
password to a registrar account. **Registry lock** adds a check that a stolen
password can't pass: changes need a human, out-of-band confirmation at the
registry itself.

## Transfer lock and registry lock aren't the same

| | Transfer lock (registrar lock) | Registry lock |
|---|---|---|
| Status codes | `clientTransferProhibited` (and sometimes `clientUpdateProhibited`, `clientDeleteProhibited`) | `serverTransferProhibited`, `serverUpdateProhibited`, `serverDeleteProhibited` |
| Set by | your registrar, from its control panel | the registry (Verisign for .com and .net), at your registrar's request |
| Removed by | anyone logged in to your registrar account, in one click | a verified request: for Verisign, a phone call to a named person who gives a security phrase |
| Stops | accidental and unauthorised transfers | transfers, deletion and **nameserver changes**, even from a compromised account |

A transfer lock is free and should always be on. But anyone who gets into the
account can switch it off, or simply change the nameservers, which a transfer
lock doesn't prevent at all. Changing nameservers is how most hijacks work:
the attacker points your domain at their servers, gets a certificate and
reads your email.

## Why it matters: real hijacks

In 2019 Cisco Talos described **Sea Turtle**, a state-sponsored campaign that
hijacked the DNS of at least 40 organisations in 13 countries, including a
registry, by getting into registrar and DNS provider accounts. Its top
recommendation was registry lock. The US government's Emergency Directive
19-01 the same year ordered federal agencies to audit their DNS records and
turn on multi-factor authentication for DNS accounts after similar attacks.

## How Verisign Registry Lock works

For .com, .net, .cc and .name:

1. Your registrar asks Verisign to lock the domain, which sets all three
   `server*` statuses.
2. To change anything, an authorised person at the registrar asks Verisign
   to unlock it.
3. Verisign calls the registrar's contact, who must give an individual
   security phrase.
4. The change is made and the domain is locked again.

Nameserver host records are locked separately, and Verisign recommends
locking both. Other registries run similar services for their domains.

## Who offers it

Registry lock is sold by registrars, not registries, and many don't offer
it. Of the popular registrars:

- **Namecheap** sells it through Domain Vault.
- **Cloudflare** offers it on the Enterprise plan as Custom Domain
  Protection.
- **Corporate registrars** such as MarkMonitor and CSC offer it to their
  clients.
- **Porkbun and Gandi** don't publish a registry lock offer.

See our [registrar comparison](/guides/best-domain-registrar-for-security).

## Do you need it?

Use it for the domains whose loss would stop the business: the one your
email runs on, your main website, and anything handling payments or logins.
For everything else, the essentials matter more:

1. A transfer lock on every domain.
2. Two-factor authentication on the registrar account, ideally a security key
   or passkey rather than SMS.
3. The registrar account in a shared company mailbox, not one person's.
4. Monitoring that tells you when nameservers, the registrar or the
   domain's status change.

## Check your domain

```
whois example.com | grep -i status
```

or look it up at [ICANN Lookup](https://lookup.icann.org). `server*` statuses
mean a registry lock is on. The
[domain expiry checker](/tools/domain-expiry-checker) shows your domain's
status, registrar and expiry date. Nameward's monitoring alerts you if the
transfer lock is turned off, or the registrar or nameservers change. If
they already have, see
[nameservers changed without permission](/guides/nameservers-changed-without-permission).

## Sources

- [ICANN: EPP status codes](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en)
- [ICANN: Transfer Policy](https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en)
- [Verisign: Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock)
- [Verisign: Registry Lock status](https://www.verisign.com/resources/registrar-resources/registry-lock-status)
- [Namecheap: what is registry lock?](https://namecheap.com/support/knowledgebase/article.aspx/10536/2289/what-is-registry-lock)
- [Cloudflare: Custom Domain Protection](https://developers.cloudflare.com/registrar/custom-domain-protection/)
- [SecurityWeek: Sea Turtle DNS hijacking](https://www.securityweek.com/state-sponsored-hackers-use-sophisticated-dns-hijacking-ongoing-attacks/)
- [CISA: Emergency Directive 19-01](https://www.cisa.gov/news-events/directives/ed-19-01-mitigate-dns-infrastructure-tampering)

---
Source: https://nameward.app/guides/registry-lock (updated 2026-10-30)