What Is Domain Locking and How Does It Protect Your Website?

Domain locking is a registrar security control that blocks your domain from moving to another registrar without authorisation.

For many generic domains, the locked registration carries the status clientTransferProhibited, which instructs the registry to reject an inter-registrar transfer.

That protection is important because whoever controls your domain can redirect your website, interfere with domain email, and impersonate your brand.

But the name can create confusion: a domain lock protects the registration from transfer.

It does not scan your website for malware, secure your hosting account, renew an expired domain, or replace strong login security.

What domain locking means

A domain registrar manages your registration and sends instructions to the registry responsible for the extension.

A standard registrar lock tells that registry not to accept a request to move the domain to another registrar.

ICANN calls this status Registrar Lock or Client Transfer Prohibited.

You may see labels such as Domain Lock, Transfer Lock, Registrar Lock, Theft Protection, or clientTransferProhibited in a dashboard or registration lookup.

The control adds a necessary step to a legitimate transfer: the authorised holder must unlock the domain before the move can proceed. It also turns an unauthorised transfer request into a rejected request while the lock remains active.

Domain locking has nothing to do with the padlock icon in a browser. That icon represents HTTPS encryption between the visitor and website. A site can have HTTPS while its domain remains unlocked, or carry a registrar lock while its website lacks a valid SSL certificate.

What happens when you turn the lock on

Your website, email, nameservers, and DNS records should continue working normally.

The standard transfer lock changes the permission to move the registration; it does not move the website or edit its content.

For a generic top-level domain such as .com, the sequence normally works like this:

1. You or your registrar enables the transfer lock.

2. The registrar sets clientTransferProhibited on the registration.

3. Another registrar submits a transfer request.

4. The registry rejects that request while the status remains in place.

5. You unlock the domain only when you intend to transfer it, then complete the registrar’s authentication steps.

An authorisation code, sometimes called an AuthInfo or EPP code, remains a separate control. Under ICANN’s Transfer Policy, the gaining registrar supplies the code and the registry verifies it. A locked domain should still reject the transfer until the holder removes the lock.

This separation helps. An attacker who steals a transfer code still faces the lock. However, someone who controls your registrar account or its recovery email may try to disable the lock and request a new code. Treat the lock as one layer, not an unbreakable vault.

How domain locking protects your website indirectly

The lock protects the address that leads customers to your website rather than the files stored on your hosting account.

If a hijacker transfers your domain, they can try to change its nameservers or DNS records. That can send visitors to a fraudulent page, interrupt domain email, support phishing, and damage trust in your brand.

ICANN’s security guidance warns that domain hijacking can disrupt website and email services and enable impersonation.

A transfer lock reduces that risk by keeping the domain with its current registrar until an authorised person unlocks it.

The extra step also creates time for transfer alerts or suspicious account activity to reach you.

Think of the domain as the sign and directions to your business. Locking the registration helps stop someone from carrying that sign to a different registrar.

You still need to secure the building behind it: the registrar account, DNS settings, hosting control panel, website software, and business email.

Registrar lock, policy lock and registry lock are different

People often use “domain lock” for several controls. Check the exact status before deciding what to do.

ICANN’s EPP status guide distinguishes clientTransferProhibited, clientUpdateProhibited, and clientDeleteProhibited.

Do not assume that one transfer lock also blocks every DNS, contact, or deletion change.

Registry lock can add stronger protection for a high-value business domain because changes require coordination beyond the normal customer dashboard. Availability, verification, and cost depend on the registry and registrar. Ask for the exact commands it blocks before buying the service.

What a domain lock cannot protect

A registrar lock does not:

• stop an attacker from signing in if they steal your registrar password;

• guarantee that nobody can unlock the domain after compromising your account or recovery email;

• block DNS or nameserver changes unless another status or registrar control covers them;

• protect website files, databases, plugins, or hosting credentials;

• detect malware, vulnerabilities, or phishing pages;

• encrypt traffic or issue an SSL certificate;

• renew the domain or stop it from expiring;

• resolve ownership, trademark, court, registry, or abuse disputes; or

• guarantee recovery after a successful hijack.

