How to Unlock a Domain for Transfer

What "unlocking" a domain really means

A registrar lock is a status flag set on your domain at the registry level, you will see it in WHOIS as clientTransferProhibited. While that flag is present, any transfer request from another registrar is automatically rejected. Unlocking simply removes that flag so a transfer can be authorized.

The lock exists for a good reason: it is the main defense against someone initiating an unauthorized transfer of your domain. So you unlock it only when you are actively moving the domain, and you re-lock at the new registrar once the transfer completes. Unlocking is not the transfer itself, it is the gate that lets the transfer begin.

Before you unlock: the prerequisites

A transfer will fail if certain conditions are not met, so check these before you touch the lock, otherwise you unlock, hit a wall, and have to wait anyway:

• The 60-day rule: ICANN blocks transfers within 60 days of a domain's initial registration or a previous transfer. If you just registered or moved it, you must wait out this window.
• The auth code (also called EPP code or transfer authorization code): a unique key the gaining registrar needs. You obtain it from your current registrar; treat it like a password.
• Registration not expired or in a redemption/pending-delete phase, renew first if it is close to expiry.
• A reachable admin contact email, since transfer approval messages are sent there. If WHOIS privacy hides or redirects that address, you may need to temporarily disable it.
• Recent contact changes can trigger their own 60-day transfer lock at some registrars, avoid editing the registrant right before transferring.

Step by step: unlock and start the transfer

The exact menu labels vary by registrar, but the flow is the same everywhere:

• Log in to your current (losing) registrar and open the domain's management page.
• Find the lock setting, often labeled Registrar Lock, Transfer Lock, or Domain Lock, and turn it off.
• If WHOIS privacy would block the admin email, temporarily disable it.
• Request or reveal the auth/EPP code and copy it exactly; codes are case-sensitive and often time-limited.
• At the new (gaining) registrar, start the transfer, enter the domain and the auth code, and pay for the transfer year.
• Approve the confirmation email that arrives at the admin contact, this authorizes the move.
• Wait: transfers can take up to five days to finalize, and the domain keeps resolving the whole time.

Reading the WHOIS status codes

You do not have to guess whether the unlock worked, WHOIS shows it. Before unlocking you will see a status of clientTransferProhibited. After you disable the lock, that code disappears (or changes to a plain "ok" / "active"), which is your confirmation the domain is ready to transfer.

During the move you may briefly see pendingTransfer. These EPP status codes are standardized across registries, so the same vocabulary applies whether you are on .com, .org, or most other TLDs. A quick WHOIS lookup, or a domain expiry checker that surfaces status and dates in one view, tells you where things stand at any point. If the status codes themselves are unfamiliar, DNS records explained covers the surrounding record types you will meet during a migration.

After the transfer: don't lose track

Once the transfer completes, do two things immediately: re-enable the registrar lock at the new registrar, and confirm the expiry date carried over correctly (transfers usually add a year, but verify). A freshly moved domain is also the easiest one to forget, because it is no longer where you habitually renew.

That is where an external watch pays off. VigilDog monitoring tracks domain expiry, SSL/TLS, and DNS independent of any single registrar dashboard, so a domain you just moved can't quietly lapse. If you manage many domains, understanding when your domain expires and getting alerted well ahead of the date is the difference between a renewal and an outage.