How it works
Domains under generic TLDs carry EPP status codes (RFC 5731) that define what may happen to them. The registrar lock is the clientTransferProhibited status: while it is set, the registry rejects every transfer request, even one with the correct auth code. It usually comes with clientUpdateProhibited and clientDeleteProhibited, which block changes and deletion.
The owner turns the lock on and off in the registrar account. The server variants such as serverTransferProhibited are set by the registry itself; sold as a “registry lock”, they require manual confirmation for every change and protect the domain even if the registrar account is compromised.
Country-code TLDs do things their own way: DENIC has no transfer status for .de, where the AuthInfo code that only the owner can request from the provider is the safeguard. Some registrars also offer their own transfer lock that they enforce independently of the registry.
Why it matters
Without a transfer lock, a leaked auth code or a hijacked registrar account is enough to move the domain to another registrar (domain hijacking). The new holder sets their own name servers and with them controls the website, email, certificates and every password reset sent to an address on the domain.
Getting a stolen domain back often takes weeks even when the case is clear, going through the registrar, the registry or a dispute procedure – weeks in which the client has no website and no email.
How to prevent it
- Turn on the transfer lock for every client domain in the registrar account, along with update and delete protection where available.
- Secure the registrar account with two-factor authentication and use a contact address that is not on the domain itself.
- Only request auth codes for a planned transfer, never send them by unencrypted email, and have them reset after the move.
- For business-critical domains, ask the registrar about a registry lock if the TLD offers one.
- Monitor the registrar and status codes continuously so an unplanned transfer or a removed lock stands out immediately.
How DomainWarn detects it
The Domain check reads the registry’s status codes daily via RDAP. If a generic TLD such as .com, .net or .agency has no transfer lock at all (neither clientTransferProhibited nor serverTransferProhibited), it adds a notice. Country-code TLDs such as .de are not rated here, because their registries don’t use the EPP status model.
If the registrar is connected through an integration (INWX, IONOS, OVHcloud or Route 53), its own data takes precedence: DomainWarn then reports a disabled transfer lock for any TLD, including .de. Every change in status codes is logged as an event in the timeline, and a change of registrar is reported as a warning – the classic sign of a transfer nobody ordered.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.