Registry Lock vs Registrar Lock: The Real Difference

By Bill Hartzer, domain name expert and expert witness·August 10, 2026

The Difference Is a Prefix, Not a Product Tier

Registrar lock and registry lock are marketed as though one is a premium version of the other. They are not the same control at all, and the distinction is not a matter of degree. It is written into the protocol.

RFC 5731, the IETF standard defining the EPP domain object (EPP being the Extensible Provisioning Protocol, the machine language registrars use to send commands to registries), sets out the convention in section 2.3: “Status values that can be added or removed by a client are prefixed with 'client'. Corresponding status values that can be added or removed by a server are prefixed with 'server'.”

In this architecture the registrar is the client and the registry is the server. So a status beginning with client is, by definition, one the registrar can add and remove. A status beginning with server is, by definition, one it cannot — there is no valid EPP command a registrar can issue to clear a server status. ICANN's own reference states the same relationship and adds that server codes take precedence over client codes.

That is the whole distinction. Everything else — pricing, branding, which registrars offer what — is downstream of a naming convention in a 2009 standards-track RFC.

What Registrar Lock Actually Does

Registrar lock is the free, usually default protection your registrar applies. It is one or more client* statuses on the domain object, defined in ICANN's EPP status code reference:

clientTransferProhibited — “tells your domain's registry to reject requests to transfer the domain from your current registrar to another.”
clientUpdateProhibited — tells the registry to reject requests to update the domain.
clientDeleteProhibited — tells the registry to reject requests to delete the domain.
clientRenewProhibited — tells the registry to reject renewal requests.
clientHold — tells the registry not to activate the domain in DNS, so it does not resolve. This is not a security lock and it is regularly mistaken for one.

Most retail registrars expose a single “Domain Lock” or “Transfer Lock” toggle that maps to clientTransferProhibited, and sometimes to clientUpdateProhibited as well. SAC044, ICANN's Security and Stability Advisory Committee guidance for registrants, recommends enabling the transfer prohibition to prevent unauthorized transfers and the update prohibition to block configuration changes.

The registry enforces these flags without exception. It will reject a transfer while clientTransferProhibited is set — and it will accept your registrar's command to remove that flag a second later, no questions asked, because the registrar is authorized to issue that command. The registry owns enforcement; the registrar owns the switch.

What Registry Lock Actually Does

Registry lock is a service sold by the registry operator — the company that runs the whole top-level domain's master database. It freezes the domain in the registry database itself so that no change can be made, not even by your own registrar, until a human at the registry verifies the request out of band.

Mechanically, the registry sets three server-side statuses: serverUpdateProhibited, serverDeleteProhibited and serverTransferProhibited. Verisign's documentation is unambiguous that all three are required: “The word 'server' and 'prohibited' must appear for all three statuses (Update, Delete, Transfer) for the domain name to be registry locked.” A domain carrying one or two of them is not registry locked, whatever it was sold as.

Making a change then runs like this:

An authorized representative at your registrar — a named individual on a list pre-registered with the registry — contacts the registry to request the unlock.
The registry calls that individual back, on a channel separate from the one the request arrived on, and requires an agreed individual security phrase before proceeding.
The registry lifts the relevant statuses, the change is made, and the lock is reapplied.

That out-of-band callback is not friction that came along with the product. It is the product. It moves the final authorization step off the registrar's web console and API entirely, which is precisely where credential theft, leaked API keys and support-desk manipulation do their work.

Locks can also be applied to host objects — the registry's separate record of a nameserver — not just to the domain object. Verisign notes that a domain plus its two nameservers is three separate locks, and that host locking works only for hosts inside Verisign-operated TLDs. This matters more than it sounds: locking only the domain object can leave a glue-record path modifiable in some configurations.

The Comparison, Line by Line

Status codes. Registrar lock sets clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited. Registry lock sets the server equivalents of the same three.
Applied by. Registrar lock, by the sponsoring registrar — the registrar currently holding the domain at the registry. Registry lock, by the registry operator.
Removed by. Registrar lock, by the registrar, instantly, over EPP or from the customer's own control panel. Registry lock, by registry staff only, after out-of-band verification of a named authorized contact.
Cost. Registrar lock is free and usually on by default. Registry lock is a paid registry service; Nominet, for example, publishes an annual per-domain price for its .uk Domain Lock.
Defeated by. Registrar lock falls to registrar account compromise, registrar social engineering, or insider action. Registry lock additionally requires defeating the registry's out-of-band process.
Availability. Registrar lock is near-universal. Registry lock is offered by specific registries — Verisign for .com, .net, .cc and .name; Nominet for .uk — and only through registrars that hold the necessary contract and process.

There is one more asymmetry worth knowing. Registrar lock is not a wall the registrar can hide behind either: ICANN's Transfer Policy requires the registrar to remove clientTransferProhibited or provide the authorization code within five calendar days of the registered name holder's request. It is a lock with a statutory-style release valve. Registry lock has no equivalent clock.

The Difference Only Becomes Visible Under Attack

On a normal day the two locks look identical. Both show up in registration data as prohibitions. Both stop an ordinary unauthorized transfer attempt. The divergence appears at exactly one moment: when the attacker has already got past your registrar.

The publicly reported theft of e-hawk.net makes the point better than any abstraction. In December 2019 attackers contacted the registrar over a messaging app claiming to have bought the domain. The name was moved into a reseller account on 23 December and on to another registrar three days later. The owners did not discover the theft until 13 January 2020, when DNS was changed. The domain had registrar lock. Registrar lock is removable by the registrar, and the registrar had been persuaded to act.

