Registrar lock is the single setting that stands between a stolen domain and a routine Tuesday, yet most IT teams have never checked whether theirs is actually enabled. Domain hijacking rarely starts with a sophisticated DNS exploit — it starts with a social engineering call to a registrar’s support desk, and registrar lock settings determine whether that call succeeds or gets rejected outright.
This matters more than most security checklists suggest, because domain recovery after a hijack can take anywhere from 48 hours to several months, depending on the registrar, the TLD, and whether ICANN’s Transfer Dispute Resolution Policy has to get involved.
What registrar lock actually does
Registrar lock — sometimes labeled clientTransferProhibited in WHOIS output — is a status code that blocks unauthorized transfers of a domain to another registrar. When it’s active, anyone attempting to move the domain, even with valid-looking credentials, hits a wall until the lock is manually removed by an authorized account holder.
There are actually several related lock statuses worth knowing:
clientTransferProhibited blocks outbound transfers to another registrar. clientUpdateProhibited blocks changes to the domain’s contact and nameserver records. clientDeleteProhibited prevents accidental or malicious deletion. GoDaddy, Namecheap, and Cloudflare Registrar all expose these as toggles in the account dashboard, though the exact wording varies — Cloudflare calls it “Transfer Lock” and enables it by default on every domain registered through their platform.
The myth worth busting here: many admins assume registrar lock protects against DNS record tampering. It doesn’t. A locked domain can still have its A records, MX records, or nameservers changed by anyone with valid access to the registrar account or the DNS management panel. Lock settings stop the domain from leaving your registrar — they do nothing to stop someone already inside your account from repointing dns.yourcompany.com to an attacker-controlled server. That’s a separate attack surface entirely, and it’s why compromised registrar accounts remain one of the most damaging entry points even on fully locked domains.
Why the lock alone isn’t enough
Registry lock versus registrar lockThese get conflated constantly, and the distinction matters during an actual incident. Registrar lock is a setting you control through your registrar’s dashboard — it can be toggled by anyone with account access, including an attacker who has compromised that account.
Registry lock sits one level higher, at the domain registry itself (Verisign for .com and .net, Public Interest Registry for .org). Removing a registry lock typically requires out-of-band verification — a phone call to a pre-authorized contact, sometimes a notarized request. MarkMonitor, CSC Corporate Domains, and Verisign’s own registry lock service are the common providers, and they’re built specifically for domains where a hijack would cause material business damage: primary corporate domains, banking domains, anything tied to email deliverability for the whole organization. Registry lock costs more — typically $150 to $1,000+ per domain per year depending on provider and domain count — and it’s overkill for a marketing microsite, but it’s close to mandatory for the domain running your primary MX records and SSO login pages.
Emergency recovery when a domain gets hijacked
When registrar lock fails or was never enabled, recovery follows a fairly consistent path. First, contact the registrar’s abuse or security team directly — not general support — and document the unauthorized change with timestamps and screenshots. Second, if the domain moved to another registrar, invoke ICANN’s Transfer Dispute Resolution Policy (TDRP), which the losing registrar can use to request the domain back within 60 days of an unauthorized transfer under the standard 5-day transfer lock window.
Third, and this is where most teams lose critical time, check whether DNS records were altered before the transfer even completed. Attackers often repoint MX and A records within minutes of gaining account access, well before the domain itself moves anywhere. A record of what “normal” DNS configuration looked like — nameservers, TTLs, SPF and DKIM entries — makes it possible to verify whether current records are legitimate or attacker-modified, which is exactly the kind of baseline that a current subdomain and DNS inventory is built to preserve.
Fourth, rotate every credential connected to the registrar account: API keys, linked email accounts, and any DNS provider integrations. A locked domain with a compromised registrar password is still a compromised domain.
Common mistakes in registrar lock configuration
The most frequent error is enabling registrar lock once during initial domain setup and never revisiting it after a registrar migration — transfer lock settings don’t always carry over automatically when a domain moves between registrars, and teams assume protection that no longer exists. The second is relying on registrar lock as the sole control while ignoring registrar account MFA, which is the actual point of failure in most hijacking cases. The third is treating all domains equally: a five-year-old campaign landing page on a forgotten subdomain doesn’t need registry lock, but the domain hosting corporate email absolutely does, and reviewing the full domain portfolio before renewal cycles is usually when these gaps actually surface.
FAQ
Does registrar lock stop someone from changing my DNS records?
No. Registrar lock only prevents the domain from being transferred to a different registrar. DNS record changes — A records, MX records, nameservers — happen through the DNS management panel or API and are unaffected by transfer lock status.
How long does emergency domain recovery usually take?
It varies widely by registrar and circumstance. A quick catch with an unlocked domain and cooperative registrar support can resolve in 48–72 hours. A full ICANN TDRP dispute, if the domain already transferred to a hostile registrar, commonly takes 4–8 weeks.
Is registry lock worth the extra cost for a small business?
For a domain running primary email and customer-facing login pages, yes — the $150–1,000/year cost is small compared to the business disruption of a hijack. For secondary or campaign domains with no email or authentication tied to them, standard registrar lock combined with hardware-key MFA on the account is usually sufficient.
Registrar lock is a baseline control, not a complete strategy — pair it with registry lock on domains that matter most, hardware MFA on every registrar account, and a maintained record of what normal DNS configuration looks like, so that an incident gets caught in minutes rather than discovered during next quarter’s audit.