A registry lock is an extra protection set at the registry, the organisation that runs your top level domain, rather than at your registrar. It blocks transfers, deletions and changes until the registry lifts it. It suits domains whose loss would stop the business, and it is not offered for every domain ending.
Registrar lock versus registry lock
Most domains can carry a registrar lock. In the standard registration status codes published by ICANN, these appear as clientTransferProhibited, clientDeleteProhibited and clientUpdateProhibited. Your registrar sets them, and anyone who gets into your registrar account can usually remove them.
A registry lock uses the server side codes instead: serverTransferProhibited, serverDeleteProhibited and serverUpdateProhibited. ICANN's own explanation notes that some registry operators offer a Registry Lock Service that lets a registrant, through the registrar, set these statuses. It also says removing them takes longer, because the registrar must pass your request to the registry and wait for it to lift the restriction.
That delay is the point. A thief with a stolen registrar password cannot flip the domain in minutes.
| Registrar lock | Registry lock | |
|---|---|---|
| Set by | Your registrar | The registry, on request through the registrar |
| Status codes | client prefixed | server prefixed |
| Removal | Often self service in the account | Slower, involves the registry |
| Availability | Most domains | Depends on the registry operator |
What it protects against
The lock targets three bad outcomes: an unauthorised transfer to another registrar, deletion of the domain, and edits to the registration data such as the nameservers. Changing nameservers is how most hijackings redirect traffic and mail, so the update lock matters as much as the transfer lock.
It does not protect the DNS records inside your zone. If your DNS provider account is compromised, an attacker can still change an A record or an MX record. Pair the lock with strong access control at the DNS host, covered in our post on securing your DNS provider account.
Do you need one?
Ask three questions.
- Would losing this domain for a week stop sales, support or sign in?
- Does mail on this domain receive password resets for other systems?
- Does your ending even offer the service?
If the answer to the first two is yes, ask your registrar whether a registry lock is available for your domain and what the verification steps are. Expect a manual process: named contacts, a phone call back, and a delay when you need an edit.
That friction has a cost. If you change nameservers during a migration, plan the unlock ahead of time. Keep the list of authorised contacts current, since the verification will use it.
Steps to set it up
- Confirm the registry operator for your domain ending supports the service.
- Ask your registrar for the process and the supported contacts.
- Name two authorised people so that one absence does not block you.
- Record the unlock procedure and the expected delay in your runbook.
- Test the process once, on a calm day, so the first use is not an emergency.
- Check the status codes with a registration lookup and confirm the server prefixed ones appear.
Start with the basics in the registrar checklist for startups, because a registry lock does not repair a weak registrar account.
Safeguard works on the software side of supply chain risk: SBOM and dependency scanning, reachability analysis and policy gates. It does not manage registrars or DNS. A free dependency scan is at gold.safeguard.sh/scan.
Quick check
Is a registry lock the same as a transfer lock?
No. A transfer lock is normally set at your registrar and you can remove it yourself. A registry lock is set at the registry and takes a slower, verified process to remove.
Can a registry lock stop someone editing my DNS records?
No. It covers registration data such as transfers, deletion and nameserver updates. Records inside your zone are controlled at your DNS host.
Sources
Last reviewed: 19 October 2026.
