Domain Transfer Lock: Turn It On and Confirm You Own the Domain

If you have heard about a business losing its web address, you may be wondering whether your own domain is locked, and whether anyone besides you could sign in and move the domain. You may not even be sure which company holds it, or whether the login belongs to someone who built your website years ago. Your domain is the address your website, your email and your ads all depend on, so it is worth ten minutes before it becomes a problem. The lock itself is one switch at your registrar, and it takes less time than finding the login. The harder questions are who is on record as the owner, who can sign in, and whether you could get the domain back if something went wrong. You can answer all three yourself, in order, without paying anyone.

Ten minutes at your registrar covers the lock, the owner and the login

Sign in to your registrar yourself, using an account you control. If you do not know which company that is, the next section shows how to find out. Then work down this list, and do not turn off the lock or hand out a transfer code unless you are deliberately moving the domain.

1. Confirm the registrar and the expiration date: Both are shown on the domain's page in your account.
2. Check the registered name holder: The name and organization should be your business, with a current address, phone number and email.
3. Check the account email: It should be an address the business controls, not a freelancer's or former employee's inbox.
4. Turn on the transfer lock: Look for a setting called registrar lock, domain lock or transfer lock. When it is on, ordinary transfers to another registrar are blocked.
5. Turn on auto-renew and check the payment method: A card that expired last spring defeats auto-renew.
6. Turn on two-step login: Use an authenticator app, a passkey or a security key if the registrar offers one, and save the backup codes.
7. Review who else has access: Remove anyone who no longer works for you or with you.
8. Write it down: Record the registrar, the account owner, the renewal date and the recovery steps somewhere your business keeps, such as a shared password manager.

ICANN's Transfer Policy, last updated February 21, 2024, names the lock status that sits behind that setting: `clientTransferProhibited`. A registrar can apply it when the registered name holder asks, and it must give the holder a reasonable way to remove it later. That is why the switch is yours to flip, and why you can turn it back on the day a planned move is finished.

The business has to be the registered owner, not the person who set it up

Owners often assume that whoever built the website owns the domain, or that paying the website invoice settled it. Neither is true automatically. Hosting, DNS, email and domain registration can sit in separate accounts, and the registration is the one that decides who controls the address. ICANN's Registration Data Policy says that when a registrant organization is entered, that organization is treated as the registered name holder. So, the first thing to read is the name and organization on the registration.

If you do not know your registrar, look the domain up with ICANN's lookup tool. It can show the registrar and registration details that are public. A privacy or proxy service may hide the owner's name and contact details, and that is normal; it does not mean you have lost ownership. The real test is inside the registrar account. If you can sign in, change the registrant details and see your business named as the holder, you own the domain in the sense that matters.

If the answer is different, act on it now. The registration may sit under a former agency, a freelancer or an employee, or the account may use their email address. Ask that person or company for the account to be moved to you, or for a transfer into an account the business controls, and get it in writing. The how to transfer a domain post walks through the move itself. Do not change nameservers or let the domain expire while you sort out who holds the login. Keep ICANN's Registrant Rights and Responsibilities page handy for the duties that come with being the holder, including keeping your contact details accurate.

Each registrar puts the lock and the login in a different place

Menu names change, so treat the paths below as a map and confirm them against your registrar's current help page. These come from each registrar's own help pages, with the update date where the page shows one.

The pages to open for your registrar are linked here. GoDaddy explains how to lock a domain and how to turn on 2-step verification. Namecheap covers two-factor authentication and what registrar lock does. Squarespace lists its domain locks and its two-factor setup. Cloudflare documents two-factor authentication and recommends more than one factor plus saved backup codes.

If your domain ends in a country code such as .uk or .de, the registry may have its own rules that differ from the ICANN rules described here. Ask your registrar what protection applies to your extension.

The 60-day rules are three separate locks, not one

People often hear that there is a 60-day lock and assume every account change freezes the domain for two months. ICANN's policy is more specific. Transfers are generally blocked for 60 days after the domain is first registered, for 60 days after a transfer between registrars, and for 60 days after certain changes to the registrant's information. A registrar may let you opt out of the lock that follows a registrant change, so ask before you edit the owner details if a move is coming.

That matters for two reasons. If you correct the owner name or email on a domain you plan to move, the change can start a clock, and you may not be able to transfer until it ends. And if you register a new domain or finish a transfer, a short waiting period is built in, which is a protection rather than a fault.

To move a domain on purpose, you need an authorization code, also called an EPP code, auth code or transfer code. ICANN's guidance on the auth-code explains that it identifies the registered name holder. The registrar must let you generate the code or provide it within five calendar days. Treat it like a password: share it only when a transfer you have chosen is underway, and only with the person or company doing it. Do not email it around or leave it in a shared document.

A lock stops transfers, not a stolen password

A transfer lock does one job well. It does not protect an account from a stolen password, a hacked email inbox, a changed DNS record, a person with administrator access or a registration that expires. Those are administrative gaps, and the lock does not close them. So, the lock works best paired with a few habits that cost nothing.

