Registrar lock explained: why your domain will not transfer

You have an Auth-Code, the receiving registrar is ready, and the domain still refuses to move. The word “locked” appears somewhere in the control panel, so it is tempting to flip every switch. Stop there. Several conditions can block a transfer, and only some are the everyday registrar lock you can remove yourself.

The fastest diagnosis starts with the exact domain status and the timeline of recent events. Did you register it recently? Was it transferred between registrars? Did the registrant information change? Is there a dispute, payment issue, court order, or registry restriction? Each answer points to a different remedy.

First, read the status instead of guessing

• clientTransferProhibited The common registrar-side status that prevents a normal inter-registrar transfer until it is removed.
• serverTransferProhibited A registry-side restriction. The registrar may need to investigate or coordinate the change.
• clientHold or serverHold These affect DNS publication, not merely transfer. Treat them as a separate availability or compliance incident.

What registrar lock actually does

Registrar lock commonly appears as clientTransferProhibited. While active, it blocks the standard process for moving the registration to another registrar. It is useful during normal operation because a stolen account password or leaked Auth-Code should not immediately become a completed transfer.

What it does not protect

• DNS changes inside the account An attacker with account access may still alter nameservers or records unless other controls stop them.
• Expiration A locked domain can still expire when renewal and payment fail.
• Email account compromise The lock does not secure the mailbox used for approvals or password resets.
• Every registry action Court orders, disputes, abuse processes, or registry policies can create separate statuses.

A clean transfer has a short runbook

1. Confirm the destination. Open the receiving account, enable strong sign-in protection, and verify who controls it.
2. Check eligibility and timing. Identify any current policy restriction before requesting codes or changing contacts.
3. Verify contact access. Make sure approval messages will reach an account the organization controls.
4. Obtain the Auth-Code. Keep it in a secure channel and use it only with the intended receiving registrar.
5. Unlock, submit, and monitor. Remove the registrar lock only when ready, start the transfer, and watch both accounts until it completes.
6. Restore the steady state. After completion, verify DNS, renewal, contacts, and the lock at the new registrar.

The three “60-day” situations are not interchangeable

Under the ICANN Transfer Policy for covered gTLDs, a registrar may deny a transfer requested within 60 days of initial registration or within 60 days of a prior inter-registrar transfer. A Change of Registrant can also lead to a 60-day inter-registrar lock under its own process. Describe the event accurately instead of telling a customer that every domain has one universal 60-day rule.

Country-code domains can follow registry-specific transfer procedures. Do not copy the gTLD explanation onto .uk, .de, or another ccTLD without checking that registry’s current rules. The correct answer may involve a tag, account push, local agent, document review, or another process rather than the standard gTLD Auth-Code flow.

Registry lock is a different control

Registry lock is a higher-touch service designed for valuable domains. Changes may require out-of-band verification between the registrar and registry. It is not the same as clicking the ordinary transfer-lock toggle, and availability, price, and procedures vary. Organizations considering it should document emergency contacts and change approvals before an incident.

If the lock will not clear, preserve evidence

• Capture the exact status Save the status code, time, registrar message, and domain involved.
• Write the timeline Record registration, prior transfer, contact changes, renewal, and dispute events.
• Open one focused ticket Ask which policy or status blocks the transfer and what action or date resolves it.

ICANN states that when a registrar does not provide a reasonable way to unlock an eligible domain within five days of a request, the registrant may submit a transfer complaint. That route is for an unresolved eligible request, not a way around a valid waiting period, registry policy, or dispute.

Lock by default, unlock with a purpose

Keep the everyday registrar lock active during normal operation. Pair it with multifactor authentication, role-based access, monitored contact mailboxes, renewal controls, and a written recovery path. When a legitimate transfer begins, open the shortest practical unlock window and close it by verifying the new account after completion. Review the SoxDomains transfer service