Every registrar-layer control shares that ceiling. Two-factor authentication, a strong password, a transfer lock toggle — all of them are enforced by, or removable by, the same organization an attacker only has to convince once. Registry lock is the only widely available control that puts a second organization, using a different channel, between the attacker and the change.

Adoption does not reflect that. A January 2020 review of Fortune 500 domains found only 22 percent registry locked. In my experience the pattern holds well below the Fortune 500: the companies most exposed to a domain loss are frequently protected by nothing more than a checkbox in a reseller's control panel.

What Registry Lock Does Not Do

It is worth being precise about the boundaries, because registry lock gets sold as a general-purpose safety net and it is not one.

It does not stop expiry. A registry-locked domain still expires if nobody renews it. It still passes through the auto-renew grace period, the 30-day redemption period, and on toward deletion. The lock protects against unauthorized change, not against inattention.
It does not protect DNS resolution. It freezes the registration record — the delegation and the registrar of record. If your DNS hosting account is compromised, the contents of your zone can still be rewritten, and every A and MX record with them.
It does not protect the certificate layer. An attacker who controls your DNS can still obtain a certificate for your name.
It is not instant to work around. Legitimate changes require a phone call during registry business hours. Plan nameserver cutovers and DNS migrations accordingly; no registry I am aware of publishes a response-time commitment for unlock requests.

How to Check Which One You Have

Do not trust the padlock icon. Check the registration record.

Query the domain in RDAP — the structured JSON successor to WHOIS, and since 28 January 2025 the definitive source for gTLD registration data.
Read the status list. Client-prefixed prohibitions mean registrar lock. If you see only clientTransferProhibited, you have the weakest common configuration: transfers are blocked, updates and deletions are not.
For registry lock, confirm that all three of serverUpdateProhibited, serverDeleteProhibited and serverTransferProhibited are present. Anything less is not registry lock, regardless of what the invoice says.
Check the nameserver host objects separately if the registry supports host locking.
Record the result, dated, and re-check it on a schedule. A lock disappearing quietly is one of the earliest indicators of account compromise, and it precedes pendingTransfer rather than following it.

Living With the Friction

Registry lock introduces deliberate delay into a process most teams have learned to treat as instant. The failure modes I see are administrative rather than technical.

The most common one is a stale authorized-contact list. The registry will call a named individual and nobody else. When that individual has left the company, an emergency nameserver change becomes a multi-day identity-proofing exercise conducted under exactly the time pressure the lock was meant to protect you from. Keep at least two named contacts current, and escrow the security phrase somewhere that is not the registrar account it protects.

The second is misplaced confidence. Registry lock secures the registration. It does not secure the registrar account, the DNS provider, the email address receiving registrar notifications, or the certificates issued for your name. Treat it as the one control that holds after everything else has failed — not as a reason to skip the rest.

One caution on policy: recommendations to revise ICANN's Transfer Policy were adopted by the GNSO Council in March 2025 and forwarded to the ICANN Board. Until the Board acts and implementation follows, none of that is in force, and anything written about it should say which version it is describing.

Frequently Asked Questions

Is the “domain lock” in my registrar's control panel a registry lock?

Almost certainly not. In nearly every case that toggle maps to clientTransferProhibited, and sometimes to clientUpdateProhibited as well — client-prefixed statuses your registrar sets and can remove, including at the request of anyone with access to your account. Registry lock is not sold to registrants directly and is not a self-service checkbox; it requires your registrar to hold a contract, an authorized-contact list and an operational process with the registry. If you did not go through that setup, you do not have it.

Can my registrar remove a registry lock if I ask?

Not by itself, and that is the point. A registrar cannot issue a valid EPP command to clear a server-prefixed status, because RFC 5731 reserves those for the server — the registry. Your registrar can start the process: a named, pre-registered individual at the registrar contacts the registry, the registry calls that person back on a separate channel, and an agreed security phrase is required before the lock is lifted. The registrar is a participant in the unlock, never the sole authority for it.

Do I need all three server status codes?

Yes. Verisign's documentation states that the words “server” and “prohibited” must appear for all three statuses — update, delete and transfer — for a domain to be registry locked. Partial application is a genuine failure mode: a domain with serverTransferProhibited alone cannot be transferred away, but its nameservers can still be re-delegated through an ordinary registrar update, which is enough to take over the traffic and the mail without ever moving the registration.

Which registries offer registry lock?

Verisign offers a Registry Lock Service for .com, .net, .cc and .name through participating registrars. Nominet offers an equivalent Domain Lock for .uk, requiring pre-authorized representatives using two-factor authentication for lock and unlock operations. A number of other gTLD and ccTLD operators run comparable services under their own names; confirm any specific one against that operator's own documentation rather than a registrar's marketing page, because the mechanics and the exact status codes vary.

If I have registry lock, do I still need registrar lock?

Keep both. They cost nothing to combine, they are enforced at different layers, and the client-prefixed codes remain useful as a tripwire: if clientTransferProhibited disappears from your registration record while the server codes remain, something changed inside your registrar account that you did not authorize. That is a signal worth having. Server codes take precedence over client codes, so there is no conflict in running both, and no configuration in which the pair is weaker than either alone.

Does registry lock make my domain impossible to steal?

No control makes that claim honestly. Registry lock removes the registrar's web console and API from the attack path for update, delete and transfer, which eliminates the most common vectors. It does not address expiry, DNS-hosting compromise, certificate misissuance, or a determined attack on the registry's own verification process. It also does not help if the authorized-contact list is stale or the security phrase is stored in the account it protects. It raises the floor considerably; it does not close the question.