A woman examining a futuristic interface screen with multiple dashboards of maps covered with an overlay of city lights.

Verisign Registry Lock Service

Verisign Registry Lock Service can help ensure that .com, .net, .cc, and .name domain names do not get hijacked

"Domain name hijacking," in which perpetrators fraudulently transfer domain names, can have a significant impact on individuals and organizations. To help protect against hijacking of domain names, Verisign Registry Lock Service is available for domain names in .com, .net, .cc, and .name through participating domain name registrars.

What is Verisign Registry Lock Service?

Verisign Registry Lock Service can help ensure that .com, .net, .cc, and .name domain names do not get hijacked. Domain name hijacking occurs when an attacker gains unauthorized access to registration data for a domain name, thereby gaining administrative control over the domain name that enables them to modify several elements of the domain name, including the website to which the domain name resolves.

Because Verisign is the registry operator for .com, .net, .cc, and .name, only Verisign Registry Lock Service can offer this type of registry-level protection for these top-level domains (TLDs).

IT technical support specialist working on multiple digital screens with bright network maps in a monitoring control room.

Why is it important to lock a domain name at the registry level?

Registry-level locking of domain names provides additional levels of authentication between the registry (Verisign in the case of .com, .net, .cc, and .name) and the registrar of the domain name. If an end customer requests a change to a registry-locked domain name, an authorized individual at the registrar must submit a request to Verisign to unlock the domain name. This authorized individual at the registrar is then contacted by Verisign via phone and required to provide an individual security phrase in order for the domain name to be unlocked. This "out-of-band" step helps protect against automation errors and system compromises.

Verisign Registry Lock Service can be used to apply registry-level locks to domain names and hosts (name server names) either independently or in combination. For example, using the Verisign Registry Lock Service, registry-level locks can be placed on the domain name “example.com” which may have one or more host records such as “ns1.example.com, ns2.example.com”. In such a case, there would be three separate locks (one for the domain name and two for the hosts). Furthermore, Verisign Registry Lock Service cannot be used where hosts are in non-Verisign TLDs (i.e., ns3.example.test). Locking the hosts in addition to the domain name is critical in stopping attacks which attempt to change the name server(s) where resolution occurs.

How can I be sure my domain name is locked at the registry level?

Our Whois lookup tool will enable you to check if your domain names are locked at the registry. Type your domain name into the Whois lookup bar. In the results, there are up to four status fields: Delete, Renew, Transfer, and Update. Delete, Transfer, and Update are the critical statuses for locking your domain name. Using Update as an example, if the status for Update says "serverUpdateProhibited" then your domain name is locked at the registry level and cannot be unlocked (and therefore changed) without out-of-band authentication between Verisign and your registrar. The word "server" and "prohibited" must appear for all three statuses (Update, Delete, Transfer) for the domain name to be registry locked.

If the Whois results for your domain name only indicate "clientUpdateProhibited," this means that your domain name has been locked by your registrar, but not at the registry level. If your Whois results show both client and server as "prohibited," your domain name is locked by both your registrar and registry. This provides a greater level of protection to help prevent against domain name hijacking.