# Three Domain Locks: Registrar Lock, Registry Lock and clientHold

> How registrar lock differs from registry lock and clientHold: who sets each status, what it blocks, how to read it in RDAP and lift it. Plus the 60-day lock.

- Language: en
- Published: 2026-10-24 · Updated: 2026-10-24
- HTML: https://rikidomains.at/en/guides/three-domain-locks/
- Markdown: https://rikidomains.at/en/guides/three-domain-locks/index.md
- RU version: https://rikidomains.at/ru/guides/tri-zamka-domena/

The word "locked" means three different things when people talk about domains. **Registrar lock** is the lock a registrar sets by default so the domain cannot be moved away: the site works, only a transfer is blocked. **Registry lock** is a paid registry service for those who need protection one level higher: every change goes through a manual check. **clientHold and serverHold** are not protection but a shutdown: the domain is removed from the DNS zone and everything on it stops working. The first two are set to keep the domain safe. The third is set when there is a claim against the domain or the owner's details are unverified.

All three are visible in the domain's public record, and confusing them is expensive: which lock is in place decides whom you write to and how long you wait.

| | Who sets it | What is blocked | Does the site work? | How to lift it |
|---|---|---|---|---|
| Registrar lock | the registrar, by default | transfer, sometimes update and deletion | yes | in the registrar panel or via support, minutes |
| Registry lock | the registry, on the registrar's request | any change without manual confirmation | yes | a manual procedure with identity checks, hours or days |
| clientHold | the registrar | the domain itself: no DNS, no mail | **no** | fix the cause: contacts, payment, reply to the complaint |
| serverHold | the registry | the same | **no** | only through the registry, usually via the registrar |

## Registrar lock: the lock everyone has

Technically these are three registry statuses: **clientTransferProhibited** (transfer to another registrar is blocked), **clientUpdateProhibited** (changes to the data are blocked) and **clientDeleteProhibited** (deletion is blocked). The *client* prefix means the status was set by the registrar, the registry's "client". Most registrars set at least the transfer lock at registration. It is theft protection: even if someone obtained the authorization code, the transfer will not go through while the lock is in place.

The owner lifts it: with a button in the registrar panel or by a request to the support of the service the domain was bought through. It takes minutes. Lifting the lock only makes sense right before a transfer; the rest of the time it should stay on.

A separate case is the **60-day transfer lock**. Under ICANN policy a domain cannot be transferred to another registrar for 60 days after registration, 60 days after a previous transfer and 60 days after a change of registrant. This lock does not appear in the domain record as a separate status, and a registrar cannot lift it on request: it is a rule, not a setting. If you change the registrant details, assume the domain is tied to the current registrar for the next two months.

## Registry lock: a manual check on every change

This is a service of the registry, the organisation that runs the zone itself (who the registry and the registrar are is explained in the [glossary](https://rikidomains.at/en/glossary/registrar-registry/)). The domain receives the statuses **serverTransferProhibited**, **serverUpdateProhibited** and **serverDeleteProhibited**: the *server* prefix says the registry set them, and a registrar cannot remove them with its own tools. Any change — nameservers, contacts, a transfer — requires a separate request with identity verification by a procedure agreed in advance: a phone call, a passphrase, a signed letter.

Registry lock is offered by Verisign for .com and .net and by a number of country-code registries; the price and the procedure differ, and it is ordered through the registrar. It is for projects where a stolen domain costs more than the inconvenience of manual procedures: brands, payment services, large exchanges. For an ordinary site a registrar lock and two-factor protection on the account are enough.

An important caveat: a registry also sets the same **server\*Prohibited** statuses without any request from the owner — on a court order, a regulator's decision or under its own rules. Then it is no longer a service but a restriction, and only the party that set it can remove it.

## clientHold and serverHold: the domain is switched off

This is the third type, and it is not about protection. A domain with a hold status is excluded from the DNS zone: the browser cannot find the address, mail on the domain is not delivered, while the registration stays with the owner and the domain is not released to anyone. The statuses are covered in detail in the [glossary](https://rikidomains.at/en/glossary/clienthold-serverhold/); here is what matters most.

**clientHold** is set by the registrar. Typical reasons:

1. **Unverified owner contact details.** Under the ICANN agreement with registrars, after registration, a transfer or a change of details the owner receives an email asking to confirm the contact. If there is no confirmation within 15 days, the registrar must suspend the domain. This is the most common cause of a hold for honest owners, and the most annoying: the email went to spam, the domain went down.
2. **Unpaid renewal.** The domain goes on hold, then into the grace period and further along the [domain lifecycle](https://rikidomains.at/en/glossary/domain-lifecycle/).
3. **A decision on a complaint.** The registrar reviewed a claim and suspended the domain pending clarification.

**serverHold** is set by the registry: on a regulator's or court decision, under the zone's own rules or at the registrar's request when a higher level is needed. Only the registry can lift it, usually on the registrar's request.

