Domain Lock, or Registrar Lock, is a security feature that prevents your domain from being transferred to another registrar without your authorization. It's a critical protection layer that every website owner should know about and enable.
1. What Is Domain Lock and How Does It Work?
When a domain is in "Locked" status (technically "clientTransferProhibited"), the registry automatically rejects any transfer request — even if the requester has the EPP Code (Auth Code). This means that even if a hacker steals your EPP Code, they still cannot transfer the domain because of the lock.
Think of Domain Lock as a two-layer security deadbolt: it can only be unlocked when:
- You log into your registrar's portal and manually remove the lock yourself
- Only then can you request the EPP Code and initiate a transfer
Critical: Domains without locks can be "domain hijacked" if your email account is compromised and someone intercepts the EPP Code. Domain Lock prevents this scenario.
2. Domain Lock Status Types
| Status | Meaning |
|---|---|
| clientTransferProhibited | Locked by registrar (good default) |
| clientUpdateProhibited | Prevents WHOIS modifications |
| clientDeleteProhibited | Prevents domain deletion |
| serverTransferProhibited | Locked by registry (higher-level lock) |
| ok / active | No lock — high risk, should add clientTransferProhibited |
3. Understanding EPP Codes and Their Role in Domain Security
An EPP Code (also called Auth Code or Authorization Code) is a unique secret string assigned to every generic TLD domain (.com, .net, .org, etc.). It acts as the second key in a two-factor process: the registrar lock is the first barrier, and the EPP Code is the second. Both must be in place — and in the right hands — for a transfer to succeed.
Here is how the EPP Code fits into the overall transfer flow:
- Remove the registrar lock — without this step the registry rejects the transfer request outright, no matter how valid the EPP Code is.
- Request the EPP Code — after unlocking, you can generate the code from your billing.in.th domain management panel. AsiaGB sends it to the admin email on file.
- Submit the code at the gaining registrar — the new registrar submits the code to the registry, which validates it against its database.
- Approve the confirmation email — the registry sends a transfer confirmation email to the admin contact. You have five days to approve or reject it.
EPP Code expiry: EPP Codes issued through AsiaGB expire after 24 hours if not used. If the transfer window passes, simply request a new code. Never share an EPP Code over email or chat with an unverified third party — treat it like a one-time bank PIN.
A common misconception is that having the EPP Code is enough to complete a transfer. In reality, ICANN's Inter-Registrar Transfer Policy requires that the domain must not have any prohibiting status codes (clientTransferProhibited or serverTransferProhibited) at the time of the transfer request. The EPP Code alone cannot override a lock — both conditions must be met simultaneously.
4. When to Unlock Your Domain — and When Not To
Knowing when it is safe to remove the lock is just as important as knowing how to enable it. Below is a practical reference table for common situations domain owners face:
| Situation | Unlock Required? | Reason |
|---|---|---|
| Transferring domain to another registrar | Yes | Registry rejects transfer while locked |
| Renewing the domain | No | Renewal does not require an unlock |
| Editing DNS records or nameservers | No | Lock only restricts transfers, not DNS management |
| Someone emails asking for your EPP Code | Never | Likely social engineering — verify through your panel |
| Domain is in Redemption Period | Not applicable | Registry-level hold overrides registrar lock entirely |
| Updating WHOIS contact information | No (usually) | Unless clientUpdateProhibited is also set |
The golden rule is simple: keep the lock enabled at all times and remove it only during an active, intentional transfer. Once the transfer completes — or if you change your mind and cancel — re-enable the lock immediately. Leaving a domain unlocked unnecessarily is the single biggest avoidable risk in domain management.
5. Registrar Lock vs Registry Lock: What's the Difference?
Many people confuse "Registrar Lock" with "Registry Lock." Both are mechanisms that prevent unauthorized domain transfers, but they operate at different layers and offer very different levels of security. Understanding the distinction helps you choose the right level of protection for the importance of your domain.
Registrar Lock (or clientTransferProhibited) is a lock applied at the registrar level — the registration provider you currently use, such as AsiaGB. It is the standard setting that should stay enabled at all times. You can turn it on or off yourself directly from your control panel, with no waiting required. It is ideal for typical domains belonging to small and mid-sized businesses.
