What Is Registry Lock, and How Is It Different from Registrar Lock?

Most domain owners have heard that they should "turn on the domain lock" in their registrar dashboard. That toggle is useful, but it has a built-in weakness: whoever can log into your registrar account can switch it off again. For the handful of domains that your business genuinely cannot afford to lose, there is a stronger control that sits one level higher in the domain system: registry lock. This article explains how registry lock works operationally, how it differs from the ordinary registrar lock, how the out-of-band verification process works, which registries and registrars offer it, what it tends to cost, and how to request it. For the EPP status codes themselves, see the companion article on what registrar lock is and why you should enable it, which covers every status in detail.

Registrar Lock vs Registry Lock in One Sentence Each

• Registrar lock is a set of client* statuses that your registrar places on your domain and that your registrar can remove instantly, usually when you click a toggle.
• Registry lock is a set of server* statuses that the registry places on your domain and that can only be removed through a manual, authenticated process involving people at both your registrar and the registry.

To see why the second one matters, it helps to recall who does what. The registry operates the TLD and holds the authoritative database, the registrar sells you the domain and talks to the registry over EPP, and you are the registrant. If those roles are fuzzy, registry vs registrar explains the split.

The Weakness Registry Lock Fixes

Registrar lock blocks transfers and, if clientUpdateProhibited is set, changes to name servers. But every one of those protections can be undone by anyone who can act as you at the registrar:

• An attacker who phishes your registrar password and bypasses or lacks a second factor.
• An attacker who socially engineers registrar support into resetting your account or changing your email.
• A compromised reseller or registrar system, where the attacker gains access to the registrar's own EPP connection.
• A malicious or careless insider with access to your registrar account.

In each case the attacker removes the client lock, changes the name servers or initiates a transfer, and the registry accepts the change because, from its point of view, a legitimate registrar sent a valid EPP command. This is the pattern behind many high-profile domain hijacking and DNS tampering incidents, including the campaigns that led the US Cybersecurity and Infrastructure Security Agency (CISA) to issue Emergency Directive 19-01 in 2019.

Registry lock breaks this chain. Even if an attacker has full control of your registrar account, and even if they can send EPP commands through the registrar, the registry refuses to change a domain carrying serverUpdateProhibited, serverTransferProhibited, and serverDeleteProhibited. Registrars cannot remove server* statuses over EPP at all.

How Registry Lock Works Operationally

The details differ between registries, but most registry lock services follow the same pattern.

1. Enrollment

Your registrar enrolls the domain in the registry's lock service. As part of setup, you and your registrar agree on:

• Authorized contacts: a short list of named people at your organization who are allowed to request unlocks.
• Verification credentials: typically a passphrase, PIN, or security question set for each authorized contact, plus confirmed phone numbers.
• Which statuses to apply: usually all three of serverUpdateProhibited, serverTransferProhibited, and serverDeleteProhibited.

On the registry side, the registrar similarly designates its own authorized staff who are allowed to request lock changes from the registry, again with separate credentials.

2. The Lock Is Applied

The registry sets the server* statuses directly in its database. From that moment, any EPP update, transfer, or delete command for the domain is rejected with a status-prohibits-operation error, no matter which registrar account it comes from.

3. Requesting an Unlock

When you need to make a legitimate change, such as moving to new name servers or updating DNSSEC DS records, the process usually looks like this:

1. An authorized contact at your organization contacts the registrar through the agreed channel and asks for an unlock of a specific domain, for a specific purpose.
2. The registrar verifies the requester out of band, for example by calling back a pre-registered phone number and asking for the passphrase. Some registrars require two authorized contacts to approve.
3. The registrar's authorized staff contact the registry through the registry's own authenticated channel and request removal of the server* statuses.
4. The registry verifies the registrar's representative, again with separate credentials, and removes the statuses.
5. You or your registrar make the change through the normal EPP path.
6. The lock is reapplied, either on request or automatically after a defined window, depending on the service.

The key idea is out-of-band verification. Nothing in the unlock path can be completed purely by logging into a website or sending an API call. A person has to verify another person through a channel that is separate from the systems an attacker is most likely to have compromised.

4. Time Cost

Because people are involved, unlocks are not instant. Depending on the registrar and registry, an unlock can take anywhere from under an hour to a business day, and some services only process requests during business hours. That delay is a feature, not a bug, but it does mean you must plan changes in advance.