ICANN describes a transfer lock as another security layer, not a fail-safe. That distinction matters. Leaving the lock on while sharing one weak password across staff accounts still leaves a dangerous route into the domain.

Combine locking with multi-factor authentication, a unique password, restricted account access, and a recovery email outside the protected domain. If yourbrand.co.tz stops resolving, a recovery address at that same domain may also become unreachable.

How to check and enable a domain lock

Start in the account where you registered the domain:

1. Sign in through a saved registrar address rather than an email link.

2. Open the domain’s security, transfer, or management settings.

3. Look for Domain Lock, Registrar Lock, Transfer Lock, or Theft Protection.

4. Turn the control on and complete any authentication request.

5. Confirm the setting after you refresh or sign in again.

6. For a generic domain, use ICANN Lookup and check whether the status includes clientTransferProhibited.

Not every extension exposes the same status or dashboard switch. This is especially important in Tanzania.

The TCRA .tz FAQ documents a Registry Key, also called a domain password or transfer code, for moving a .tz name. It does not promise that every .tz registrar offers the same self-service ICANN-style lock used for generic domains.

For .tz, .co.tz, .or.tz, and related names, ask your registrar which transfer lock or authorisation controls the extension supports and how you can verify them. Keep the administrative contact current because TCRA says that contact requests the transfer code through the Karibu portal or the registry channel.

If you cannot find the control, contact the registrar from the email already attached to the account. Do not accept unsolicited “security help” that asks for your password, transfer code, or one-time authentication number.

Unlock only for a transfer you started

An unlocked domain is not automatically compromised. It simply loses the transfer block, so keep the unlocked period as short and controlled as possible.

Before you unlock:

• confirm the gaining registrar and its official transfer page;

• make sure the registrant and administrative contacts can receive notices;

• enable multi-factor authentication on the registrar and email accounts;

• check whether a mandatory policy restriction already blocks the transfer;

• save the current nameservers and DNS records; and

• request the transfer code only through the official account or registry process.

Then unlock the domain, initiate the transfer yourself, and monitor every notification. Never approve a transfer you do not recognise. After the move completes, verify the registrant, expiry date, nameservers, website, and email, then enable the protection available at the new registrar.

If you plan to move an existing registration, use our guide to transferring a domain in Tanzania and confirm the rules for its extension before unlocking it.

Build a complete domain-security stack

Locking works best inside a routine that protects both the registration and the account controlling it:

• use a long, unique registrar password stored in a password manager;

• require multi-factor authentication for every administrator where available;

• keep registrar, registrant, administrative, and recovery contacts current;

• give domain access only to staff or partners who need it;

• turn on login, transfer, DNS-change, and renewal alerts where available;

• protect the transfer code and replace it if you suspect exposure;

• enable privacy protection where the extension permits it and it fits your ownership needs;

• renew early and verify the new expiry date after payment; and

• document who owns the domain and who may approve transfers.

Review those controls when an employee or agency leaves. A former collaborator may still know the login, control the recovery inbox, or appear as the registrant. Our domain protection checklist covers the broader account, DNS, renewal, and website controls that sit around the lock.

Act immediately if the domain moves without permission

If you see an unknown transfer notice, unexpected unlock, changed registrant, or unfamiliar nameserver, contact your registrar immediately.

If the name already moved, contact the previous registrar as well and state that you did not authorise the transfer.

Secure the registrar and email accounts from a trusted device. Change passwords, revoke unknown sessions, replace recovery methods, and preserve notices, receipts, account history, and screenshots.

Tell your hosting and email teams to watch for DNS changes or impersonation.

For a generic domain, ICANN says you can submit an unauthorised-transfer complaint if the registrar cannot or will not help.

For a .tz name, work through the registrar and TCRA’s official registry channels.

Speed matters because another transfer or account change can complicate recovery.

Keep control of the address your customers trust

Domain locking provides a focused benefit: it blocks an unauthorised move to another registrar while the lock remains active.

Leave it on during normal operation, unlock it only for a transfer you initiated, and support it with strong account and email security.

If you are choosing a name for a new business or website, start with a domain you can manage under the correct owner details.

Search and register your domain with us, then record the renewal and security controls from day one.