Should You Turn On the Transfer Lock for Your Domain Name?

By Bill Stilwell · Last reviewed October 16, 2026

The short answer

Yes. Keep the transfer lock on for every domain you own, and turn it off only when you’re moving the domain to a new registrar on purpose. The lock stops anyone from moving your domain to another company without first changing the setting in your account. Under the rules set by the Internet Corporation for Assigned Names and Numbers (ICANN), your registrar must give you a way to remove it when you ask.

What this means

A transfer lock is a setting at your registrar. Some registrars call it “registrar lock” or “domain lock.” When it’s on, a public lookup of your domain shows a status called “clientTransferProhibited.”

The lock only blocks moving the domain to another registrar. Your website and email keep working. You can still renew the domain and edit your Domain Name System (DNS) records (see 13.1.4 DNS Access).

To move a domain, you also need an authorization code, sometimes called an “auth code” or an “EPP code.” EPP stands for Extensible Provisioning Protocol. The code works like a password for that one domain. ICANN’s rules say that if your registrar doesn’t let you get the code yourself, it must give it to you within five calendar days of your request.

There are also 60-day waiting periods to know about. ICANN says:

A registrar may deny a transfer within 60 days after the domain was first registered.
A registrar may deny a transfer within 60 days after it was last moved to a new registrar.
After a change to the owner’s name, organization, or email, a 60-day transfer lock usually applies, unless you opted out first. Not every registrar offers the opt out.

Say a landscaper’s registrar account gets broken into. The attacker tries to move the domain to a registrar they control. With the lock on, they’d have to find and change that setting too, and many registrars send an alert when it changes. That buys the owner time.

Why it matters

A stolen domain takes everything with it. Whoever holds the domain controls the website and every email address on it.
Getting a domain back after a bad transfer is slow. It can take weeks of disputes and paperwork.
The 60-day rules can catch you off guard. If you update the owner’s email right before a planned move, you may be stuck waiting two months.

Who this applies to

Every business that owns a domain. Pay extra attention if your domain is the main way customers reach you, or if you plan to change registrars soon.

How to do it

Log in to your registrar and open each domain’s settings.
Turn on the transfer lock (it may be called domain lock or registrar lock). Many registrars turn it on by default. Check anyway.
Confirm it worked. Look up your domain using ICANN Lookup (lookup.icann.org). The status should include “clientTransferProhibited.”
Protect the account itself. The lock only helps if the registrar login is safe. Turn on multi-factor authentication (MFA) and use a shared business email for the account (see 11.7.3 Multi-Factor Authentication).
Turn on alerts for account changes if your registrar offers them.
When you do want to move the domain, follow this order. Finish the transfer first. Then update owner names or emails. Changing contact details first can start a 60-day lock.
Remove the lock only for the move. Request the authorization code, start the transfer at the new registrar, and approve any confirmation emails. ICANN’s process includes confirmation steps, and the move won’t go through if you ignore them.
Turn the lock back on at the new registrar once the move is done.
Write it down. Record the lock status, the date checked, and any transfers in your Master Business Record (see 5 Master Business Record).

What proof to keep

A screenshot of each domain with the transfer lock on
A dated lookup result showing the “clientTransferProhibited” status
Emails confirming any transfer you started
Your note of when you last checked

Store these in your website records folder.

Common mistakes

Leaving the lock off after a move. People remove the lock to transfer and forget to turn it on again at the new registrar.
Sharing the authorization code by text or email. Treat it like a password. Only send it to the new registrar.
Changing the owner email before transferring. This can trigger the 60-day lock. Move first, update after.
Thinking the lock protects against expiration. It doesn’t. A locked domain can still expire if you don’t renew it (see 13.1.3 Domain Renewal).
Paying a company that mails “transfer” or “renewal” notices. Some are sales pitches meant to move your domain. Only act from inside your own registrar account.

When to get help from a pro

Your registrar’s support team: if you can’t find the lock setting, can’t get your authorization code, or a transfer was denied. Ask:

Is my domain under a 60-day lock, and when does it end?
Can I opt out of the change of registrant lock before I update my contact details?

A web professional: if you’re moving several domains at once, or you think a domain was moved without your permission (see 11.9.2 Account Takeover).

Bill’s note

[Bill: add a short story or lesson here. For example, a client who got stuck in a 60-day lock after changing their email before a transfer, or a time a transfer lock stopped an unauthorized move.]

If you’d rather have this done for you, SiteSmarty manages domains for the local businesses it builds websites for.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: which SiteSmarty domains I checked and the lock status of each]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the registrar lock setting and the public lookup showing the status]
[Result so far:]

Questions people ask

Does a transfer lock stop my website or email from working? No. It only blocks moving the domain to another registrar.

How do I remove the lock on my domain? Turn off the lock in your registrar account. ICANN’s rules say that if there’s no way to do it yourself, the registrar must remove it within five calendar days of your request.

What is an authorization code? It’s a unique code for your domain that you give the new registrar to prove you approve the move.

Why can’t I transfer my domain right now? Your domain may be in a 60-day window after it was registered, moved, or had its owner details changed. Ask your registrar.

Audit check

Question: Is the transfer lock on for every business domain, with the registrar account protected by MFA?
Pass looks like: Every domain shows “clientTransferProhibited” in a public lookup. Registrar login uses a business email and MFA. Lock status checked and recorded.
Fail looks like: Lock off with no transfer underway. Authorization codes shared in email threads. No MFA on the registrar account.
Evidence to collect: Lookup results for each domain, a screenshot of the lock setting, and proof of MFA on the registrar account.

Where this fits

Do this first: 13.1.2 Registrar Ownership

Do this next: 13.1.7 Domain Expiration Plan

Sources

ICANN, "Transfer Policy" (checked October 16, 2026)
ICANN, "FAQs for Registrants: Transferring Your Domain Name" (checked October 16, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.