The transfer lock, explained

What the lock does

With the transfer lock on, no other provider can pull your domain away. It does not stop the domain working: your site, your email and your settings carry on as normal. It only blocks a move.

A move needs two things: the lock off, and a transfer code that only you can get. Requiring both means a stolen password alone is not enough to take your domain, and a leaked code is useless while the lock stays on.

The auth code, or EPP code

The transfer code goes by a few names: auth code, authorization code or EPP code. They all mean the same thing, a password for the domain itself. The provider you are moving to asks for it to prove the move is yours to make.

Each code belongs to one domain. If you are moving several, you need a code for each, and a code can change once it has been used or after the lock goes back on.

Treat it like a password. Never post it, never send it to someone who asks out of the blue, and only request it when you are ready to move.

How to check if a domain is locked

Run a public lookup on the domain, the kind anyone can do without an account. Look at the status lines. A locked domain shows a status like clientTransferProhibited. If that line is missing, the lock is off.

For a domain in your account here, open it and the lock is shown with the domain's other settings.

You may see other status lines too. Most are routine. One worth knowing is a hold placed by the domain's own provider, which blocks a move for reasons like an unpaid renewal or a dispute. If a transfer keeps failing with the lock off, that is usually why, and the provider holding the domain can tell you more.

The 60-day hold

Some moves are blocked for 60 days whatever the lock says. This hold is a rule across the industry, and it protects owners from fast, fraudulent moves. It applies:

• after a domain is first registered,
• after a domain has been transferred to a new provider,
• after a change of owner, in many cases.

Once the 60 days are up, the domain can move again as long as the lock is off. The hold does not stop you changing DNS settings, renewing or using the domain in any other way. It only stops it changing provider.

Moving a domain away, step by step

1. Check the domain is past any 60-day hold and not close to its expiry date.
2. Make sure the owner email works. Confirmation emails go there during the move.
3. Write down your DNS settings, so your site and email keep working at the new provider.
4. Open the domain in your account and turn the lock off. You will be asked to sign in again first.
5. Ask for the auth code. If Domain Guard is on, you confirm with its 2-step sign-in.
6. Start the transfer at your new provider and enter the code there.
7. Approve any confirmation email that arrives. The move usually finishes within about a week.

Until the new provider confirms the move is complete, leave everything here as it is. Canceling the domain early, or letting it expire mid-move, can leave it stuck between the two.

Most transfers also add time to the registration at the new provider, so you do not lose the time you already have. Your domain stays registered in your name the whole time. If you want to bring a domain the other way, see connecting a domain you already own.

Locking it again

If you change your mind, turn the lock back on. It takes effect straight away and blocks any new transfer request. If a move you did not start is already under way, contact us straight away. The lock is one of a few habits that stop domain hijacking, so leave it on unless you are moving.