What Registry Lock Does Not Block

Registry lock protects the registration, not your zone content. It does not stop someone from editing A, MX, or TXT records at your DNS host, because those records live on your DNS provider's servers, not at the registry. If your DNS hosting account is compromised, registry lock will not help. Protect that account just as carefully, because DNS-level hijacking is a separate threat that registry lock does not address.

Registry lock also does not prevent the domain from expiring. A locked domain still needs to be renewed. Many enterprise registrars combine registry lock with long registration terms and auto-renewal.

Side-by-Side Comparison

Aspect	Registrar lock	Registry lock
Statuses used	client* (for example clientTransferProhibited)	server* (for example serverTransferProhibited)
Who sets them	Your registrar	The registry, at your registrar's request
How to remove	Dashboard toggle or registrar API	Manual, authenticated, out-of-band process
Time to remove	Seconds	Typically hours, sometimes a business day
Survives registrar account takeover	No	Yes
Survives compromised registrar systems	No	Generally yes
Cost	Usually free	Usually an extra fee, often annual and per domain
Availability	Almost every registrar and TLD	Only some registrars, and only TLDs whose registry offers it
Best for	Every domain you own	Critical domains: brand, email, login, payments

Which Registries and Registrars Offer It?

Registries. Many large registries operate a registry lock service. Verisign offers one for .com and .net, and a large number of other gTLD and ccTLD registries offer their own versions, sometimes under different names. Some ccTLD registries implement locking with their own mechanisms rather than EPP server* statuses. Availability changes over time, so treat any list as a starting point and confirm with your registrar for each TLD you care about.

Registrars. Registry lock is only available to you through a registrar that has signed up for the registry's service. In practice it is most commonly offered by:

• Corporate and brand-protection registrars, which often bundle it into managed domain portfolios.
• Some large retail registrars, often as a paid add-on or on business or enterprise tiers.
• Some infrastructure providers' registrar services, typically on enterprise plans.

If your current registrar does not offer registry lock for a TLD you need, you may have to transfer the domain to another registrar that does. Do this well before you need the protection, because transfers themselves take time and require removing the existing locks.

What Does Registry Lock Cost?

There is no standard price. The cost has two components: the registry's fee charged to the registrar, and the registrar's markup and service cost. Pricing models vary:

• A one-time setup fee plus an annual fee per domain.
• An annual fee only, sometimes bundled into a corporate domain management contract.
• Per-unlock fees in some arrangements, especially where unlocks require manual work.

As a rough guide, expect registry lock to cost noticeably more than the domain registration itself, often tens to a few hundred US dollars per domain per year at retail, and sometimes more in enterprise contracts. Ask for written pricing before enrolling, including whether unlock requests are charged separately.

Who Actually Needs Registry Lock?

Registry lock is not for every domain. The extra cost and friction are justified when losing control of a domain, even for a few hours, would cause severe harm. Good candidates:

• Your primary brand domain and the domain your main website runs on.
• Domains that handle corporate email, because a hijacker can intercept password resets and impersonate staff.
• Domains used for authentication, SSO, or APIs that customers or partners depend on.
• Domains used for payments or financial transactions.
• Government, healthcare, and critical infrastructure domains.
• High-value premium domains held as investments.

For a personal blog, a parked domain, or a short-term campaign site, a registrar lock plus strong account security is usually enough. Securing the registrar account itself is covered in how to secure your domain registrar account with 2FA.

How to Request Registry Lock

1. Inventory your critical domains. List each domain, its TLD, current registrar, and what depends on it.
2. Check TLD support. Ask your registrar whether the registry for each TLD offers registry lock, and whether the registrar participates.
3. Choose authorized contacts. Pick at least two people, ideally in different roles, who can approve unlocks. Avoid relying on a single person who might leave or be unreachable.
4. Set strong verification details. Use passphrases that are not discoverable from social media or public records, and store them in a password manager or secure vault.
5. Finalize DNS before locking. Set your name servers and DNSSEC DS records first, so you do not need an unlock the day after enrollment.
6. Enroll and confirm. Once the registrar reports the lock is in place, verify it yourself with RDAP or WHOIS.
7. Document the unlock procedure. Write a short runbook covering who to call, what to say, and how long it takes, and test it once in a planned maintenance window.

