Front Sentinel / guides

How to get registry lock for your domain

The lock you switch on in a registrar dashboard lives inside that dashboard. Whoever signs in to the account, or gets into the registrar's own systems, can switch it off and change your nameservers. Registry lock is set one level up, at the registry, and changes then need a manual check outside the account.

Checked 22 October 2026 against registrar and registry documentation. Prices and TLD lists change, so confirm with your registrar before you buy.

From our October 2026 survey of the 100 largest DeFi protocols by TVL.

Registrar lock and registry lock

Domains carry EPP status codes, listed on ICANN's EPP status page. The client codes are set by the registrar, and the registrar (or anyone in your account) can remove them:

• clientTransferProhibited is the usual "domain lock". It stops a transfer to another registrar. It does not stop a nameserver change.
• clientUpdateProhibited and clientDeleteProhibited block updates and deletion, again only until someone with account access removes them.

The server codes are set by the registry: serverTransferProhibited, serverUpdateProhibited (this one blocks nameserver changes) and serverDeleteProhibited. With registry lock, the registry only lifts them when an authorised person at your registrar asks, and that person first confirms the request with you outside the account. For .com and .net, Verisign describes a phone call to a named contact who must give a security phrase.

In May 2025 an attacker got into the systems of Curve's registrar and changed the nameservers of curve.fi. A lock set by the registrar can't stop a change made from inside the registrar.

Which registrars offer it

There is no official list. Verisign works with registrars that have signed up for the service but does not publish who they are. This is what registrars say on their own pages.

Registrar	Registry lock	How to get it
Namecheap	Yes, on Domain Vault	.com, .net, .xyz, .cc, .name and about twenty others (list). Not .io or .org.
Dynadot	Yes	Manage Domain, then Registry Lock, then Upgrade. .com, .net, .cc; takes 3 to 5 business days (help page).
NameSilo	Yes	$12 a month or $144 a year per domain, .com, .net, .cc, .tv (NameSilo).
CentralNic Reseller (RRPproxy)	Yes	Through an account manager, 50+ TLDs including .com, .net, .io, .xyz, .me, .ch. They quote about $100 to $500 a year depending on the registry (details).
MarkMonitor	Yes	Corporate registrar, by contract. All six registry-locked domains in our survey are here.
CSC	Yes ("MultiLock")	Corporate registrar, by contract, 150+ extensions.
Cloudflare	Enterprise only	Part of Custom Domain Protection, applied where the TLD supports it. Standard Cloudflare Registrar has the registrar-level lock only.
Amazon Route 53	No	Registrar-level transfer lock only.
Name.com, IONOS, Hostinger	No public offer	Their help pages describe the registrar lock only.
GoDaddy, Squarespace, Porkbun, Gandi	No public offer found	Ask support whether they can set server*Prohibited at the registry. Gandi has sold it in the past through promotions and its corporate service.

If your registrar doesn't offer it, the usual route is to transfer the domain to one that does. The transfer lock has to come off for the move, so do it on a quiet day and request registry lock as soon as the domain arrives.

Which TLDs support it

• .com, .net: yes, through Verisign, and only via a participating registrar.
• .xyz: yes. Namecheap and CentralNic Reseller both offer it.
• .io: Identity Digital runs a registry lock service across its TLDs; CentralNic Reseller lists .io. Namecheap does not.
• .org: the registry has a lock service, but we found no retail registrar selling it today. Ask a corporate registrar.
• .fi: the Finnish registry keeps a registry lock field, but publishes no EPP statuses over RDAP, so nobody outside can see whether it is on.
• .finance, .app, .dev: no registrar we checked lists them. Ask before you plan around it.

If your protocol lives on a TLD without registry lock, the other layers carry more weight: a CAA record, DNSSEC, two-factor and a restricted user list at the registrar, and monitoring that tells you when the nameservers or certificates change.

How to check that it is on

After the registrar confirms, look up the domain's statuses. The registry lock checker reads them from the registry's RDAP server and shows which locks are set. You can also use ICANN Lookup. You want to see server update prohibited, server transfer prohibited and server delete prohibited. If only the client codes show, you have the registrar lock and nothing more.

Registries sometimes set server codes for other reasons, such as a dispute, so ask your registrar to confirm that the codes come from the lock service.

Before you buy

• Ask who can approve a change and how. Two named people with a phone number and a passphrase is the usual setup. Keep the list current when people leave.
• Ask how long an unlock takes. Planned nameserver moves need a day or more of lead time.
• Lock the nameserver host records too if your nameservers sit under your own domain.
• Keep watching. A lock can be lifted by mistake or by a convincing call to the registrar, and you want to know the same day.

Know when a lock comes off

Front Sentinel reads your domain's registry statuses, nameservers and new certificates on a schedule and alerts your team in Telegram, email or webhooks when any of them change. One domain is free.

Check your locks   Monitor a domain