Raises the cost of unauthorized transfer. Configured at the registrar, not inside Aepto.
Locks · Transfer hygiene
Domain lock status: what it does and misses.
Domain lock status is the registrar-side brake on unauthorized transfers. It is essential hygiene for production names, and it is incomplete protection if you treat the lock badge as a monitoring strategy.
By Muhammad Hamza, Founder of AeptoPublished Updated
What lock status is for
What a lock does, and what it does not.
- Registrars expose statuses such as clientTransferProhibited so the name cannot be transferred away without an intentional unlock.
- Related locks may restrict updates depending on the registrar and TLD.
- For portfolio owners, the operational rule is simple: production names stay locked until a documented transfer window opens.
- Locks do not pay renewals, do not fix phishing of your login, and do not narrate every DNS edit.
- If someone already has authorized access, a lock may slow them, not stop every damaging action.
- That is why 2FA, least privilege, and monitoring sit beside the lock toggle.
Lock checklist for multi-domain teams
- 01 Lock every production and brand name by default
- 02 Require 2FA on registrar accounts that can unlock
- 03 Document who may unlock for transfers
- 04 Re-lock immediately after a completed move
- 05 Monitor baselines anyway (Theft Guard)
What locks miss (and monitoring catches)
Prevention and detection are different layers.
Alerts when NS or registrar signals leave the learned baseline, including cases locks never advertised.
DNS still moves
Panel access can rewrite records. Read DNS change impact.
Transfers still happen
Social engineering and unlocked windows exist. See theft reality.
Access is the root
Locks without 2FA are a sticker on an unlocked door.
Use locks. Then watch the baseline.
Theft Guard alerts you when the registrar or nameservers change from their baseline.
Aepto is not a registrar lock, and monitoring alone does not block a transfer. It detects drift and preserves history so you can act.
What does each lock status actually block?
"Locked" can mean four different things. Check which ones your domains have.
| Status | Set by | Blocks | Does not block |
|---|---|---|---|
| clientTransferProhibited | Your registrar (the usual "domain lock") | Transfers to another registrar | DNS edits inside your account |
| clientUpdateProhibited | Your registrar | Contact and nameserver updates at the registry | Anyone with your login who can remove it |
| serverTransferProhibited | The registry ("registry lock") | Transfers until a verified manual unlock | Mistakes inside your DNS host |
| clientDeleteProhibited | Your registrar | Deleting the registration | Expiry if you don't renew |
Status names come from ICANN's EPP status codes. Aepto does not set or replace locks. It alerts when registrar or nameserver details drift from the baseline.
How do you run an unlock window safely?
Transfers need a temporary gap. Most hijacks abuse a permanent one.
- 01
One person unlocks
Name a single authorized operator. Shared unlock habits are how "I thought you re-locked it" happens.
- 02
Set a re-lock reminder
Calendar the re-lock for the same day the transfer completes.
- 03
Update the baseline
After a planned move, update the Theft Guard baseline so the alert is closed on purpose, not ignored.
- 04
Audit at onboarding
When you take over a portfolio, check lock status on every name. Old transfers often left names unlocked.
Common questions
What is domain lock status?
Registrar and registry flags (often clientTransferProhibited and related locks) that restrict transfer or certain changes until an authorized user unlocks them.
Does locking stop DNS changes?
Not always. Many locks focus on transfer. DNS edits can still happen with panel access. Monitor baselines even when locks are on.
Does Aepto set lock status for me?
No. Locks are configured at the registrar. Aepto alerts on unexpected registrar and NS drift. It does not replace lock controls.
Should every domain be locked?
Production and brand names generally yes. Names you are actively transferring need a controlled unlock window. Document who can unlock.
How do locks relate to Theft Guard?
Locks prevent. Theft Guard detects. Use both. See Theft Guard for baseline drift alerts.
What lock should I enable?
Confirm transfer lock / clientTransferProhibited at the registrar, plus account 2FA. Remember: transfer lock does not freeze DNS edits inside a compromised account.
Lock at the registrar. Watch in Aepto.
Add domains free. Theft Guard frequency scales by plan.