Registry Lock & EPP Status Decoder
Audit domain hijacking defense posture. Decode Extensible Provisioning Protocol (EPP) status flags and evaluate out-of-band Registry Lock vs registrar-level client lock protections.
Complete EPP Status Code Reference Guide
| EPP Status Code | Authority | Security Implication & Definition |
|---|---|---|
| serverTransferProhibited | Registry | Blocks transfer requests at the registry level. Essential component of Registry Lock. |
| serverUpdateProhibited | Registry | Prevents nameserver reassignment and DNSSEC modification without out-of-band verification. |
| serverDeleteProhibited | Registry | Guarantees domain cannot be deleted accidentally or maliciously at the registry. |
| clientTransferProhibited | Registrar | Standard registrar-level transfer lock. Default on most retail domains. |
| clientUpdateProhibited | Registrar | Locks contact information and nameservers in the registrar panel. |
| serverHold | Registry | Domain is suspended from the root DNS zone by court order, law enforcement, or policy breach. |
| ok / active | Neutral | Normal status with zero locks applied; domain is fully modifiable and transferable. |
Frequently Asked Questions
What is the critical difference between a Client Lock and a Registry Lock?
A Client Lock (such as clientTransferProhibited) is applied at the registrar level via software API. If an attacker breaches the registrar account or registrar staff are compromised via social engineering, the lock can be removed instantly. A Registry Lock (serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited) is applied directly at the central registry (e.g. Verisign). Registry locks cannot be disabled via API; they require multi-party out-of-band human identity authentication.
Which EPP status codes constitute a complete Registry Lock protection suite?
A complete registry lock applies three server status flags: serverTransferProhibited (blocks unauthorized registry-level transfers), serverUpdateProhibited (prevents changes to authoritative nameservers, DNSSEC DS records, and registrant contact fields), and serverDeleteProhibited (prevents accidental or malicious domain deletion).
Why is Registry Lock considered essential for high-value corporate domain portfolios?
Without Registry Lock, domain hijacking attacks like DNS redirection can intercept corporate email, compromise single sign-on (SSO) credentials, and reroute financial transaction processing. High-value brands and financial institutions treat Registry Lock as a mandatory compliance safeguard.
How much does Registry Lock typically cost per domain per year?
Registries charge registrars an annual wholesale fee (typically $100 to $300 per year per domain), and enterprise registrars (such as CSC, MarkMonitor, Safenames) or retail registrars (such as Namecheap, Cloudflare Registrar) offer the service for $200 to $500+ annually with human verification workflows.