BUY WEBSITES
BUY DOMAINS
LOGIN
SIGNUP
Transfer Locking and When to Unlock a Domain: Registrar Lock, Registry Lock, the 60-Day Hold, and the Clean Handover
A transfer lock, also called a registrar lock or domain lock, is a setting on a domain name that blocks it from being transferred away to another registrar. It is on by default for newly registered domains, and it is the single strongest protection against domain hijacking. To move a domain you own, you turn the lock off first.
The confusion starts because the word lock covers three different things. There is the registrar lock you toggle yourself, the registry lock that only the registry can remove, and the ICANN 60-day hold that is not a lock you can clear at all. This guide separates the three, cites each to ICANN and the registrars, and answers the question the title asks: when to unlock, and when to leave the lock on.
It is written for the case that matters to a buyer above all. You have acquired an aged or expired domain, and now the lock stands between you and control of it. SEO Domains operates the curated marketplace, a 220,000+ pre-screened catalogue from $100 entry-level aged domains through premium acquisitions, where a clean, unlocked, eligible domain is part of the handover instead of a hurdle you inherit.
What is a transfer lock (registrar lock)?
A transfer lock is a status set on a domain that tells the registry to reject any request to move the domain to a new registrar. In its everyday form it is the registrar lock, a switch in your domain control panel that you turn on and off. While the lock is on, an inter-registrar transfer cannot start, no matter who requests it or what credentials they hold.
ICANN, the body that coordinates the domain name system, records the lock as an EPP status code on the domain. The everyday registrar lock corresponds to the status clientTransferProhibited. When that flag is set, ICANN states that the registry will reject requests to transfer the domain from your current registrar to another.
The lock is a security feature, not a restriction
The purpose of a transfer lock is to stop theft. A domain is a valuable asset, and an unlocked domain with a leaked auth code is exposed to an unauthorised move. The lock closes that window. By keeping the domain locked between transfers, the owner forces any move to begin with a deliberate, account-level action that an attacker cannot perform from the outside.
This is why the lock is enabled the moment a domain is registered, instead of being left to the owner to switch on later. The default state is protected, and unlocking is the exception you make when you genuinely intend to move the name.
Transfer lock, registrar lock, domain lock: the same switch
Registrars label this one switch differently. GoDaddy calls it a domain lock, Namecheap calls it a registrar lock, and other panels read transfer lock or client transfer lock. The wording on the button changes, the function does not. Each one toggles the same clientTransferProhibited status on the domain. The names diverge again only when a stronger, registry-level protection enters the picture, which the next section separates out.
The three locks people confuse: registrar, registry, and the 60-day hold
Three different mechanisms get called a lock, and conflating them is the root of the transfer confusion buyers run into. The registrar lock is client-set and you clear it yourself. The registry lock is server-set and only the registry can remove it. The 60-day hold is not a togglable lock at all; it is an ICANN eligibility rule based on time. Knowing which one you are facing tells you exactly what to do next.
Each of the three blocks a transfer, which is why they share the word lock in casual use. What separates them is who controls the block and how it is cleared. The table and the contrast below map all three to the action each one demands.
| Mechanism | Who sets it | EPP status | How it is cleared |
|---|---|---|---|
| Registrar lock (the everyday lock) | You, through your registrar account | clientTransferProhibited | Toggle it off yourself in the control panel |
| Registry lock (premium protection) | The registry, by your standing request | serverTransferProhibited | Only the registry removes it, through an out-of-band verification |
| The 60-day hold (eligibility rule) | ICANN policy, automatically by event | Not a clearable status | Wait out the 60 days; there is no switch |
Registrar lock versus registry lock
The registrar lock and the registry lock sit at two layers of the domain system. The registrar lock lives at your registrar and answers to your account, which is what makes it convenient and also what makes it the everyday tool. The registry lock lives one level up, at the registry that operates the top-level domain, and it is designed for high-value names where convenience is traded for maximum protection.
Registrar lock (clientTransferProhibited)
Set and cleared by you inside your registrar account. Standard on every domain, on by default, and the lock you turn off to start a transfer. Fast to change, which is its strength and its limit, because account access alone removes it.
Registry lock (serverTransferProhibited)
Set at the registry by standing arrangement and removed only through a manual, out-of-band check, such as a phone confirmation against a passphrase. Used to guard high-value domains, because no online account compromise can lift it. CSC and other corporate-domain providers offer it as a premium service.
The 60-day hold is not a lock you can clear
The third mechanism trips up buyers because it looks like a lock but behaves like a clock. ICANN’s Transfer Policy makes a domain ineligible to transfer between registrars for 60 days after it is registered, after a prior inter-registrar transfer, and, where the registrar applies it, after a change of registrant. Unlocking the domain does nothing, because the block is the policy timer, not a status you control. The full mechanics live in ICANN’s 60-day transfer rule.
The EPP status codes behind the lock
Every lock is recorded as an EPP status code on the domain, readable in a WHOIS or RDAP lookup. The codes that matter for transfers are clientTransferProhibited, set by your registrar, and serverTransferProhibited, set by the registry. ICANN publishes the exact meaning of each, and reading the status line tells you which lock is in force and who can lift it.
EPP status codes are the flags the registry and registrar attach to a domain to describe its state. They are the authoritative record of whether a domain can move. ICANN maintains the full list and defines each one in plain language, which makes the status line the first thing to check when a transfer will not start.
| Status code | Set by | What it does (ICANN) |
|---|---|---|
| clientTransferProhibited | Registrar (client) | Tells the registry to reject requests to transfer the domain to another registrar; the everyday registrar lock |
| serverTransferProhibited | Registry (server) | Prevents the domain from being transferred; an uncommon status enacted during disputes, at the holder’s request, or during a redemption period |
| clientUpdateProhibited | Registrar (client) | Rejects requests to update the domain; pairs with the transfer lock to harden a name against unauthorised change |
| clientDeleteProhibited | Registrar (client) | Rejects requests to delete the domain; the third code in the standard anti-hijack trio |
| pendingTransfer | Registry (server) | A transfer is already in progress; a second request will not start until the first resolves or is cancelled |
The verbatim definition is worth reading once, because it is the legal substance of the lock. ICANN describes the everyday registrar lock as follows.
Why your domain is locked by default, and why that protects you
Registrars enable the transfer lock automatically on every new registration because the default state of a domain is meant to be protected, not exposed. Domain hijacking works by sending an unauthorised transfer request, and the lock is the standing barrier that defeats it. An unlocked domain is only as safe as the auth code and the account behind it, so the lock buys a second line of defence.
The reasoning is the same logic that puts a transfer lock on the default path instead of the opt-in path. If unlocking were the default, a single leaked credential would be enough to move a domain. With the lock on by default, an attacker has to clear the lock first, and clearing it requires authenticated access to the account, which an external attacker does not have.
What the lock defends against
A locked domain resists the two routes a hijacker takes. The first is a stolen auth code, the transfer password covered in EPP code (auth code) explained. On its own a leaked code is dangerous, but against a locked domain it is inert, because the registry rejects the transfer before the code is even checked. The second route is a fraudulent transfer request to the gaining registrar. The lock stops that request at the registry, regardless of what the requester claims.
The pairing that hardens a name
Owners who guard a valuable domain rarely set the transfer lock alone. They pair clientTransferProhibited with clientUpdateProhibited and clientDeleteProhibited, the trio ICANN names as the standard anti-hijack set. Together the three reject transfers, updates, and deletions, so an intruder cannot quietly change name servers or contacts as a prelude to a theft. The transfer lock is the headline protection, and the other two close the side doors.
When to unlock, and when to keep the lock on
Unlock a domain only at the moment you are ready to transfer it, and re-lock it the instant the transfer completes or is abandoned. The rule is to minimise the unlocked window, because an unlocked domain is the only state in which a transfer, authorised or not, can begin. Outside an active transfer, there is no good reason to leave the lock off.
The title question has a precise answer. The lock is a default-on, exception-off setting. The exception is a transfer you intend, and it lasts as long as that transfer takes and no longer. Treating the unlocked state as temporary, not as a convenience left running, is the discipline that keeps the security benefit intact.
Re-lock as the final step
The unlocked window needs to close as soon as the transfer resolves. When a domain lands at the gaining registrar, the lock is frequently off, because the move required it off. The closing step of any transfer is to re-enable the lock at the new registrar, which returns the domain to its protected default. A transfer that is abandoned midway deserves the same treatment: re-lock the domain at once instead of leaving it open.
The registry lock is the opposite trade
For a high-value domain held long term, the registry lock inverts the convenience. Because only the registry can remove it through a manual check, unlocking takes deliberate effort and cannot be done in a hurry. That friction is the feature. A name that moves rarely, if ever, and that would be catastrophic to lose, is the candidate for a registry lock, where the cost of a slow unlock is worth the immunity to account compromise.
How to unlock a domain for transfer, step by step
To unlock a domain, log in to the current registrar, open the domain’s management page, find the lock setting, and turn it off. The control sits near the transfer or security settings, and the label reads domain lock, registrar lock, or transfer lock depending on the registrar. Once it is off, the domain is ready to start an inter-registrar transfer. Re-lock it after the move completes.