Registry Lock (or serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited) is a lock applied at the registry level — the central organization that manages the entire domain extension's database, such as Verisign for .com/.net. It is the highest-level lock that even the registrar cannot change through automated systems. Removing it requires a manual identity-verification process (often a phone call or multi-step confirmation), making it the most secure but also the most cumbersome option.
| Aspect | Registrar Lock | Registry Lock |
|---|---|---|
| Applied at level | Registrar (your provider) | Registry (extension's central authority) |
| EPP status | clientTransferProhibited | serverTransferProhibited |
| Self-service toggle | Instant via control panel | No — requires a manual process |
| Security level | High (blocks automated transfer) | Highest (blocks even the registrar) |
| Best for | Typical domains, most businesses | Major brands, enterprises, banks, high-value domains |
| Cost | Free (included in registration) | Usually an additional service fee |
In short: For typical business websites, Registrar Lock is sufficient. But if your domain is a well-known brand or carries very high business value (for example, the primary domain of a large organization), investing in Registry Lock is worthwhile because a hacker cannot bypass it even if they successfully breach the registrar's systems.
6. How to Check If Your Domain Is Locked
Method 1: Via WHOIS Tool
Use a WHOIS lookup tool (like AsiaGB's WHOIS tool) to search your domain. Look at "Domain Status" — if you see clientTransferProhibited, your domain is locked.
Method 2: Via Your Registrar Portal
Log into AsiaGB's control panel at billing.in.th → go to Domains → select your domain → check the "Registrar Lock" status.
7. How to Enable/Disable Domain Lock at AsiaGB
- Log into billing.in.th with your account credentials
- Go to Domains → My Domains
- Click on the domain you want to manage
- Find the "Domain Information" or "Manage" tab
- Toggle the Registrar Lock on or off as needed
⚠️ Only unlock your domain when you're actively transferring it. After the transfer is complete, re-enable the lock immediately. Never leave your domain in an unlocked state unnecessarily.
8. Warning Signs That Your Domain May Be at Risk
Domain hijacking rarely happens without some early indicators. Hackers typically probe or collect information before making their move. Recognizing these warning signs early lets you shut down the threat before it becomes a crisis:
- A transfer confirmation email you did not initiate — someone has already submitted a transfer request using your domain. Do not approve it; investigate immediately and contact AsiaGB support via ticket.
- A "password changed" or "new device login" notification for your registrar account or admin email — an attacker may have already compromised one of these accounts.
- WHOIS data showing different owner details or nameservers that you did not change — the domain may already be under someone else's control.
- Your website redirecting to an unfamiliar page or DNS pointing to unknown servers — nameservers may have been altered for phishing or traffic interception.
- Emails suddenly going missing — MX records may have been modified to intercept incoming mail, including transfer verification messages.
- Phishing emails posing as your registrar asking you to "verify your account" or "unlock your domain urgently" — always navigate directly to billing.in.th by typing the URL yourself, never by clicking links in unsolicited emails.
If you notice any of these signs: Change your registrar account password and admin email password immediately, enable 2FA if it is not already on, verify that your registrar lock is still enabled, and open a support ticket with AsiaGB so the team can investigate and assist you as quickly as possible.
9. The Domain Expiry Lifecycle and Why Auto-Renew Matters
In addition to locking, another critical protection is enabling Auto-Renew so the system automatically renews your domain before expiration. Domains that lapse through the full expiry cycle become easy targets for competitors, domain investors, and bad actors who monitor expiring names. Understanding each phase helps you see why acting early is essential:
| Phase | Duration | Cost | Risk |
|---|---|---|---|
| Active (normal operation) | Until expiry date | Standard renewal price | None |
| Grace Period | 0–45 days after expiry | Standard renewal price | Website and email stop working |
| Redemption Period | 30 days after Grace Period | High recovery fee (often 2,000–5,000+ THB) | Very high — expensive to recover |
| Pending Delete | 5 days before release | Cannot be renewed | Very high — back-orders queued |
| Released / Available | After Pending Delete | Standard registration price | Highest — anyone can register it |
Enabling Auto-Renew at billing.in.th means the system attempts to charge your payment method approximately 30 days before the expiry date. If payment succeeds, your domain renews without any action required from you. Check your domain's expiry date at least every three months and confirm that Auto-Renew is still active — especially after updating payment methods.
10. Frequently Asked Questions
If my domain is locked, do I still need to protect my EPP Code?
Yes, keep it confidential. But with the lock enabled, even if someone knows your EPP Code, they cannot transfer the domain.
Do .co.th domains have domain lock?
Yes, but Thai ccTLD domains operate through THNIC's own lock process. Contact AsiaGB support for guidance on managing .co.th domain security.
Is there an extra cost for domain lock?
No. Domain Lock is a standard feature included in the domain registration fee — no additional charge.
Register Your Domain with Lock Protection
.com from 500 THB/year · Free Domain Lock · Auto-Renew Available
Register Domain at AsiaGB