Three Domain Locks: Registrar Lock, Registry Lock and clientHold

The word "locked" means three different things when people talk about domains. Registrar lock is the lock a registrar sets by default so the domain cannot be moved away: the site works, only a transfer is blocked. Registry lock is a paid registry service for those who need protection one level higher: every change goes through a manual check. clientHold and serverHold are not protection but a shutdown: the domain is removed from the DNS zone and everything on it stops working. The first two are set to keep the domain safe. The third is set when there is a claim against the domain or the owner's details are unverified.

All three are visible in the domain's public record, and confusing them is expensive: which lock is in place decides whom you write to and how long you wait.

	Who sets it	What is blocked	Does the site work?	How to lift it
Registrar lock	the registrar, by default	transfer, sometimes update and deletion	yes	in the registrar panel or via support, minutes
Registry lock	the registry, on the registrar's request	any change without manual confirmation	yes	a manual procedure with identity checks, hours or days
clientHold	the registrar	the domain itself: no DNS, no mail	no	fix the cause: contacts, payment, reply to the complaint
serverHold	the registry	the same	no	only through the registry, usually via the registrar

Registrar lock: the lock everyone has

Technically these are three registry statuses: clientTransferProhibited (transfer to another registrar is blocked), clientUpdateProhibited (changes to the data are blocked) and clientDeleteProhibited (deletion is blocked). The client prefix means the status was set by the registrar, the registry's "client". Most registrars set at least the transfer lock at registration. It is theft protection: even if someone obtained the authorization code, the transfer will not go through while the lock is in place.

The owner lifts it: with a button in the registrar panel or by a request to the support of the service the domain was bought through. It takes minutes. Lifting the lock only makes sense right before a transfer; the rest of the time it should stay on.

A separate case is the 60-day transfer lock. Under ICANN policy a domain cannot be transferred to another registrar for 60 days after registration, 60 days after a previous transfer and 60 days after a change of registrant. This lock does not appear in the domain record as a separate status, and a registrar cannot lift it on request: it is a rule, not a setting. If you change the registrant details, assume the domain is tied to the current registrar for the next two months.

Registry lock: a manual check on every change

This is a service of the registry, the organisation that runs the zone itself (who the registry and the registrar are is explained in the glossary). The domain receives the statuses serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited: the server prefix says the registry set them, and a registrar cannot remove them with its own tools. Any change — nameservers, contacts, a transfer — requires a separate request with identity verification by a procedure agreed in advance: a phone call, a passphrase, a signed letter.

Registry lock is offered by Verisign for .com and .net and by a number of country-code registries; the price and the procedure differ, and it is ordered through the registrar. It is for projects where a stolen domain costs more than the inconvenience of manual procedures: brands, payment services, large exchanges. For an ordinary site a registrar lock and two-factor protection on the account are enough.

An important caveat: a registry also sets the same server*Prohibited statuses without any request from the owner — on a court order, a regulator's decision or under its own rules. Then it is no longer a service but a restriction, and only the party that set it can remove it.

clientHold and serverHold: the domain is switched off

This is the third type, and it is not about protection. A domain with a hold status is excluded from the DNS zone: the browser cannot find the address, mail on the domain is not delivered, while the registration stays with the owner and the domain is not released to anyone. The statuses are covered in detail in the glossary; here is what matters most.

clientHold is set by the registrar. Typical reasons:

1. Unverified owner contact details. Under the ICANN agreement with registrars, after registration, a transfer or a change of details the owner receives an email asking to confirm the contact. If there is no confirmation within 15 days, the registrar must suspend the domain. This is the most common cause of a hold for honest owners, and the most annoying: the email went to spam, the domain went down.
2. Unpaid renewal. The domain goes on hold, then into the grace period and further along the domain lifecycle.
3. A decision on a complaint. The registrar reviewed a claim and suspended the domain pending clarification.

serverHold is set by the registry: on a regulator's or court decision, under the zone's own rules or at the registrar's request when a higher level is needed. Only the registry can lift it, usually on the registrar's request.

Telling a hold from a protective lock is simple: in the domain record the word Hold means "switched off", the word Prohibited means "protected". A domain can have clientHold and clientTransferProhibited at the same time: it is off and it cannot be transferred.

How to read a domain record

Open the record through any RDAP service, for example rdap.org, and find the status field. What can be there:

Status	Meaning	Cause for concern
ok / active	no restrictions	no transfer lock — worth enabling
clientTransferProhibited	transfer blocked by the registrar	no, this is normal
clientUpdateProhibited, clientDeleteProhibited	update or deletion blocked by the registrar	no
serverTransferProhibited and other server*Prohibited	the same, at registry level	no if you ordered registry lock; yes if you did not
clientHold	domain switched off by the registrar	yes
serverHold	domain switched off by the registry	yes
pendingTransfer	a transfer to another registrar is in progress	yes, if you did not start it
autoRenewPeriod, redemptionPeriod, pendingDelete	stages after the registration period ended	yes: the domain was not renewed
inactive	the domain has no nameservers	the site will not work until nameservers are set

If the record contains no Hold and no deletion stage, yet the site does not open, the problem is not at the registrar — it is hosting, DNS or the CDN. What to check in that case is covered in Domain not opening.

How this works at Riki Domains

The statuses of every domain are shown in the domain list in the bot and in the web panel, and it is the same information as in the public registry record. Domains are registered through accredited partner registrars, and the transfer lock is enabled there by default.

If a clientHold appears on a domain after a complaint, the service's support handles the correspondence with the registrar: asks the registrar for the substance of the claim, passes on your replies and evidence, keeps track of deadlines. How exactly this works and what the service does not do is described in Reseller or registrar. In the zones of the Platinum and Titan plans the domain is registered in the service's name, so contact-verification emails go to the service rather than to you, and a hold "for unverified contacts" is handled by support without your involvement. In standard zones the contacts are yours, and the verification email has to be opened in the first days after purchase.

If your project needs a registry lock, ask support: availability and price depend on the registry of the specific zone.

If the domain was hacked

A separate scenario that accounts for a noticeable share of hold statuses among honest owners: the site or the hosting account was hacked, someone else's content appeared on the domain, a complaint came in, the registrar set clientHold. The order of actions:

1. Change the passwords for hosting, the registrar panel and email, enable two-factor protection.
2. Remove the foreign content and close the hole it came through. Keep screenshots and logs: you will need them for the reply.
3. Answer the registrar on the substance: what happened, what was done, when. The registrar does not establish the fact of a hack; it checks whether the violation has been removed, so the reply has to be specific.
4. After the status is lifted, check the domain record a week later: a hold sometimes returns if the registrar received a repeat complaint about an old link.

For Riki Domains customers support walks this path: tell the support chat that the domain was hacked and attach the evidence that the problem is fixed.

Owner's checklist

• The transfer lock (clientTransferProhibited) is always on and is lifted only right before a transfer.
• The contact-verification email is opened and confirmed in the first days after registration or a change of details.
• Auto-renewal is on and the balance holds a year's worth in advance.
• After a change of registrant or a transfer — 60 days without a transfer, plan ahead.
• Two-factor protection is on for the registrar account and for the email the domain is tied to.
• Once a quarter — a look at the domain record in RDAP: statuses, nameservers, expiry date.

If the project cannot afford even a short outage — registry lock, plus a separate procedure for the day a change is needed urgently after all.