The steps below are registrar-agnostic, with the common label variations noted. Every registrar puts the lock control in its domain management area, even when the menu names differ.
-
Log in to the current registrar and open the domain
Sign in to the account that holds the domain and open its management page. This is the losing registrar, the one you are moving away from. On GoDaddy this is the Domain Portfolio; on Namecheap it is the Domain List.
The mistake: looking for the lock at the gaining registrar. The lock lives at the registrar that currently holds the domain, never the one you are moving to.
-
Find the lock setting
Open the domain’s settings and look for the control labelled domain lock, registrar lock, or transfer lock, usually grouped with the transfer or security options. It will show as on or enabled for a protected domain.
The mistake: confusing the transfer lock with a registrant-change lock or a DNSSEC setting. Read the label; the one you want references transfer.
-
Turn the lock off
Toggle the lock to off or disabled. This clears the clientTransferProhibited status at the registry. The change is usually immediate, though certain registrars take a short time to propagate it to the registry.
The mistake: requesting the auth code before unlocking. A code pulled while the domain is still locked can be rejected at validation, because the transfer-prohibited status is still set.
-
Confirm the status, then request the auth code
Run a WHOIS or RDAP lookup and confirm the status line no longer shows clientTransferProhibited. With the lock cleared, request the auth code and start the transfer at the gaining registrar. ICANN policy requires the current registrar to provide the auth code within 5 calendar days of the request.
The mistake: assuming the unlock took effect without checking. A stale status line is the leading reason a transfer rejected an hour after an unlock that did not fully propagate.
-
Re-lock at the new registrar after the transfer
When the transfer completes and the domain sits at the gaining registrar, turn the lock back on. This returns the domain to its protected default and closes the unlocked window you opened to make the move.
The mistake: leaving the domain unlocked after the transfer. An open lock at the new registrar is an exposure that serves no purpose once the move is done.
Why a domain still will not unlock or transfer
An unlocked domain does not always transfer, because the registrar lock is one block among four. A registry-set serverTransferProhibited status overrides your unlock entirely. The ICANN 60-day hold blocks the move on a timer no setting can clear. And a pendingTransfer or an expired auth code stalls the process after the lock is already off. Reading the status line tells you which one you are facing.
This is the section the registrar help pages skip, and it is the one that saves the largest amount of time. When a domain will not move after an unlock, the reflex is to toggle the lock again. As frequently, the lock is fine and a different block is in force.
A registry lock you cannot clear
If the status line shows serverTransferProhibited, the block is at the registry, not your registrar. ICANN describes this as an uncommon status, usually enacted during a dispute, at the holder’s request, or during a redemption period. A registrant cannot remove it from the control panel. Clearing it requires contacting the registrar, which works with the registry, and resolving whatever condition set it.
The 60-day eligibility hold
Separate from any status code, ICANN’s Transfer Policy makes a domain ineligible to transfer for 60 days after certain events. A newly registered domain, a domain that was itself transferred in the last 60 days, and, where the registrar applies it, a domain whose registrant changed recently, all sit inside the hold. No unlock shortens it. The detail is covered in ICANN’s 60-day transfer rule, and it is the leading reason a freshly acquired domain will not move.
| Symptom | Likely cause | The fix |
|---|---|---|
| Transfer will not start at all | clientTransferProhibited still set; the unlock did not take | Re-check the status line; toggle the lock off and confirm in WHOIS or RDAP |
| Unlocked, but the transfer is still blocked | serverTransferProhibited set by the registry | Contact the registrar to identify and resolve the registry hold |
| Eligible-looking domain still cannot move | Inside a 60-day post-registration or post-transfer hold | Wait out the 60-day window, then retry the transfer |
| A second transfer attempt does nothing | pendingTransfer; a transfer is already in progress | Let the first transfer resolve or cancel it before starting again |
| Lock is off but the code keeps failing | An expired or mistyped auth code, not a lock problem | Generate a fresh code and paste it exactly, preserving case |
| Registrar will not let you unlock | An account hold, unpaid invoice, or recent contact change | Clear the account condition the registrar flags, then unlock |
The pattern across the table is that the visible registrar lock is the simplest block and the first one cleared. The blocks that persist after an unlock are registry-level or policy-level, and they call for a different response: a conversation with the registrar, or patience with the clock. A genuine ownership dispute that surfaces here is handled separately in Handling a transfer dispute.
Transfer locks when you buy an aged or expired domain
When you acquire a previously owned domain, the lock is the seller’s responsibility to clear, not yours. A clean handover means the domain arrives unlocked, past its 60-day eligibility holds, with a valid auth code, so you can transfer it into your own account and then re-lock it under your control. A stale lock or a 60-day hold turns a clean purchase into a stalled one.
