What is Registry lock? Definition and meaning
Registry lock is a status applied at the registry level – above the registrar – that prevents any change to a domain's registration data, including transfer, deletion, or nameserver modification, until the lock is explicitly lifted through a verified, out-of-band authorization process.
Registry lock sits one layer above the more familiar registrar lock. It requires direct coordination between the registrar and the domain registry operator, typically involving a telephone callback or cryptographic token to a pre-authorized contact. No automated or web-based request can override it. The result is a domain that is effectively frozen at the registry level, giving the registrant the strongest available protection against unauthorized transfer or hijacking.
If your domain stopped resolving overnight and the registration record changed without your consent, the absence of a registry lock is very often a contributing factor. That loss of control is preventable.
What registry lock is – and what it is not
Registry lock is a registry-level status code that blocks all lifecycle operations on a domain: transfer out, deletion, nameserver change, registrant update, and sponsoring-registrar change. None of those operations can proceed while the lock is active, because the registry itself – not only the registrar – must authorize any change.
The term readers most often confuse it with is registrar lock (also called "transfer lock" or the EPP status clientTransferProhibited). Registrar lock is weaker. It lives at the registrar level and can be lifted by anyone with access to the registrar account – a stolen password, a social-engineering call to customer support, or a compromised email address is enough. Registry lock is different in kind, not just degree. It lives at the registry and requires a separate, out-of-band verification step that an attacker cannot satisfy through the registrar's normal interface.
Registry lock is therefore not a product name, not a premium plan, and not interchangeable with the EPP status clientTransferProhibited. It corresponds to the EPP status codes serverTransferProhibited, serverUpdateProhibited, and serverDeleteProhibited – applied at the registry's instruction, not the registrant's.
Where registry lock comes from in the rules
Domain lifecycle statuses are defined within the Extensible Provisioning Protocol, the technical standard that governs how registrars communicate with registry operators for gTLDs under ICANN's system. The UDRP and the Uniform Rapid Suspension procedure both interact with the lock: when a UDRP panel orders a transfer, the registrar implements it, but a domain under registry lock requires the registry's cooperation before the registrar can act. This is rarely a problem in ordinary dispute cases but matters when speed is critical after a theft event.
For ccTLDs, the registry lock equivalent varies by operator. Some national registries offer an analogous service; others do not. The .uk registry (Nominet) and several European registries provide formal lock services, though the procedural details differ from the gTLD model. Confirming availability with counsel for a specific zone is always the correct step.
How registry lock plays out in practice
Three patterns recur in our practice.
Pattern 1 – the prevented hijack. A registrant holding a high-value .com brand activates registry lock at their registrar's request. Months later, an attacker gains access to the registrar account, generates a transfer authorization code, and submits a transfer request to a receiving registrar. The request fails. The registry rejects it because no out-of-band authorization was completed. The domain stays put. The registrant learns of the attempt only from the registrar's security alert.
Pattern 2 – the post-theft discovery. A registrant did not activate registry lock. An attacker uses a phishing email to compromise the registrar account, updates the nameservers, and initiates a transfer. By the time the registrant notices the domain is resolving to a stranger's page, the transfer has completed to a different registrar. At that point, recovery requires registrar escalation, a potential court order, and – if the receiving registrar is in a different jurisdiction – coordination with local litigation counsel. The absence of registry lock turned a preventable event into a multi-jurisdictional recovery matter.
Pattern 3 – the pre-filing precaution. A brand owner is about to file a UDRP complaint against a registrant who has shown awareness that a dispute is coming. The registrant's own domain is not the target. Rather, the brand owner's registered domain – the one they have operated for years – is at risk of a retaliatory transfer to a privacy-shield registrar. Activating registry lock before filing removes that risk. The domain cannot be moved while the dispute is live.
Why registry lock matters to brand owners and registrants
Domain theft is not theoretical. ICANN's Registration Data Access Protocol (RDAP) replaced the older WHOIS system as the standard public lookup tool as of January 2025, and registration data for individuals is now redacted by default under data-protection rules. That opacity cuts both ways: it protects legitimate registrants, but it also makes it harder to identify a hijacker quickly after a theft. The window between a successful attack and a completed transfer can be hours. Registry lock eliminates that window entirely, because no automated channel can defeat the out-of-band verification requirement.
For a brand owner who relies on a domain for commerce or communications, the downstream consequences of even a brief loss of control – email interception, customer misdirection, credential phishing – can exceed the direct cost of any domain dispute. Registry lock is the one control that addresses the risk at its source.
Not every registrar offers the service. Premium and enterprise-tier registrars typically do; budget registrars generally do not. Verifying whether your registrar supports registry lock, and activating it for any domain critical to business operations, is a step we raise in every domain due-diligence engagement we handle.
COGNOMEN handles court action and domain theft recovery exclusively across gTLDs and ccTLDs. To assess a theft event or plan a preventive lock strategy, contact info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
What is registry lock?
Registry lock is a domain status applied at the registry level – not the registrar level – that blocks all lifecycle changes to a domain, including transfer, deletion, nameserver modification, and registrant updates. It corresponds to the EPP server-side status codes serverTransferProhibited, serverUpdateProhibited, and serverDeleteProhibited. Lifting the lock requires out-of-band verification between the registrar and the registry, so no web-based or automated request can override it.
How is registry lock proven or established?
A registrant requests registry lock through a registrar that supports the service. The registrar coordinates directly with the registry operator to set the server-side EPP status codes. Proof that the lock is active appears in the domain's RDAP or WHOIS record, which will show the relevant serverProhibited statuses. Removal requires a verified callback or token exchange that both the registrar and registry must complete – there is no self-service path for an attacker to bypass that process.
Why does registry lock matter to my domain?
Registrar-level lock – the default "transfer lock" most registrars apply – can be defeated by anyone who gains access to the registrar account. Registry lock cannot be defeated through the registrar's interface at all. For any domain critical to business operations, email, or commerce, the distinction is material: a successful account compromise that bypasses registrar lock can move a domain in hours, while registry lock stops the transfer regardless of what happens at the account level.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.