There are two domain transfer locks. The mandatory 60-day ICANN lock is applied automatically after you register a new domain or recently transfer one; it’s an anti-fraud rule and cannot be removed early. The optional registrar lock (the clientTransferProhibited status) is a switch you control to block hijacking — leave it on for domains you keep, and turn it off only when you deliberately start a legitimate transfer. To transfer, you also need the EPP authorization code from your current registrar.
The confusion is understandable: both locks stop a domain from moving registrars, but they exist for different reasons and behave completely differently. One is a fixed waiting period imposed by policy; the other is a security setting you turn on and off. Knowing which is which is the difference between “why won’t this transfer?” and a smooth move.
A status that prevents a domain from being moved to another registrar. Two kinds exist: a mandatory 60-day ICANN lock applied automatically after a new registration or recent transfer, and an optional registrar lock (clientTransferProhibited) the registrant can toggle on or off to guard against unauthorized transfers.
The two locks side by side
The clearest way to keep them straight is to put them next to each other. They differ on every axis that matters — who imposes them, whether you can remove them, and what they’re for.
| Aspect | Mandatory 60-day lock | Optional registrar lock |
|---|---|---|
| Who applies it | ICANN policy, automatically. | You, the registrant. |
| When | After a new registration or a recent transfer. | Any time, on or off. |
| Can you remove it? | No — you wait out the 60 days. | Yes — toggle it in your account. |
| Status shown | A transfer-prohibited state tied to the lock period. | clientTransferProhibited. |
| Purpose | Anti-fraud cooling-off window. | Anti-hijacking switch you keep on. |
So if a transfer is being refused, the first question is which lock is in play. If the domain was registered or transferred within the last 60 days, you’re looking at the mandatory lock and there’s nothing to do but wait. If it’s older than that, the block is almost certainly the optional registrar lock — which you can clear yourself.
The mandatory lock can also follow a registrant change
The 60-day lock isn’t only triggered by registration and transfer. Under ICANN’s change-of-registrant process, certain updates to the registrant contact details can also apply a 60-day transfer lock unless you opt out where that’s permitted. The logic is identical: give the rightful owner a window to catch and reverse an unauthorized change before the name can leave.
Unlocking for a legitimate transfer
When you genuinely want to move a domain to a new registrar, the optional lock is the one you interact with. The process is straightforward:
- Check the 60-day lock doesn’t apply. If the domain was registered or transferred recently, you must wait until that mandatory window expires — it can’t be lifted early.
- Turn off the registrar lock. In your current registrar’s domain settings, disable the lock so the
clientTransferProhibitedstatus is cleared. - Get the authorization code. Request the EPP authorization code (auth code) from your current registrar; the gaining registrar needs it to pull the domain across.
- Start the transfer at the new registrar. Submit the domain and auth code there and approve the transfer when prompted.
The auth code is central to the whole thing. It’s a per-domain secret that proves to the new registrar that you’re entitled to move the name — without it, the transfer simply can’t start. That’s why the optional lock and the auth code work together: the lock stops anyone from initiating a transfer, and the code stops anyone from completing one. Our full transfer guide walks through the end-to-end flow.
Why you should leave the optional lock on
For any domain you intend to keep, the optional registrar lock should be your default-on setting. It costs nothing, doesn’t affect how your site or email works, and provides a meaningful layer of protection against one of the worst things that can happen to a domain: hijacking, where an attacker who gains access tries to spirit the name away to another registrar.
An unlocked domain plus a leaked auth code is a hijack waiting to happen
The two safeguards only protect you together. If a domain is unlocked and its auth code is exposed, someone could attempt to transfer it away. Keep the registrar lock on except during a deliberate transfer, treat the auth code like a password, and regenerate it after any move. The lock is the cheap insurance; the code is the key — guard both.
A simple rule of thumb
Lock on, code secret. Only unlock in the moment you’re starting a transfer you initiated yourself, and re-lock (or let the new registrar lock) as soon as it completes. Combine this with auto-renew and you’ve covered the two biggest ways people lose domains: forgetting to renew, and unauthorized transfers.
★ Key takeaways
- The 60-day ICANN lock is mandatory after a new registration or recent transfer and can’t be removed early.
- The optional registrar lock (
clientTransferProhibited) is a switch you control — leave it on for domains you keep. - To transfer, clear the optional lock and get the EPP auth code from your current registrar.
- A registrant-contact change can also trigger a 60-day lock; an unlocked domain plus a leaked code invites hijacking.
Frequently asked questions
What is the 60-day transfer lock?
The 60-day transfer lock is a mandatory ICANN policy that prevents a domain from being transferred to a different registrar for 60 days after it is newly registered or recently transferred. It is an anti-fraud measure, it applies automatically, and it cannot be removed early — you simply have to wait out the window before a registrar transfer is possible.
How is the registrar lock different from the 60-day lock?
The registrar lock is optional and under your control. Shown as the clientTransferProhibited status, you can turn it on or off in your account to block or allow transfers. The 60-day lock, by contrast, is mandatory, applied automatically by policy, and cannot be toggled off. One is a switch you own; the other is a fixed waiting period.
How do I unlock a domain before transferring it?
Log into your current registrar, open the domain’s settings, and turn off the registrar lock (clear the clientTransferProhibited status). Then request the EPP authorization code, which the new registrar needs to pull the domain across. You cannot unlock the mandatory 60-day lock — if it applies, you must wait until it expires.
Should I leave the optional transfer lock on?
Yes, for domains you intend to keep. The optional registrar lock is a simple, free defence against hijacking: with clientTransferProhibited set, no one can move the domain to another registrar without you first unlocking it. Leave it on by default and only turn it off in the moment you are deliberately starting a legitimate transfer.
Does changing my registrant details trigger a lock?
It can. Under ICANN’s change-of-registrant process, certain updates to the registrant contact information can apply a 60-day transfer lock unless you opt out where allowed. The intent is the same as the post-registration lock: give the rightful owner a window to catch and reverse an unauthorized change before the domain can be moved.
Sources & further reading
- ICANN — Internet Corporation for Assigned Names and Numbers (inter-registrar transfer and change-of-registrant policy)
- IANA — Root Zone Database (which registry operates each extension)
- Related: how to transfer a domain, what is an EPP / authorization code?, how to choose a domain registrar, how to register a domain name, domain transfer vs redemption, domain auto-renew explained