Telling a hold from a protective lock is simple: in the domain record the word **Hold** means "switched off", the word **Prohibited** means "protected". A domain can have clientHold and clientTransferProhibited at the same time: it is off and it cannot be transferred.

## How to read a domain record

Open the record through any RDAP service, for example [rdap.org](https://rdap.org), and find the status field. What can be there:

| Status | Meaning | Cause for concern |
|---|---|---|
| ok / active | no restrictions | no transfer lock — worth enabling |
| clientTransferProhibited | transfer blocked by the registrar | no, this is normal |
| clientUpdateProhibited, clientDeleteProhibited | update or deletion blocked by the registrar | no |
| serverTransferProhibited and other server\*Prohibited | the same, at registry level | no if you ordered registry lock; yes if you did not |
| clientHold | domain switched off by the registrar | yes |
| serverHold | domain switched off by the registry | yes |
| pendingTransfer | a transfer to another registrar is in progress | yes, if you did not start it |
| autoRenewPeriod, redemptionPeriod, pendingDelete | stages after the registration period ended | yes: the domain was not renewed |
| inactive | the domain has no nameservers | the site will not work until nameservers are set |

If the record contains no *Hold* and no deletion stage, yet the site does not open, the problem is not at the registrar — it is hosting, DNS or the CDN. What to check in that case is covered in [Domain not opening](https://rikidomains.at/en/guides/domain-not-opening/).

> [Open the bot](https://t.me/riki_domains_bot?start=g26)

## How this works at Riki Domains

The statuses of every domain are shown in the domain list in the [bot](https://rikidomains.at/en/guides/how-to-use-the-riki-bot/) and in the [web panel](https://rikidomains.at/en/guides/riki-domains-web-panel/), and it is the same information as in the public registry record. Domains are registered through accredited partner registrars, and the transfer lock is enabled there by default.

If a clientHold appears on a domain after a complaint, the service's support handles the correspondence with the registrar: asks the registrar for the substance of the claim, passes on your replies and evidence, keeps track of deadlines. How exactly this works and what the service does not do is described in [Reseller or registrar](https://rikidomains.at/en/guides/riki-domains-reseller-or-registrar/). In the zones of the Platinum and Titan plans the domain is registered in the service's name, so contact-verification emails go to the service rather than to you, and a hold "for unverified contacts" is handled by support without your involvement. In standard zones the contacts are yours, and the verification email has to be opened in the first days after purchase.

If your project needs a registry lock, ask support: availability and price depend on the registry of the specific zone.

## If the domain was hacked

A separate scenario that accounts for a noticeable share of hold statuses among honest owners: the site or the hosting account was hacked, someone else's content appeared on the domain, a complaint came in, the registrar set clientHold. The order of actions:

1. Change the passwords for hosting, the registrar panel and email, enable two-factor protection.
2. Remove the foreign content and close the hole it came through. Keep screenshots and logs: you will need them for the reply.
3. Answer the registrar on the substance: what happened, what was done, when. The registrar does not establish the fact of a hack; it checks whether the violation has been removed, so the reply has to be specific.
4. After the status is lifted, check the domain record a week later: a hold sometimes returns if the registrar received a repeat complaint about an old link.

For Riki Domains customers support walks this path: tell the [support chat](https://t.me/riki_domains_support) that the domain was hacked and attach the evidence that the problem is fixed.

## Owner's checklist

- The transfer lock (clientTransferProhibited) is always on and is lifted only right before a transfer.
- The contact-verification email is opened and confirmed in the first days after registration or a change of details.
- Auto-renewal is on and the balance holds a year's worth in advance.
- After a change of registrant or a transfer — 60 days without a transfer, plan ahead.
- Two-factor protection is on for the registrar account and for the email the domain is tied to.
- Once a quarter — a look at the domain record in RDAP: statuses, nameservers, expiry date.

If the project cannot afford even a short outage — registry lock, plus a separate procedure for the day a change is needed urgently after all.

## FAQ

**What is the difference between clientHold and clientTransferProhibited?**

clientTransferProhibited is a protective lock: the domain works, only a transfer to another registrar is blocked. clientHold is a shutdown: the domain is removed from the DNS zone, the site and mail stop, although the registration remains.

**Can I transfer a domain while it is on clientHold?**

No. The hold has to be lifted first, then the clientTransferProhibited lock, and only then does the registrar issue the authorization code. A transfer is not a way around a suspension.

**How fast is clientHold lifted after I confirm my contact details?**

The status is usually lifted within hours of confirmation and DNS recovers within a few hours, in rare cases up to a day. If the status was set after a complaint, the timing depends on the correspondence with the registrar.

**What is the 60-day transfer lock?**

An ICANN rule: for 60 days after registration, after a transfer and after a change of registrant the domain cannot be moved to another registrar. It is not a registry status but a policy restriction, and a registrar cannot lift it on request.

**Where can I see my domain's statuses?**

In the domain's public record through any RDAP or WHOIS service, in the Domain Status field. At Riki Domains the status is shown in the domain list in the bot and in the web panel.