--- id: "registry-lock" kind: "glossary-term" title: "registry lock" language: "en" category: "Transfers and EPP" updated: "2026-10-10T10:28:55Z" canonical: "https://tldlog.com/glossary/registry-lock/" translations: es: "https://tldlog.com/es/glosario/bloqueo-registro/" de: "https://tldlog.com/de/glossar/registry-lock/" fr: "https://tldlog.com/fr/glossaire/verrouillage-registre/" it: "https://tldlog.com/it/glossario/registry-lock/" pt-BR: "https://tldlog.com/pt/glossario/bloqueio-registro/" ru: "https://tldlog.com/ru/glossariy/blokirovka-urovne-registratury/" zh-Hans: "https://tldlog.com/zh/cihui/zhuce-guanli-jigou-suoding/" --- # registry lock An optional service, offered by some registries through registrars, that sets server statuses to block transfers, updates or deletion. Removing it needs a manual, verified process. It protects high-value domains against hijacking, even if a registrar account is compromised. Registry lock is an extra layer of protection for a domain name. The registry, the organization that runs the top-level domain, freezes the domain so that it cannot be transferred, changed or deleted through the usual automated system. To make any change, a person at the registrar must ask the registry, which checks the request before it lifts the lock. ## What registry lock is Every domain carries EPP status codes that say which actions are blocked. Codes that start with "client" are set by the registrar. Codes that start with "server" are set by the registry, and they take precedence. The EPP standard for domain names, RFC 5731, says a registrar must not alter a status set by the registry. Registry lock uses three server codes, alone or together: - serverUpdateProhibited: requests to update the domain, such as its name servers or contacts, are rejected. - serverDeleteProhibited: requests to delete the domain are rejected. - serverTransferProhibited: requests to transfer the domain to another registrar are rejected. Some registries also lock host objects, so that the name servers a domain depends on are not changed or deleted by mistake. The registry sets or removes these statuses at the request of an authorized representative of the registrar. In gTLDs, Verisign, the registry for .com and .net, introduced the service after registrars asked it to protect their customers' most valuable names. Verisign ran a beta in the fourth quarter of 2008, asked ICANN for approval through the RSEP in June 2009, and ICANN approved it. Since 2019, ICANN has listed registry lock as a service gTLD registries can request through a simplified fast-track process, if they follow the standard model. ## How it differs from a registrar lock A registrar lock uses client codes, such as clientTransferProhibited. The registrar sets and removes it, and the registrant can often switch it off in the account. ICANN tells registrants who cannot unlock a gTLD domain themselves to ask their registrar, and to file a transfer complaint if the registrar does not unlock it or offer a reasonable way to do so within five days (as of October 2026). A registry lock works one level higher. Because the registrar cannot remove a server code with a normal command, someone who gets into the registrant's account cannot simply turn the lock off there. Removal goes through a separate, manual check at the registry. This makes it harder to hijack a domain, though no lock makes hijacking impossible. The difference also shows in ccTLD services. EURid, the registry for .eu, says registry lock always overrides its registrar lock and the two cannot be used at the same time. A .eu name with only a registrar lock can still be transferred with an authorisation code (as of October 2026). The trade-off is speed. ICANN notes that removing a server code can take longer than removing a client code, because the registrar must forward the request to the registry and wait. ## How changes are made while it is on In the model Verisign described in 2009, and Public Interest Registry (PIR) for .org in 2014: 1. An authorized person at the registrar asks the registry to remove a specific server status. 2. The registry validates that person. 3. The registry removes the status. 4. The registrar makes the change. 5. The authorized person asks the registry to set the status again. This happens outside the automated system, with independent checks by registry staff. DENIC, the registry for .de, uses its own process. The registrant asks its registrar for the lock, provides proof of identity and names a lock contact. For each change request, DENIC sends a token to the lock contact's mobile phone and an email to the address on file. The change goes ahead only when the lock contact confirms it with the token; without confirmation within seven calendar days, the request is rejected (as of October 2026). A worked example: the registrant of example.com wants new name servers while registry lock is on. It asks its registrar. An authorized person at the registrar asks the registry to remove serverUpdateProhibited; the registry validates that person and removes the status; the registrar makes the change; then the authorized person asks for the status to be set again. Until the status is removed, any update sent through the normal system is rejected. ## Which TLDs and registrars offer it, and what it costs Registry lock is optional. Many gTLDs and some ccTLDs offer it. As of October 2026, ICANN's table of RSEP requests lists 48 registry lock requests from 2009 to 2026, most of them approved, covering for example .com, .net and .org, and brand TLDs. Among ccTLDs, DENIC and EURid offer their own versions. Not every registrar offers it. DENIC and EURid both tell registrants to ask their registrar. Registries charge registrars for the service, and the registrant pays whatever its registrar charges. Prices vary, and no current price is given here. As historic examples only, the proposals Verisign filed in 2009 and PIR in 2014 gave wholesale tiers from 100 USD per domain per year (for 1 to 99 names) down to 50 USD. Public comments on Verisign's request raised concerns about pricing. ## Who needs it Registries describe the service as meant for high-profile or valuable names, essential to business continuity or brand protection. DENIC names companies, brands and public authorities as attractive targets. Registry lock blocks changes at the registry: name servers, contacts, transfer and deletion. It does not protect DNS records hosted with a DNS provider, which are managed elsewhere. Changes also need planning, because they take longer. Whether it fits a given domain is a question for the registrar or registry. ## Sources - [EPP Status Codes | What Do They Mean, and Why Should I Know?](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) - [ICANN Registry Request Service: Registry Lock Service - com/net (VeriSign RSEP request)](https://itp.cdn.icann.org/en/files/consensus-policy/verisign-reglock-request-25jun09-en.pdf) - [Fast Track RSEP Process](https://www.icann.org/en/contracted-parties/registry-operators/services/rsep-process/fast-track-rsep-process) - [.de Registry Lock: Protection Against Domain Hijacking](https://www.denic.de/en/products/de-registry-lock/) - [Secure your domain name (EURid)](https://eurid.eu/en/manage-your-eu/secure-your-domain-name/) ## related terms - [registrar lock](https://tldlog.com/glossary/registrar-lock/) - [domain hijacking](https://tldlog.com/glossary/domain-hijacking/) - [EPP status codes](https://tldlog.com/glossary/epp-status-codes/) - [DNS hijacking](https://tldlog.com/glossary/dns-hijacking/)