• Two-step login: A password alone is the weak point. An authenticator app, passkey or security key stops a stolen password from being enough. Cloudflare recommends saved backup codes, and they belong in the business's records.
• A business-controlled email address: Password resets go to the account email. If a former freelancer or a hacked inbox receives them, the lock will not help. If your business email has already been compromised, start with what to do when business email is hacked and then return to the registrar.
• Auto-renew with a working card: A lapsed registration puts the domain at risk too. The domain name expired post covers recovery, and it is better never to need it.
• Renewal notices that reach someone: Registrar emails should go to an address a person reads. Be careful with unsolicited invoices that claim your domain is about to lapse; the fake domain renewal scams post shows how to tell them from the real notice.
• Separate hosting, DNS and email in your head: Your website host is not automatically the domain's owner. Knowing which company controls which piece makes any later problem faster to fix. If you want your email on your own domain, the business email with your own domain post explains how that connects.

A shared login, an old account email and a missing recovery method are worth fixing first, and an afternoon is usually enough to do it.

If a transfer already happened, these are the first calls

Speed matters more than perfect wording once something has gone wrong. ICANN's page on lost domain names says an unauthorized transfer may come from domain hijacking or from unauthorized access to an email account or login, and it directs the holder to contact the previous registrar immediately. Work in this order:

1. Contact the current and the previous registrar: Ask them to investigate an unauthorized transfer and whether it can be reversed.
2. Secure the accounts: Change the registrar password, the email account password and the recovery methods, and sign out sessions you do not recognize.
3. Keep every record: Save transfer notices, account logs, emails and screenshots with dates.
4. Check what else changed: Look at DNS, nameservers, email routing and the registrant details.
5. Use ICANN's help routes if the registrar does not respond: ICANN's I Need Help page points to its compliance process for certain registrar failures.

ICANN says it cannot directly return a lost domain. A registrar may be able to reverse an unauthorized transfer, depending on the facts and applicable law, so recovery is not guaranteed. The Transfer Dispute Resolution Policy is mainly a process between registrars; it is not a form you file alone, and a registrar needs to be involved. You can read the TDRP if you want to see how it works. If the cause was a compromised account, Cloudflare's guide to securing a compromised account is a sensible checklist even if your registrar is a different company.

The ten-minute check costs nothing; paid help fits a few situations

You do not need a vendor to switch on a transfer lock, turn on auto-renew or set up two-step login. Do those yourself today. Paid help starts to make sense when the check shows a problem that crosses systems or people: the domain sits in a former vendor's account, you cannot identify the registrar, the registrant details are wrong and the old holder will not cooperate, your DNS and business email are tangled together, you have several domains to audit, or an unauthorized change has already happened.

In those cases the work is control recovery, documentation and coordination with the registrar, not a secret setting only an agency can reach. You should keep direct control of the registrar account even when someone helps, and the registration should stay in your business's name. Website maintenance often includes renewals and account access, which is where a handoff from a former designer usually gets tidied up.

Frequently Asked Questions About domain transfer lock

What is a domain transfer lock?

It is a setting at your registrar that blocks ordinary transfers of the domain to another registrar. It is also called a registrar lock or domain lock, and the status behind it is `clientTransferProhibited`. You can turn it on and off from your registrar account.

Do I still own my domain?

Sign in to the registrar and read the registered name holder. If the business is named there and you control the account, you own the registration. ICANN's lookup tool can show the registrar and public registration details, though a privacy service may hide names.

Do I have to wait 60 days to transfer a domain?

Only in certain cases. Transfers are generally blocked for 60 days after first registration, after a transfer between registrars, and after certain changes to the registrant's information. A registrar may let you opt out of the lock that follows a registrant change.

How can I check whether my domain is locked?

Open the domain's settings at your registrar and look for the registrar lock, domain lock or transfer lock setting. Use the registrar's help page for the exact menu, and confirm the setting shows as on after you change it.

Will I lose my email or will my website go down if I move my domain?

Your website and email depend on DNS records, which are separate from the registration. Confirm that your DNS settings come across before you start, and follow the steps in how to transfer a domain. Ask your registrar before you move anything live.

Can ICANN get my domain back?

ICANN says it cannot directly return a lost domain. Contact your current and previous registrar immediately; a registrar may be able to reverse an unauthorized transfer. ICANN's complaint routes cover certain registrar failures.

What This Means for You

A domain transfer lock is the easy part. Turn it on, make sure the business is the registered name holder and the account email belongs to the business, switch on two-step login, and keep auto-renew funded. Add the 60-day rules, a safe place for backup codes, and a short list of who to call if a transfer happens without you, and you have covered the ways a small business loses a domain.

Once the check is done, it rarely needs touching again beyond renewal day and the day an employee or agency leaves. That is a quiet kind of protection: your website, email and ads keep working because the one address they all depend on stays yours.

If the check turns up a domain in someone else's account, an unknown registrar or a tangle of DNS and email, Web Leveling can help you recover control and set up a clean handoff, and our web hosting service covers the site side of it while the registration stays in your name. We work with small and medium businesses across the country and overseas. Contact us about your domain and website and tell us who holds what today.

Terms