Why Is My Domain Transfer Blocked? Every Lock, Decoded
A blocked transfer is almost always a lock, and usually one your own registrar applied. Here is every status code and time-based rule that can stop a transfer, who controls each one, and how to tell which is holding your domain.
September 9, 20266 min readTransfers · EPP status codes · Registrars
You asked to move a domain to a new registrar and something refused. Maybe the new registrar returned an error, maybe the old one did, and maybe nothing happened at all.
A blocked transfer is almost never mysterious. There is a finite list of things that can stop one, every one of them is published in the domain's registry record, and you can read that record yourself. What makes this confusing is not the technology. It is that the party best placed to explain the lock is often the party that applied it, and they are losing your business if you succeed.
This guide covers every lock, who controls it, and how to tell which one you are looking at.
Start by reading the status codes
Every domain carries a set of EPP status codes published by its registry. They are the authoritative answer to "can this domain be transferred right now", and they are public. You do not have to ask anyone.
Run the domain through a lookup that shows its status codes and compare what comes back against the table below.
| Status code | Who set it | Blocks transfer | What to do |
|---|---|---|---|
| clientTransferProhibited | Your registrar | Yes | Ask your registrar to unlock, or unlock it yourself in their control panel |
| serverTransferProhibited | The registry | Yes | Different conversation, see below |
| pendingTransfer | The registry | Yes | A transfer is already in progress |
| pendingDelete | The registry | Yes | The domain is being deleted, transfer is no longer possible |
| redemptionPeriod | The registry | Yes | Expired and recoverable only by the current owner, at a restore fee |
| clientHold or serverHold | Registrar or registry | Usually | The domain is suspended, resolve that first |
| inactive | The registry | No | No nameservers are set, unrelated to transfers |
| ok | The registry | No | Nothing is blocking a transfer |
The distinction that matters most is the prefix. client means your registrar applied it. server means the registry applied it. That single word tells you who to talk to.
clientTransferProhibited is normal, and it is yours to remove
This is the one most people hit, and it is not a problem. It is an anti-hijacking measure, and most registrars now apply it by default the moment a domain is registered. Without it, anyone who obtained your authorization code could move your domain away before you noticed.
Because your registrar set it, your registrar can remove it, and in most control panels you can remove it yourself in a couple of clicks. Look for a setting called domain lock, registrar lock, transfer lock or theft protection.
Two things worth knowing:
- Turning it off is fine and temporary. Turn it back on after the transfer completes, and turn it back on at the new registrar too.
- A registrar refusing to remove it on request is a problem. Under ICANN policy they may only deny a transfer for specific reasons, and "we would rather keep you" is not one of them.
serverTransferProhibited is a different conversation
This one was applied by the registry, not your registrar, and your registrar cannot simply toggle it off. It usually means one of three things:
- A registry lock service. Some owners pay for this deliberately on high-value names, because it requires an out-of-band verification process before anything can change. If you own the domain and did not set this up, ask your registrar whether it was enabled on your behalf.
- A legal or dispute hold. A UDRP proceeding, a court order, or a law enforcement request can freeze a domain at the registry.
- A registry-level problem with the registration itself.
If you see this code and you did not expect it, that is worth immediate attention rather than a support ticket left overnight.
The time-based locks, and the change happening right now
Separately from the status codes, ICANN policy imposes waiting periods during which a domain cannot move between registrars. These catch almost everybody at some point, because nothing in the purchase flow warns you about them.
Historically there were three triggers, each imposing a 60-day lock:
- Registering a new domain
- Transferring a domain to a new registrar
- Changing the registrant, meaning the name or email of the legal owner
This is currently changing. On 13 March 2025 the GNSO Council accepted the Transfer Policy working group's final report, containing 47 recommendations. Two matter here:
- The registration and transfer locks shorten from 60 days to 720 hours, which is 30 days.
- The Change of Registrant lock is removed entirely.
Implementation is not instant. Registries and registrars were given time to adopt it, and rollout has been staggered rather than switching over on a single date. In practice that means the answer to "how long is my domain locked" depends on which registrar holds it and how far along their implementation is.
So do not trust a flat answer, including one from a help page that has not been updated since 2024. Read the domain's actual status codes and ask your registrar what they currently enforce. That is the only reliable answer during a transition.
The change of registrant trigger deserves a specific warning while it still exists at some registrars: correcting a typo in your own name or updating your email address can lock your domain. If your registrar still applies it and offers an opt-out, you generally have to opt out before making the change, not after.
Things that look like a lock and are not
The domain expired. An expired domain cannot be transferred until it is renewed. Depending on how far it has gone, you may be in the auto-renew grace period, where a normal renewal fixes it, or in redemption, where recovery costs considerably more. Our guide to what happens after a domain expires covers the full sequence.
Contact details are unverified. Under the Registrar Accreditation Agreement, registrars must verify the registrant's email address, and an unverified contact can lead to suspension. Check your inbox, including spam, for a verification message.
You have the wrong authorization code. The auth code, also called the EPP code or transfer key, is domain-specific and case-sensitive, and some registrars expire it after a period. It is not a password and it is not the same for every domain in your account. If the new registrar rejects it, request a fresh one.
Nothing was ever submitted. Transfers are pulled by the gaining registrar, not pushed by the losing one. If you unlocked the domain and waited, nothing will happen. You start the transfer at the registrar you are moving to.
When a transfer is quietly refused
Once a valid transfer request reaches the registry, your current registrar has a limited window to respond, and if they do nothing the transfer completes automatically. That is deliberate: the policy is designed so inaction cannot trap a domain.
A registrar may only refuse a transfer for defined reasons, such as evidence of fraud, a pending dispute, an unpaid balance, or a domain inside a lock period. Dissatisfaction at losing a customer is not one of them, and neither is a retention offer they would like you to hear first.
If you believe a transfer was refused improperly, escalate in writing to the registrar, then to ICANN's complaint process, which exists exactly for this.
Check your own domain first
Almost every blocked transfer is answered by reading the status codes, and that takes seconds.
- Look up your domain and read the registry status codes it carries.
- If you hold several domains, Domain Hub lists the status codes for all of them together, so you can see which are transfer-ready before you start a migration rather than discovering it one at a time.
- Domain Hub also records when a registrar or nameserver changes on a domain you watch, which matters for the case this guide does not cover: a transfer you did not authorise. That one has its own guide.
The rules in this article come from ICANN's Transfer Policy, which is public, and from the status codes your registry publishes about your own domain, which are also public. When a support answer conflicts with the record, the record is what the registry will act on.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain