Domain locked — the three kinds of lock and how to clear each
"Your domain is locked" can mean three different things. The registrar (transfer) lock — clientTransferProhibited — is a safety toggle you switch off yourself in the dashboard. The ICANN 60-day locks — after a new registration, a transfer, or a registrant change — are policy and cannot be lifted; they expire on their own. And registry-level locks — serverTransferProhibited and relatives — sit above your registrar and can only be changed by asking your registrar to act (they're common on premium 'registry lock' security products and disputes). An RDAP lookup shows exactly which statuses your domain carries, which tells you which case you're in.
1. The registrar lock (you control it)
Every mainstream registrar sets clientTransferProhibited by default — it's the safety catch that stops anyone moving your domain with a stolen auth code. It's meant to be toggled: find 'domain lock' / 'transfer lock' in your dashboard, switch it off, do your transfer, and it gets re-enabled at the new registrar. If your dashboard's unlock toggle is greyed out, that usually means one of the other two lock types is also present.
2. The ICANN 60-day locks (you wait them out)
These are policy locks with fixed durations, not settings:
- After a new registration — no transfers for the first 60 days
- After a transfer — no onward transfer for 60 days
- After a registrant (owner contact) change — many registrars apply a 60-day transfer lock; some let you opt out before making the change, none remove it after
- After renewing a domain that had expired — expect a ~45-day wait past the original expiry date before transferring
3. Registry-level locks (your registrar must act)
Statuses beginning with server — serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited — are set at the registry, one level above your registrar. You'll see them on premium 'registry lock' products (deliberately, as a security feature), on domains under dispute, and occasionally on legal holds. Neither you nor the gaining registrar can clear them; the losing registrar must request the change from the registry. If you bought a registry-lock product, disabling it is part of that product's process and typically involves extra identity verification — that friction is the feature.
Which lock do I have?
Run the domain through an RDAP/WHOIS lookup and read the status lines. client* statuses → your registrar's dashboard toggles. Recently registered, transferred, or changed owner → a 60-day policy lock; check the dates. server* statuses → ask your registrar to act. Our registrar-lookup tool shows these statuses for any domain, with the registrar of record.
Three distinct 'locked domain' cases: (1) clientTransferProhibited — registrar transfer lock, user toggles it off in the dashboard; (2) ICANN policy locks — 60 days after registration, transfer, or registrant change (opt-out for registrant-change lock exists only before the change at some registrars); ~45 days after a post-expiry renewal; these expire, they cannot be lifted; (3) server* statuses (serverTransferProhibited etc.) — registry-level, only the current registrar can request removal; expected on registry-lock security products and disputes. Diagnose via RDAP status lines: client* → dashboard, dates → wait, server* → registrar ticket.