What is Registry lock?

A registry lock is a high-security domain lock that requires manual verification with the registry before anything can change.

A registry lock is the strongest protection you can put on a domain name. It's applied at the registry, the organisation that runs the extension, rather than at your registrar. Once it's on, nobody can change the domain's nameservers, contacts or registrar, or delete it, through the normal online systems. Every change has to be requested, verified by real people, and then the lock is lifted briefly to allow it.

Large companies, banks and government bodies use registry locks to stop their domains being hijacked. If an attacker gets into the registrar account, they still can't point the domain somewhere else.

How a registry lock works

1. The registrar asks the registry to set special statuses on the domain, such as serverUpdateProhibited, serverTransferProhibited and serverDeleteProhibited.
2. While those statuses are in place, the registry's systems reject changes, even ones sent by the registrar.
3. When you need a change, an authorised contact makes a request through an agreed process, often including a phone call, passphrase or signed form.
4. The registrar and registry verify the request, unlock the domain, make the change and lock it again.

Registry lock vs domain lock

• A standard domain lock (also called registrar lock) is a setting you can switch on and off yourself in your registrar dashboard. It blocks unauthorised transfers, but anyone who gets into your account can turn it off.
• A registry lock is controlled at the registry and can only be lifted through a manual, verified process. It protects against account takeover, social engineering and mistakes.

A domain lock is the right default for almost everyone. A registry lock adds a second, much harder barrier on top.

Who needs a registry lock

It's worth considering if your domain is very valuable or if downtime would be serious:

• Busy online shops and banks
• Well-known brands that attract phishing and hijacking attempts
• Domains that run critical email or login systems

For most small business sites, a standard domain lock, a strong unique password and two-factor authentication on your registrar account are enough.

Registry lock drawbacks

• Not every extension supports it, and not every registrar offers it.
• Changes are slow, sometimes taking hours or days, so emergency DNS or nameserver moves are harder.
• It usually costs extra, often much more than the domain itself.
• It doesn't lock your DNS records if your DNS is hosted elsewhere. It protects the registration and nameserver delegation, not the records inside your zone.

Registry lock questions