This is the context registrar help pages never address, because they assume you already own the domain you are moving. An aged-domain buyer is in a different position. The domain arrives from someone else, and the lock state you inherit decides whether the transfer is a formality or a fight.
The lock state you want to inherit
A domain ready to hand over has three things lined up. It is unlocked at the seller’s registrar, so the transfer can start. It is past the ICANN 60-day hold, so it is eligible to move. And it comes with a freshly issued auth code, so the credential is valid when you submit. Miss any one of the three and the transfer waits, regardless of how good the domain itself is.
Where a clean handover comes from
In a private sale, the seller unlocks the domain at their registrar and shares the auth code, ideally through escrow so the code is released against payment. The risk is a seller who is slow to unlock, or a domain still inside a 60-day hold the buyer did not check. Sourcing from a screened marketplace removes that friction, because the inventory is verified and the transfer path is handled as part of the sale. Browse curated aged and expired domains, a 220,000+ screened catalogue from $100 entry-level names through premium acquisitions, each with a clean transfer in, on the SEO Domains marketplace. The order of operations once the domain reaches you is set out in the Post-transfer checklist for aged domains.
Transfer lock frequently asked questions
The questions buyers and owners raise when they search for what a transfer lock is and when to unlock, answered against ICANN policy and the registrar record.
Q1What does a domain transfer lock do?
It blocks the domain from being transferred to another registrar. The lock sets the clientTransferProhibited status, which ICANN states tells the registry to reject any transfer request, helping prevent unauthorised transfers from hijacking or fraud. While the lock is on, no transfer can start, whatever credentials the requester holds. You turn it off only to move the domain yourself.
Q2How do I unlock my domain for transfer?
Log in to the registrar that currently holds the domain, open the domain’s management page, find the control labelled domain lock, registrar lock, or transfer lock, and turn it off. Confirm with a WHOIS or RDAP lookup that the clientTransferProhibited status is gone, then request the auth code and start the transfer at the new registrar. Re-lock the domain once the move completes.
Q3What is the difference between a registrar lock and a registry lock?
A registrar lock is the everyday lock you set and clear in your own account; it carries the clientTransferProhibited status. A registry lock is a premium protection set at the registry and removed only through a manual, out-of-band check, carrying the serverTransferProhibited status. The registrar lock trades a little security for convenience; the registry lock trades convenience for immunity to account compromise.
Q4I unlocked my domain but it still will not transfer. Why?
The registrar lock is one block among four. A registry-set serverTransferProhibited status overrides your unlock, ICANN’s 60-day hold blocks the move on a timer no setting clears, and a pendingTransfer or expired auth code stalls the process after the lock is off. Run a WHOIS or RDAP lookup, read the status line, and match the block to its fix instead of re-toggling the lock.
Q5Is it best to keep my domain locked all the time?
Yes, outside an active transfer. The lock is on by default for a reason: an unlocked domain is the only state in which a transfer can begin, so the unlocked window is the hijack window. Unlock only when you are ready to move the domain, complete the transfer, and re-lock at the new registrar. A domain spends almost none of its life unlocked when the lock is treated as a step inside a transfer.
The clean-handover foundation: the SEO Domains marketplace
The transfer lock is the last gate between a paid-for domain and your control of it, and a clean handover depends on the seller clearing that gate before the sale closes. Sourcing from a screened catalogue removes the lock friction, because the inventory is verified, the 60-day eligibility is checked, and the transfer in is part of the deal. SEO Domains operates that curated marketplace.
Why a clean handover starts at the source
A stalled transfer is rarely the buyer’s fault. It is a stale registrar lock the seller forgot to clear, a 60-day hold nobody checked, or a registry lock left in place. Buying from a marketplace that verifies the domain and manages the transfer turns the lock from a point of friction into a formality. The asset, an aged or expired domain with real inherited authority, is what you are paying for, and a clean unlock is how you take control of it.
What a screened acquisition gives you
A vetted purchase removes the parts of the lock-and-transfer process that go wrong:
- A domain delivered unlocked at the source, so the transfer can start at once.
- Eligibility confirmed, past the 60-day registration and transfer holds.
- A clean, freshly issued auth code released as part of the sale, not a recycled static one.
- A screened backlink profile and authority history, so the asset is worth transferring in the first place.
The legitimate demand behind every transfer-lock search is control of a domain you have paid for. That is the product, an ownable aged or expired name with a clean transfer in, not a tool or a subscription. SEO.domains operates the curated marketplace where aged and expired domains are screened before they are listed, and where the handover, lock state and auth code included, is part of the deal.
