Transfer lock is a security mechanism that prevents your domain from being transferred to a different registrar without your authorisation. There are two distinct types that are commonly confused.
Type 1: ICANN’s 60-day post-registration lock
ICANN (the body governing domain registration) mandates that newly registered domains cannot be transferred for 60 days after initial registration. This lock also applies after a transfer-in — you can’t transfer out again for 60 days.
Purpose: prevent domain hijacking via social engineering (e.g., convincing a registrar support agent to initiate an unauthorised transfer while the registrant can’t respond).
Who controls it: ICANN policy. No registrar can waive this lock for you. It’s non-negotiable.
Implication: if you register a domain and immediately decide you want to move to a cheaper registrar, you’re waiting 60 days. Plan accordingly.
Type 2: The registrar lock (user-toggled)
Separate from ICANN’s mandatory lock, registrars offer a voluntary “registrar lock” (also called “domain lock” or “transfer protection”) that you can enable and disable. When enabled, the domain can’t be transferred even with the correct EPP auth code.
Purpose: additional security layer. If your registrar account is compromised, the attacker still can’t transfer your domain if registrar lock is on.
Who controls it: you, in your domain settings dashboard.
How to disable: one click in most registrars. GoDaddy historically required multiple confirmation steps and sometimes a support call — a pain point that slowed legitimate transfers and frustrated the “renewal-shock refugee” cohort.
Transfer lock transparency: a ranking criterion
| Registrar | Unlock process | Transfer wait time |
|---|---|---|
| Cloudflare | One toggle in dashboard | Immediate unlock |
| Porkbun | One toggle in dashboard | Immediate unlock |
| Namecheap | One toggle in dashboard | Immediate unlock |
| GoDaddy | Multiple confirmation steps, sometimes requires support | Can take hours |
GoDaddy’s more complex unlock process is a meaningful friction source for users trying to transfer out. It’s not a reason to avoid GoDaddy, but it’s an operational reality to account for if you’re migrating multiple domains under deadline pressure.
The EPP code and the lock
To initiate a transfer, you need both: (1) the registrar lock off, and (2) the domain’s EPP auth code (also called transfer auth code). Both must be satisfied simultaneously. Get the auth code while the lock is on and it won’t work. Disable the lock before requesting the auth code to avoid confusion.
Why it matters when picking a registrar
If you anticipate ever migrating domains (GoDaddy refugees: yes), choose a registrar with a simple, one-click unlock process. Friction at transfer time can cost you real money if renewal deadlines are approaching.