Why do some lookups show lock statuses with spaces?

A Registration Data Access Protocol (RDAP) lookup may display client transfer prohibited rather than the status code clientTransferProhibited. These labels refer to the same registrar-level transfer restriction; changed formatting does not show that the lock was removed.

How can a registrar remove clientUpdateProhibited if updates are blocked?

An update that removes clientUpdateProhibited is allowed despite that restriction. This exception lets the sponsoring registrar clear its own update lock; it does not let that registrar remove a server-set lock.

Can Verisign Registry Lock cover a nameserver host in another registry's extension?

Verisign's service cannot lock a nameserver host under an extension outside that service's coverage. Protection for such a host depends on its separate registry and registrar, rather than on the lock for your domain.

Do transfer, update, or delete locks prevent domain renewal?

Restrictions on transfer, update, or deletion do not themselves prohibit renewal. If renewal is refused, check for clientRenewProhibited or serverRenewProhibited and ask which underlying condition applies.

How do I replace a registry-lock approver who has left the company?

Appoint a replacement through the service's verified contact-change procedure. For .be Domain Guard, you submit a form to change the authorized person through your registrar.

Does a temporary unlock stay open until I decide to relock the domain?

Some services relock automatically after an approved window. For .be Domain Guard, the registry re-enables protection after 48 hours, and the registrar can ask for earlier reactivation during office hours.

Why might a temporary registry unlock still leave transfer or deletion blocked?

A temporary unlock may authorize updates while leaving other operations restricted. With .be Domain Guard, a transfer or deletion requires permanent cancellation of the service rather than its temporary update window.

Does DNSSEC replace registry lock?

DNSSEC authenticates DNS data with digital signatures, while registry lock controls whether protected registration changes can be made. Enabling DNSSEC does not itself remove transfer, delete, or update restrictions on the registration.

Is domain privacy the same as registry lock?

A privacy service substitutes contact details in public registration data rather than applying a registry lock. Keeping contact information private does not by itself impose transfer, update, or deletion restrictions at the registry.

Is a 60-day transfer restriction the same as a registry-lock service?

For gTLDs, a 60-day transfer restriction can follow initial registration, a registrar transfer, or certain registrant changes under the transfer policy. It limits when a registrar move can happen, while a registry-lock service adds a separate approval mechanism for protected operations.

Registry Lock vs Registrar Lock

A domain lock limits which registration changes can go through. A registrar lock is controlled at the registrar level; a registry lock service adds a control at the registry, which may require a separate verification step before a protected request is accepted. Both can reduce the chance of an unauthorized transfer or change, but neither is a promise that every account or DNS problem is prevented.

The word lock is used for several statuses and services. Read the actual status code and ask the provider what set it before concluding that a paid registry-lock product is active. Registration locks control the domain's registration record; they do not themselves protect website files or edits made only within a DNS zone.

See Where Each Lock Acts

The registrar is the provider that manages the registrant's account and sends registration requests to the registry. A registrar-side lock can tell the registry to reject a class of requests for the domain. For example, clientTransferProhibited prevents a registrar transfer while it remains in place. The registrant generally uses their account at the registrar or its support process to remove the lock when an authorized transfer is planned.

The registry operates the top-level domain's registration system. A registry-side restriction is applied there, so a request that passes a registrar account check can still be rejected at the registry. A commercial registry-lock service can add a separate approval path between registrar and registry.

With Verisign Registry Lock, an authorized registrar contact requests an unlock, and Verisign then calls that contact to verify an individual security phrase. This out-of-band check uses a channel separate from the normal automated registration request. Other registry-lock services may use different verification procedures.

Protection depends on which actions are restricted. A transfer lock affects a registrar move. An update lock can block changes to registration data such as nameserver delegation. A delete lock can prevent deletion requests. Ask for the specific operations covered; a single transfer-prohibited flag does not show that update and deletion are also protected.

A domain registration and a nameserver host record can be separate objects in the registry. With Verisign Registry Lock, domain names and host records can be locked separately or together. Protecting the domain alone does not establish that a related host record is also locked. Ask which records are covered if you operate nameservers registered under the domain.

Read Client and Server Status Codes

The client prefix marks statuses set by the registrar, while server marks statuses set by the registry operator. clientTransferProhibited and serverTransferProhibited can both prevent an inter-registrar transfer, but they point to different control layers. Similar pairs exist for update and delete restrictions. The visible codes describe what requests will be rejected, not necessarily why the restriction was placed.

That distinction matters when interpreting a lookup. A serverUpdateProhibited or serverTransferProhibited status does not, by itself, prove that the registrant purchased a specific registry-lock service. These server-level restrictions can also be applied during legal disputes, at a registrant's request, or in redemption-related circumstances. Ask the registrar to confirm the restriction's reason and whether the name is enrolled in the service.

Multiple statuses can coexist. A domain can have client and server transfer restrictions at the same time. Removing only the client status may leave the server status active. Read the whole status set, including any hold or pending state, before attributing a rejected request to the wrong layer. A hold can also stop DNS resolution, which is a different effect from blocking a transfer.

Find Out Who Can Remove the Lock

For a normal registrar lock, begin in the registrar's domain-management area. An authorized registrant may be able to toggle transfer protection or request support to remove it. For generic top-level domains (gTLDs), the holder must have a reasonable way to remove an ordinary registrar transfer lock, subject to policy and legal restrictions. Follow the provider's authentication steps and plan the unlock close to a legitimate transfer, then review the resulting status.

A registry-level lock may require the registrar to contact the registry through a separate channel. The registrant typically cannot clear it by clicking a standard account toggle. With a service that requires separate registry approval, the usual registrar sign-in alone cannot authorize the registry-side unlock. Other registry services can differ in availability and procedure. Ask the current registrar whether the extension supports such a service, what actions are covered, and how emergency changes are handled before relying on it.

If an unexpected restriction appears, do not ask support to remove it blindly. First establish who set it and whether it protects a pending dispute, recovery process, or previously requested security control. An account administrator may need to prove authority and follow the documented process even when a change is urgent.

Plan Protected Changes

Before scheduling a registrar transfer, nameserver change, or deletion, list the exact operation and the status codes that would block it. A domain transfer may require a valid authorization code and approval from the registered name holder as well as removal of transfer restrictions. Changing the authoritative nameservers can require lifting an update restriction but does not necessarily require removing transfer protection. Ask the provider to limit an unlock to the needed operation and time where its service permits that.

For a planned infrastructure migration, coordinate any registry-level verification before the maintenance window. The added approval step can be valuable security, but it may also delay a legitimate urgent change. Confirm who at the registrar can request the unlock and who in your organization can approve it. Keep a record of the request, the codes before and after, and confirmation that protections were restored once the work is complete.

Keep the Registration Account Secure

Locking the registration does not replace account controls. Use a unique password, additional sign-in protection when available, accurate recovery contacts, and limited administrator access. Review account activity and renewal settings. A registry lock can constrain certain registration operations, but a compromised account may still expose invoices, contacts, support communications, or DNS controls outside that locked path.