Domain Security: Locks, 2FA, and the Email Account That Owns Everything

Transfer lock: the free default

The standard transfer lock — visible as clientTransferProhibited in the domain's status codes — blocks transfer requests until the lock is removed from inside your registrar account. Every registrar offers it, it's typically on by default, and it should be on for every domain you're not actively transferring right now.

Its limit is exactly its definition: anyone who controls your registrar account can switch it off. It stops drive-by transfer attempts, not account takeover.

Registry lock: the vault for crown jewels

Registry lock is a separate, paid service in which the registry itself — above the registrar — locks the domain against transfer, deletion, and nameserver changes, and unlocking requires an out-of-band verification process between registrar staff and the registry. It defeats account takeover, because a stolen password isn't enough to move the name.

It costs real money per domain per year and adds friction to legitimate changes, availability varies by registrar and TLD, so it's not for the whole portfolio — it's for the small set of names whose loss would be catastrophic.

2FA, done properly

• •Enable 2FA on every registrar account — including the old ones with three domains you forgot about.
• •Prefer an authenticator app or hardware key over SMS; phone numbers can be hijacked via SIM-swap.
• •Store backup codes somewhere that isn't the same email account an attacker would target.
• •Audit who else has access — team members, old API keys, connected apps — and prune annually.

The real attack surface: your email account

Nearly every registrar account on earth can be reset through its email address, which makes that inbox the effective master key to your portfolio. Attackers know this; email takeover is the standard opening move in domain theft.

Harden it like it's money: strongest available 2FA (hardware key if possible), a unique password, current recovery methods. And avoid the classic circular trap — registering your registrar accounts to an email address on a domain that lives in that same registrar account. If the domain lapses or is seized, you lose the email and the account recovery path at once.

WHOIS privacy and monitoring

WHOIS privacy keeps your contact details out of public registration data — most registrars now include it free where the TLD allows it. It reduces phishing and social-engineering surface, though policies differ by TLD and some registries don't permit it.

The last layer is noticing fast. Unlocks, status changes, and nameserver changes are visible in registry data, so monitoring catches an attack in progress. A portfolio tracker with live RDAP enrichment, like Sourdough, surfaces a status change on any of your names without you polling WHOIS by hand.