tldlog.com

domain name news

registry lock

An optional service, offered by some registry The central database and system of a top-level domain, or loosely the organization that runs it. Full definition through registrar A company that registers domain names for customers with the registry. Full definition, that sets server statuses to block transfers, updates or deletion Removing a domain registration from the registry, which starts the path to its release. Full definition. Removing it needs a manual, verified process. It protects high-value domains against hijacking, even if a registrar account is compromised.

category
Transfers and EPP

Updated on 4 min read

Registry lock is an extra layer of protection for a domain name A readable internet name made of labels separated by dots. Full definition. The registry, the organization that runs the top-level domain, freezes the domain so that it cannot be transferred, changed or deleted through the usual automated system. To make any change, a person at the registrar must ask the registry, which checks the request before it lifts the lock.

What registry lock is

Every domain carries EPP status codes Standard labels showing a domain's state and what actions are blocked. Full definition that say which actions are blocked. Codes that start with “client” are set by the registrar. Codes that start with “server” are set by the registry, and they take precedence. The EPP Extensible Provisioning Protocol The protocol registrars use to manage domain names at registries. Full definition standard for domain names, RFC Request for Comments A numbered document in the series recording the internet's technical standards and practices. Full definition 5731, says a registrar must not alter a status set by the registry.

Registry lock uses three server codes, alone or together:

  • serverUpdateProhibited Registry-set status code that blocks changes to the domain's data. Full definition: requests to update the domain, such as its name server A server that holds a domain's DNS records and answers lookups. Full definition or contacts, are rejected.
  • serverDeleteProhibited Registry-set status code that blocks deletion of the domain. Full definition: requests to delete the domain are rejected.
  • serverTransferProhibited Registry-set status code that blocks transfer of the domain to another registrar. Full definition: requests to transfer the domain to another registrar are rejected.

Some registries also lock host object The registry's record of a name server that domains can be linked to. Full definition, so that the name servers a domain depends on are not changed or deleted by mistake.

The registry sets or removes these statuses at the request of an authorized representative of the registrar.

In gTLD generic top-level domain A top-level domain not tied to a country, run under ICANN contracts. Full definition, Verisign The company that operates the .com and .net registries. Full definition, the registry for .com and .net, introduced the service after registrars asked it to protect their customers’ most valuable names. Verisign ran a beta in the fourth quarter of 2008, asked ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition for approval through the RSEP Registry Services Evaluation Policy ICANN's process for approving new or changed services at a gTLD registry. Full definition in June 2009, and ICANN approved it. Since 2019, ICANN has listed registry lock as a service gTLD registries can request through a simplified fast-track process, if they follow the standard model.

How it differs from a registrar lock

A registrar lock A registrar-set lock that blocks transfers until the owner removes it. Full definition uses client codes, such as clientTransferProhibited A registrar status that blocks transfers to another registrar. Full definition. The registrar sets and removes it, and the registrant The person or organization that holds a domain name registration. Full definition can often switch it off in the account. ICANN tells registrants who cannot unlock a gTLD domain themselves to ask their registrar, and to file a transfer complaint if the registrar does not unlock it or offer a reasonable way to do so within five days (as of October 2026).

A registry lock works one level higher. Because the registrar cannot remove a server code with a normal command, someone who gets into the registrant’s account cannot simply turn the lock off there. Removal goes through a separate, manual check at the registry. This makes it harder to hijack a domain, though no lock makes hijacking impossible.

The difference also shows in ccTLD country code top-level domain A top-level domain for a country or territory, usually two letters long. Full definition services. EURid The nonprofit registry that runs .eu under contract with the European Commission. Full definition, the registry for .eu, says registry lock always overrides its registrar lock and the two cannot be used at the same time. A .eu name with only a registrar lock can still be transferred with an authorisation code (as of October 2026).

The trade-off is speed. ICANN notes that removing a server code can take longer than removing a client code, because the registrar must forward the request to the registry and wait.

How changes are made while it is on

In the model Verisign described in 2009, and PIR Public Interest Registry The nonprofit registry operator of .org. Full definition (PIR) for .org in 2014:

  1. An authorized person at the registrar asks the registry to remove a specific server status.
  2. The registry validates that person.
  3. The registry removes the status.
  4. The registrar makes the change.
  5. The authorized person asks the registry to set the status again.

This happens outside the automated system, with independent checks by registry staff.

DENIC Deutsches Network Information Center The Frankfurt-based cooperative that runs Germany's .de domain. Full definition, the registry for .de, uses its own process. The registrant asks its registrar for the lock, provides proof of identity and names a lock contact. For each change request, DENIC sends a token to the lock contact’s mobile phone and an email to the address on file. The change goes ahead only when the lock contact confirms it with the token; without confirmation within seven calendar days, the request is rejected (as of October 2026).

A worked example: the registrant of example.com wants new name servers while registry lock is on. It asks its registrar. An authorized person at the registrar asks the registry to remove serverUpdateProhibited; the registry validates that person and removes the status; the registrar makes the change; then the authorized person asks for the status to be set again. Until the status is removed, any update sent through the normal system is rejected.

Which TLDs and registrars offer it, and what it costs

Registry lock is optional. Many gTLDs and some ccTLDs offer it. As of October 2026, ICANN’s table of RSEP requests lists 48 registry lock requests from 2009 to 2026, most of them approved, covering for example .com, .net and .org, and .brand A top-level domain that a company runs for its own trademark. Full definition. Among ccTLDs, DENIC and EURid offer their own versions.

Not every registrar offers it. DENIC and EURid both tell registrants to ask their registrar.

Registries charge registrars for the service, and the registrant pays whatever its registrar charges. Prices vary, and no current price is given here. As historic examples only, the proposals Verisign filed in 2009 and PIR in 2014 gave wholesale tiers from 100 USD per domain per year (for 1 to 99 names) down to 50 USD. public comment An open period when anyone can comment on ICANN drafts. Full definition on Verisign’s request raised concerns about pricing.

Who needs it

Registries describe the service as meant for high-profile or valuable names, essential to business continuity or brand protection The work of keeping a brand safe from misuse in domain names. Full definition. DENIC names companies, brands and public authorities as attractive targets.

Registry lock blocks changes at the registry: name servers, contacts, transfer and deletion. It does not protect DNS record One entry in a DNS zone, made of a name, a type, a TTL and data. Full definition hosted with a DNS provider A company that runs the name servers for a domain, which may differ from the registrar. Full definition, which are managed elsewhere. Changes also need planning, because they take longer. Whether it fits a given domain is a question for the registrar or registry.

Sources

related terms