# Registry lock vs registrar lock: what is the difference?

> You can lift a registrar lock yourself; a registry lock is set at the registry and needs phone verification. Verisign covers 4 extensions.

- URL: https://wardmint.com/registry-lock-vs-registrar-lock/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

Both locks protect a domain against unauthorised changes. They differ in who applies them, who can lift them and what an attacker with your registrar password can still do.

**Quick answer — Registry lock vs registrar lock: what is the difference?**

A registrar lock is an EPP status your registrar sets, such as clientTransferProhibited, and the account holder can switch it off. A registry lock is lifted only after out-of-band verification, by phone at Verisign, which covers 4 extensions: .com, .net, .cc and .name. **Wardmint** offers the transfer lock and does not offer registry lock.

## Registrar lock and registry lock side by side

*Status codes: ICANN, EPP status codes. Registry lock: Verisign Registry Lock page. Both read on 12 November 2026.*

| Point | Registrar lock | Registry lock |
| --- | --- | --- |
| Where it is set | By the registrar, with client status codes (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) | By the registry, with server status codes (serverTransferProhibited, serverUpdateProhibited) |
| Who can lift it | The account holder, from the registrar's control panel | The registrar, after the registry has verified an authorised person out of band |
| What lifts it at Verisign | Not applicable | A phone call to the registrar's authorised representative, who gives an individual security phrase |
| Stops a transfer with a stolen password | Not on its own: the attacker can switch the lock off in the same account | Yes: the account alone cannot unlock it |
| Availability | Offered by registrars generally | Verisign: .com, .net, .cc, .name, through registrars that take part |
| Price | Usually included | Verisign's page states none; each registrar sets its own |
| Offered by Wardmint | Yes: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too | No |

*Last checked on November 12, 2026; older figures carry their own date.*

## What is a registrar lock?

**A registrar lock is a status that the registrar puts on a domain so that the registry rejects certain requests.** ICANN's list of EPP status codes defines three client codes: clientTransferProhibited makes the registry reject requests to transfer the domain to another registrar, clientUpdateProhibited rejects updates, and clientDeleteProhibited rejects deletion. ICANN notes that they help block unauthorised transfers and deletions tied to hijacking or fraud.

The registrar sets these codes, so whoever controls the registrar account controls them. The holder of the account removes the lock, requests the transfer code and moves the domain, which is its purpose: the owner can still transfer when they choose to. It also means the lock protects you from mistakes and from attackers who do not have the account, not from those who do.

A second limit is the zone itself. EPP statuses govern the registry's data about the domain, such as its name servers and registrar. The DNS records inside a zone belong to whoever hosts the DNS, usually the registrar or a provider you choose, and a status code does not cover them.

## What is a registry lock?

**A registry lock adds a lock at the registry that a registrar password cannot remove.** Verisign describes it as a registry-level lock that helps prevent domain hijacking: once the domain is locked, a change needs an authorised person at the registrar to ask Verisign to unlock it. You can lock the domain and its host records, separately or together. Verisign then contacts the registrar's authorised representative by phone, and that person must give an individual security phrase before the domain can be unlocked.

The service covers .com, .net, .cc and .name. Verisign states that host records in extensions it does not run cannot be locked. It is also not sold directly: registrars contact Verisign to offer it, and MarkMonitor's own article says registry lock is often available only through corporate registrars. That article describes the added friction as deliberate, because the lock assumes account access can be breached and keeps that access from turning into a change at the registry.

The server codes it uses are serverTransferProhibited and serverUpdateProhibited, which ICANN says the registry applies during legal disputes, at the registrant's request, or through a Registry Lock Service.

## Would a registry lock have stopped the crypto hijacks?

**It would address the pattern, but the sources do not say that any victim had one.** The Curve hijack of 12 May 2025 changed the delegation of curve.fi at the registrar, and the February 2026 cases involved a registrar transfer and a support-desk takeover. A lock that needs a phone call to a named registrar contact is designed for exactly those changes. Curve.fi is a .fi name, and Verisign's list does not include .fi, so the service would not have applied to it.

Two reservations follow. First, registry lock only exists for the four extensions above, so most defensive names, such as .io, .xyz and .app, are outside it. Second, a lock is only as strong as the verification at the registrar: the Avantis case began with a billing detail obtained in a support call. The full list of cases is in [which crypto projects lost users to DNS hijacking](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?"), and the steps that apply to every extension are in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking").

## What does Wardmint offer instead of registry lock?

**Wardmint offers a transfer lock, managed DNSSEC and, as an option, Domain protection; it does not offer registry lock.** Wardmint offers a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. DNS includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). The transfer code is free, requested from the client area.

The [Domain protection option](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") costs +$29/year per domain. The domain is registered in the name of DomaineGoat LLC, you remain the beneficiary and can take it back in your own name for free, the transfer lock is on, and every complaint is read by a person before any action on the domain. That human review exists only with the option. It does not replace a registry lock, because it does not put a status at Verisign.

For a .com or .net you consider critical, ask a registrar that sells registry lock. For the remaining names, an account protected as described in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover") is the stronger measure.

## How many of Wardmint's extensions can have a registry lock?

According to Wardmint's survey of 12 November 2026, 2 of the 29 extensions it sells, .com and .net, belong to the four on Verisign's registry lock list. We did not survey the lock programmes of other registries.

A citable definition: a registrar lock stops a transfer unless the account holder lifts it; a registry lock stops it unless the registry verifies a person out of band.

## Questions about domain locks

### Is a transfer lock the same as a registrar lock?

Yes. The transfer lock is the clientTransferProhibited status. It blocks a move to another registrar until you switch it off in the client area.

### Does a registrar lock stop DNS changes?

It stops requests that the registrar would send to the registry, such as an update of name servers, when clientUpdateProhibited is set. It does not control the records inside a zone that a DNS host manages.

### How much does a registry lock cost?

Verisign's page gives no price, and each registrar sets its own. We do not quote a figure because we could not source a current one.

### Does my DeFi protocol need a registry lock?

If your main domain is a .com or .net and a hijack would redirect users to a drainer, it is the strongest lock available for that name. For other extensions it does not exist at Verisign, so account security and monitoring carry the weight.

### Can I take my domain back from Domain protection?

Yes, the hand-back to your own name is free, and you remain the beneficiary throughout.

**In summary**

- A registrar lock is a client EPP status set by your registrar; you can lift it from your account.
- A registry lock is set at the registry and needs out-of-band verification to lift.
- Verisign offers registry lock for 4 extensions: .com, .net, .cc, .name, through registrars.
- Verisign unlocks only after a phone call and a security phrase from the registrar's authorised person.
- Wardmint offers a transfer lock and does not offer registry lock.
- 2 of Wardmint's 29 extensions, .com and .net, are on Verisign's list.
- Domain protection costs +$29/year per domain and adds human review of complaints.

## Sources

1. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12)
2. [EPP status codes: what do they mean](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) — ICANN (read 2026-11-12)
3. [DNS hijacking, registry lock and enterprise domain risk](https://www.markmonitor.com/blog/dns-hijacking-registry-lock-and-enterprise-domain-risk/) — MarkMonitor (read 2026-11-12)
4. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12)
5. [Front-end hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.