Locking a Domain Against Transfer

What the lock does

A domain can be moved from one registrar to another by anybody with the authorisation code and access to the contact address.

The transfer lock prevents that entirely while it is on, regardless of who has what.

It is a free setting in your registrar account, applied by the registry itself rather than by the registrar's own interface.

Turning it off is a deliberate action taken when you actually want to transfer, and turning it back on afterwards takes a moment.

Why it matters

• A transferred domain is hard to recover.
• The site and email go with it.
• Recovery takes weeks, not days.
• It costs nothing to prevent.
• It is on by default at most registrars.

The third is what makes prevention worth thirty seconds. Getting a domain back after an unauthorised transfer means a dispute process, potentially across two registrars in different countries, while your email does not work.

Check yours in thirty seconds

Which is the whole action.

Log into your registrar, open the domain, and look for a setting called transfer lock, registrar lock, or domain lock.

It should say locked, enabled, or on.

You can also confirm it publicly: a registration lookup shows a status of transfer prohibited when the lock is applied.

Do it for every domain rather than only the main one, since the setting applies per domain rather than per account.

That takes seconds each once you are already logged in.

Newly registered domains and recently transferred ones are much the most likely to be sitting unlocked.

A worked example

A business checked their four domains after reading about a hijacking.

Three were locked, which was the registrar default.

The fourth had been unlocked during a transfer eighteen months earlier and never locked again, which is the standard way this happens.

Relocking it took about ten seconds.

Nothing had gone wrong and nothing was likely to, and it was still worth the two minutes across all four.

They added it to the annual review list so the check repeats.

The lock is not the whole of it

Since it protects one route and not the others.

Somebody with access to your registrar account can simply turn the lock off, so the account itself is the real perimeter.

Two-factor authentication on the registrar account matters more than the lock does, and far fewer people have it.

The email address on the account matters too, since a password reset goes there and whoever controls that address controls the domain.

So the order is: two-factor on the account, a controlled email address, then the lock.

All three of those together take about ten minutes and cover the realistic risks for a small business.

Protect the email address specifically

Which is the weak point people miss.

If your registrar account uses an email address on the domain it protects, a lapsed domain takes the recovery route with it.

Use an address on a different domain, or a free provider, for the registrar account specifically.

That sounds backwards and it is the arrangement that survives the domain itself going wrong.

Whichever address you use, make sure more than one person can reach it.

There is a stronger version

Worth knowing about for a domain the business genuinely depends on.

Some registrars offer a registry-level lock, which requires manual verification with a person before anything can change.

It costs money, takes days to unlock deliberately, and is used by organisations for whom losing the domain would be catastrophic.

For most small businesses that is more than the situation warrants.

For a business whose entire order flow runs through one domain, it is worth asking the price.

Remember to unlock deliberately

Since the lock does what it says.

A planned transfer requires unlocking first, and a locked domain will simply refuse the transfer with an unhelpful error.

That is the intended behaviour and it confuses people every time.

Unlock, transfer, then check the lock is back on at the new registrar, which is the step everybody forgets.

That forgetting is precisely how the unlocked domain in the earlier example came about, and it is the most common reason a lock is missing.

Put it on the same note as the transfer, so it gets closed out rather than left open.

Watch for transfer notices you did not request

Since a lock stops the transfer and does not stop the attempt.

Registrars send a notification when a transfer is requested, and one arriving for a domain you have not touched is worth taking seriously immediately.

The usual explanation is harmless, since a misleading renewal notice from another company is a long-running trick that quietly transfers the domain if you pay it.

Those arrive by post as well as by email, look like invoices, and are legal because the small print says it is a transfer offer rather than a renewal.

Anybody who pays domain bills should know to check every such notice against your actual registrar before paying it.

The counter-case

Unauthorised transfers are rare.

Registrars require confirmation from the contact address, and the realistic risk for a small business is far lower than the coverage suggests.

The lock also gets in the way at the one moment you need it off, and somebody who does not know about it loses an afternoon to a confusing error.

And a compromised registrar account defeats the lock entirely, which is exactly why the account security matters more than the setting does.

Do the two-factor first if you only do one thing this week.

The lock is worth thirty seconds and the account security is worth ten minutes, in that order of value.

Check the lock on every domain, turn on two-factor at the registrar, and use an email address that does not depend on the domain.

The ten minutes

1. Log into the registrar.
2. Check the lock on every domain.
3. Relock any left open.
4. Turn on two-factor.
5. Check the account email address.
6. Use one not on the same domain.
7. Add it to the annual review.

Step six is the one nobody thinks of, since a registrar account reachable only through an address on the domain it protects has no recovery route when that domain is the thing that has gone wrong.

The account security side is covered in locking down the login page.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.