Registry lock: protect your critical domains

Why does domain hijacking matter so much?

Your main domain carries your website, your email and often the login to your customer portal. Whoever controls its DNS controls where all of that goes.

CISA described the pattern in an emergency directive. An attacker gets valid credentials for an account that can change DNS records, then alters records such as A, MX or NS to send traffic to infrastructure they control. Because they control the DNS, they can also obtain valid certificates for the domain, so redirected traffic raises no browser warning.^[4] CISA has since closed that directive, but the attack pattern it describes is still a useful model.^[4]

How do registrar and registry locks differ?

Domain status is expressed through EPP status codes, and there are two families. Client codes are set by your registrar. Server codes "are set by registries, and they take precedence over client codes".^[1]

• Registrar lock. Set by your registrar with the client codes clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited. Anyone with control of your registrar account can lift it.
• Registry lock. Set by the registry with the server codes serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited. Only the registry can lift it, after its own verification.

ICANN describes clientTransferProhibited as telling the registry to "reject requests to transfer the domain", and serverUpdateProhibited as locking the domain to prevent it "from being updated".^[1] The difference is in who can switch them off. A registrar lock lives in the same account an attacker would take over. A registry lock does not.

How does a registry lock work in practice?

The process depends on the registry. Verisign describes its Registry Lock service for .com, .net, .cc and .name.^[2] To change a locked domain, an authorized person at the registrar asks Verisign to lift the lock, and Verisign calls that person, who must provide "an individual security phrase" before the change proceeds.^[2]

Two details are easy to miss:

• Host records. Verisign lets you lock the name server host records as well as the domain, and calls this "critical in stopping attacks" that try to change where resolution happens.^[2]
• Access route. The service is available "through participating domain name registrars".^[2] Not every registrar offers it, and other registries run their own versions, so check each ending you rely on.

Which domains should get a registry lock?

Not every domain needs one. A registry lock adds a manual step to every change, so keep it for the domains where a hijack would hurt most:

• The domain that carries your corporate email.
• Domains behind customer logins, payments or APIs.
• Your main brand domain and any domain printed on invoices.

Parked, campaign and defensive domains usually do well with a registrar lock, auto-renew and MFA on the account. Our guide to typosquatting protection covers how to build the inventory that this decision depends on.

How do transfer rules interact with locks?

ICANN's Transfer Policy sets the baseline for moving a domain between registrars. In the version contracted parties had to implement by 21 August 2025, a registrar may deny a transfer requested within 60 days of the domain's creation or of a previous transfer.^[3] Registrars must give the holder a unique AuthInfo code on request and remove clientTransferProhibited within five calendar days if they do not offer self-service.^[3] After a change of registrant, the registrar must impose a 60-day transfer lock unless the holder opted out beforehand.^[3]

These rules make transfers harder, but they still assume the account holder is genuine. That is the case a registry lock covers: a request that looks legitimate because it came from a compromised account.

What does a registry lock not protect?

A registry lock guards the registration and its delegation. It does not cover changes inside your DNS zone at the DNS host. If someone signs in to your DNS provider, they can still edit records.

The rest of the defense sits around it:

1. Account security. CISA's directive asked agencies to update passwords and "implement multi-factor authentication" on every account that can change DNS records.^[4] Phishing-resistant sign-in, covered in our guide to passkeys and WebAuthn, is stronger still.
2. Monitoring. The same directive asked agencies to audit public DNS records and to monitor Certificate Transparency logs "for certificates issued that they did not request".^[4]
3. Signed answers. DNSSEC provides "origin authentication and integrity protection for DNS data".^[5] It protects answers in transit, not the account that manages them. Our corporate DNS security guide covers how it fits with SPF, DKIM and DMARC.
4. Dangling records. Old subdomains that point at resources you no longer hold are a separate risk; see subdomain takeover.

How do you plan changes under a lock?

Write the release process down before you need it. Name who may ask to lift the lock, how the registrar verifies them and how long the round trip takes with your registrar. Plan name server or registrar moves as scheduled changes, not emergency ones.

If a domain is hijacked, recovery and incident response belong with your registrar, the registry and a specialist firm or counsel you contract with. Our domain security service covers lock status, inventory and account hygiene as part of our digital asset security work.