Front Sentinel / free tools

Registry lock checker

Check whether a domain has registry lock and registrar locks. The status codes are read live from the registry's public RDAP server. Free, no sign-up.

Check locks

What registry lock is

Every domain carries EPP status codes. Statuses starting with client are set by the registrar, and anyone who controls the registrar account can usually switch them off. Statuses starting with server are set by the registry that runs the TLD, such as Verisign for .com. When a registrar orders registry lock for a domain, the registry sets serverUpdateProhibited, serverTransferProhibited and serverDeleteProhibited, and lifting them takes a manual, out-of-band verification between the registrar and the registry.

That difference matters when the registrar account, or the registrar itself, is compromised. A registrar lock is a setting the attacker can switch off. A registry lock is not in the account at all.

Why dApp teams care

Changing a domain's nameservers is the usual way to take over a dApp frontend: users load the real address and get the attacker's site. In May 2025 an attacker got into the systems of Curve's registrar and pointed curve.fi at their own DNS server. In July 2024 Squarespace reported unauthorized changes to DNS settings of several cryptocurrency domains. More cases with sources are on the main page.

How this check works

It finds the registry's RDAP server through the IANA bootstrap file, requests the registrable domain (so app.example.com checks example.com) and reads the status list. The meaning of each code is in ICANN's EPP status code reference.

Limits: some country-code registries don't run RDAP or don't publish statuses. Registries can also set server* statuses for reasons other than a lock order, for example during a dispute, so a registry status shows protection is in place but not who asked for it.

To check by hand: whois example.com and look for "Domain Status", or for .com:

curl -s https://rdap.verisign.com/com/v1/domain/example.com | jq .status

How to get registry lock

Ask your registrar whether it offers registry lock for your TLD. Not every registrar or TLD supports it, and where it exists it is often a paid add-on, more common at corporate registrars. Set up who may request unlocks and how they are verified before you need a change. If registry lock isn't available, turn on all registrar locks, protect the registrar account with hardware-key 2FA, keep few people on it, and monitor the domain so a change doesn't go unnoticed.

Get alerted when a lock disappears

Front Sentinel watches registry statuses, nameservers, certificates and the scripts your frontend serves, and sends alerts to Telegram, email or webhooks. It reads only public data and never asks for registrar access.

Monitor a domain free   Pricing