Reading lock state — DNS Security Practitioner

Domain status codes are published in RDAP and tell you which locks a domain actually has. The distinction that matters is the prefix: client means the registrar set it, server means the registry did.

Reading it

$ curl -s https://rdap.verisign.com/com/v1/domain/certadns.com | jq -r '.status[]'

client transfer prohibited

Checked 2026-09-15. A transfer lock, set at the registrar. No registry lock.

The codes worth knowing

Status	Set by	Prevents
`clientTransferProhibited`	The registrar, usually by default	A transfer to another registrar.
`clientUpdateProhibited`	The registrar, on request	Changes to contacts and nameservers.
`clientDeleteProhibited`	The registrar, on request	Deletion of the domain.
`serverTransferProhibited`	The registry	A transfer — and the registrar cannot remove it.
`serverUpdateProhibited`	The registry	Any change, including by someone inside your registrar account.
`serverDeleteProhibited`	The registry	Deletion, including by an attacker with full account access.

Why the prefix is the whole point

A client lock is a flag in your registrar account. Anyone who gains control of that account can clear it and then do whatever it was preventing, in the same session. It stops mistakes and unauthorised transfers initiated elsewhere; it does not stop an attacker who is already inside.

A server lock is held at the registry. Removing it requires an out-of-band process with the registrar — typically a phone call to named individuals with a passphrase. That process is the control, and it is what makes registry lock the only protection that survives a full registrar-account compromise.

When it is worth the friction

	Transfer lock	Registry lock
Cost	Free, usually on by default	An annual fee per domain, at registrars that offer it
Time to make a legitimate change	Immediate	Hours to days, by arranged process
Survives account compromise	No	Yes
Worth it for	Every domain	Domains whose loss would stop the business

The friction is the feature and it is real: a registry-locked domain cannot have its nameservers changed during an incident without going through the process. That is a deliberate trade, and it is why the answer is a handful of domains rather than the estate.

Check what you actually have

“The domain is locked” almost always means clientTransferProhibited, which most registrars set automatically and which many people believe is registry lock. One RDAP query settles it, and the answer for most primary domains is that the stronger control was never purchased.

Knowledge check

An attacker has full access to your registrar account. Which lock still stops them changing the nameservers?

serverUpdateProhibited — it is held at the registry and removing it requires an out-of-band process the account does not control.
clientUpdateProhibited, which specifically prevents nameserver changes.
clientTransferProhibited.
None — registrar account access is total.

Correct — serverUpdateProhibited — it is held at the registry and removing it requires an out-of-band process the account does not control. That out-of-band process is the actual control. Every client- prefixed lock is a flag inside the account the attacker now holds, and can be cleared in the same session.

Not this — clientUpdateProhibited, which specifically prevents nameserver changes. It does prevent them, until the attacker clears it — which they can, because it is set at the registrar and they are inside the registrar account.

Not this — clientTransferProhibited. It addresses transfers rather than updates, and it is equally removable from inside the account.

Not this — None — registrar account access is total. It is total over everything the registrar controls. Registry-held locks sit above that, which is the entire reason they exist.