How to Verify Registry Lock Is Active

Registry lock shows up as server* statuses in WHOIS and as server ... prohibited values in RDAP:

whois example.com | grep -i "domain status"

A domain with both registrar lock and registry lock typically shows something like this:

Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

Be aware that registries also apply server* statuses for other reasons, such as during a UDRP proceeding or a court order. Seeing them does not by itself prove you are enrolled in a paid registry lock service, so confirm with your registrar.

Monitoring Script

Registry lock should never disappear without a planned change. This Python script, using only the standard library, checks your critical domains via RDAP and exits with a non-zero code if any of them is missing a required server status or has unexpected name servers. Run it from cron or a CI job and alert on failure.

import json
import sys
import urllib.request

EXPECTED = {
    "example.com": {"ns1.example-dns.net", "ns2.example-dns.net"},
    "example.org": {"ns1.example-dns.net", "ns2.example-dns.net"},
}
REQUIRED = {
    "server update prohibited",
    "server transfer prohibited",
    "server delete prohibited",
}


def rdap(domain):
    req = urllib.request.Request(
        f"https://rdap.org/domain/{domain}",
        headers={"Accept": "application/rdap+json"},
    )
    with urllib.request.urlopen(req, timeout=20) as resp:
        return json.load(resp)


problems = []
for domain, expected_ns in EXPECTED.items():
    try:
        data = rdap(domain)
    except Exception as exc:
        problems.append(f"{domain}: RDAP lookup failed ({exc})")
        continue

    statuses = {s.lower() for s in data.get("status", [])}
    missing = REQUIRED - statuses
    if missing:
        problems.append(f"{domain}: missing {', '.join(sorted(missing))}")

    ns = {n["ldhName"].lower().rstrip(".") for n in data.get("nameservers", [])}
    if ns != expected_ns:
        problems.append(f"{domain}: name servers changed to {', '.join(sorted(ns))}")

if problems:
    print("\n".join(problems))
    sys.exit(1)
print("All registry locks and name servers look correct.")

You can also add a quick live DNS check to catch a delegation change at the TLD servers. For .com, ask a Verisign gTLD server directly:

dig +norec NS example.com @a.gtld-servers.net

The authority section should list exactly the name servers you expect.

Common Mistakes

• Locking before finalizing DNS. Every change afterwards costs an unlock cycle.
• Only one authorized contact. If that person leaves, recovering unlock authority can be slow.
• Forgetting DNSSEC. Key rollovers that change DS records at the registry need an unlock. Plan them. See what DNSSEC is for how DS records fit in.
• Treating registry lock as a replacement for account security. An attacker in your registrar account can still disable auto-renew, change contacts on some TLDs, or socially engineer support. Keep strong MFA everywhere.
• Assuming all TLDs are covered. A brand might be locked in .com but wide open in its ccTLD.

---

Registry Lock FAQ

Conclusion

Registrar lock and registry lock look similar in a WHOIS lookup, but they protect against very different threats. Registrar lock stops opportunistic transfers and is free, so it belongs on every domain. Registry lock moves the controls up to the registry and makes every unlock depend on human, out-of-band verification, which means a stolen password, a hijacked registrar account, or a compromised reseller is no longer enough to take over your domain.

The trade-off is cost and friction, so reserve registry lock for the domains that carry your brand, email, logins, and payments. Enroll them deliberately, document the unlock process, monitor the server statuses continuously, and keep the registrar account itself locked down. Done together, those steps make your most important domains about as hard to hijack as a domain can be.

Here are some useful references for going deeper on registry lock:

1. ICANN: EPP Status Codes: What Do They Mean, and Why Should I Know? — definitions of every client and server status, including the server prohibitions used by registry lock.
2. RFC 5731: EPP Domain Name Mapping — the specification that defines server and client status values and who may set them.
3. RFC 8056: EPP and RDAP Status Mapping — how EPP statuses appear in RDAP JSON responses.
4. CISA: Emergency Directive 19-01: Mitigate DNS Infrastructure Tampering — the US government directive prompted by registrar-level DNS hijacking campaigns.
5. ICANN SSAC: SAC040: Measures to Protect Domain Registration Services Against Exploitation or Misuse — the advisory that discusses registry-level locking among other registration security measures.