Registrar locks and waiting periods

The two kinds of lock

A registrar lock is set by the registrar that sponsors the name and appears in status data as clientTransferProhibited. It is on by default at most registrars, it exists to stop unauthorised transfers, and the registrant can switch it off in the control panel in seconds. Every normal transfer starts by removing it.

A registry lock is set at the registry itself and appears as serverTransferProhibited. It cannot be lifted from a control panel. Registries offer paid lock services for valuable names where changes require an out of band identity check with named contacts, often by telephone. Registries also apply server side locks for their own reasons, such as an unresolved dispute or a compliance issue.

The difference matters when a deadline is being agreed. A registrar lock costs a minute. A registry lock can take days to release because a human at the registry has to authenticate the request.

The sixty day rule for generic extensions

Under the transfer policy that governs .com, .net, .org and other generic extensions, a registrar may refuse an outbound transfer when the name was registered or transferred within the previous sixty days. This is the rule that catches buyers who plan to move a freshly bought name straight to a preferred registrar.

The same policy imposes a sixty day inter-registrar transfer lock after a change of registrant. The previous registrant can opt out of that lock before the change is made, but the opt out has to be chosen at the time, not afterwards. Registrars implement this differently and some do not expose the opt out at all.

Both rules apply to the registrar to registrar move, not to a push inside one registrar. That is the main reason a push is often the cleaner mechanism when the name has recently changed hands, as described in how a domain name changes hands.

A revision of the generic extension transfer policy has been agreed within the industry and will change parts of this framework once registrars have implemented it. Until a registrar states that it operates under the new rules, plan around the sixty day periods described above.

Country code registries work differently

Country code registries set their own policies and most of them do not impose a sixty day period at all.

DENIC executes a .de provider change as soon as a valid AuthInfo is presented, and a holder change can run alongside it. DNS Belgium executes a .be transfer immediately once the transfer code validates. SIDN moves a .nl name as soon as the gaining registrar submits a valid token. Nominet moves a .uk name when the registrar tag changes.

The absence of a waiting period does not mean the absence of friction. The delay in these extensions sits in getting the code or the token out of the losing registrar, which can take several days when the request goes through a support queue.

Locks that are not transfer locks

Two other statuses stop a deal even though the transfer lock is off.

• clientUpdateProhibited and serverUpdateProhibited block changes to contacts and nameservers. A buyer who can transfer the name but cannot edit it has an incomplete handover.
• pendingDelete, redemptionPeriod and quarantine mean the name is on its way out of the register. Names in these states cannot be transferred and should not be paid for as if they were normal stock. Several European registries hold cancelled names in quarantine for a fixed period before releasing them.

Check the status codes with a WHOIS or RDAP lookup before agreeing anything, using the method in verifying the seller.

Building the periods into the agreement

A handover deadline that ignores a live waiting period is a deadline that will be missed, and a missed deadline is where disputes start.

1. Look up the name and read every status code before the price is agreed.
2. Ask the seller directly when the name was registered, when it was last transferred, and whether the registrant details were changed recently.
3. If a waiting period is running, agree either a push at the current registrar or a handover date after the period ends.
4. Write the chosen mechanism and date into the agreement rather than leaving it to be worked out later. The clauses that matter are set out in purchase agreement essentials.

A seller who cannot say when the name last moved has not looked. Ask for a screenshot of the domain overview page in the registrar account.

When a lock appears mid deal

Occasionally a lock goes on after the deal is agreed. Registrars apply automatic locks after a password reset, after a suspected account compromise, or when registrant contact verification lapses.

The response is the same in each case: hold the payment, ask the seller for the registrar ticket number, and reset the handover deadline once the registrar has confirmed the cause. Releasing funds against a promise that the lock will clear leaves the buyer with no leverage and no name.