Domain Transfer Locks Explained: Understanding 60-Day Rules (2025)

Quick Answer

Table of Contents

The Three 60-Day Transfer Lock Scenarios

ICANN's transfer policy creates automatic 60-day locks in three distinct situations:

1. New Domain Registration Lock

What triggers it: Registering a new domain name

Duration: 60 days from registration date

Can you opt out? No - this is mandatory

Why it exists: Prevents fraudulent registrations from being quickly transferred away before the fraud is discovered or disputed.

Example:

• You register example.com on January 1, 2025
• You cannot transfer to another registrar until March 2, 2025
• After March 2, the domain becomes transfer-eligible

2. Post-Transfer Lock

What triggers it: Completing a domain transfer from one registrar to another

Duration: 60 days from transfer completion date

Can you opt out? No - this is mandatory

Why it exists: Prevents rapid "transfer ping-pong" that could be used to obscure fraudulent domain theft. Also gives registrars stability in their records.

Exception: A domain can be transferred back to the original registrar within 60 days if both registrars agree (useful for accidental transfers or fraud recovery).

Example:

• Your domain transfer completes on January 15, 2025
• You cannot transfer again until March 16, 2025
• This applies even if you want to move to a different third registrar

3. Change of Registrant Lock

What triggers it: Modifying the registrant Name, Organization, or Email address in the domain's WHOIS record

Duration: 60 days from the change (but see important notes below)

Can you opt out? Yes - at many registrars, if you opt out before making the change

Why it exists: Protects against unauthorized ownership changes that could precede domain theft.

What triggers it specifically:

• Changing the registrant name (e.g., "John Smith" to "Jane Doe")
• Changing the organization name (e.g., "ABC Corp" to "XYZ Inc")
• Changing the registrant email address

What does NOT trigger it:

• Changing billing contact information
• Changing technical contact information
• Updating phone numbers or addresses (unless registrant-level fields)
• Changing nameservers
• Modifying DNS records

Why Does the 60-Day Lock Exist?

Understanding the rationale helps explain why these restrictions exist and when they might change.

Fraud Prevention

Primary goal: Give victims time to detect and report unauthorized actions

Scenario the lock prevents:

1. Attacker compromises registrar account
2. Registers domain using victim's payment method
3. Immediately transfers domain to an offshore registrar
4. Victim can't recover domain due to jurisdictional issues

With 60-day lock:

• Victim has 60 days to notice the fraudulent charge
• Can dispute with registrar before transfer is possible
• Registrar can cancel registration if fraud is confirmed

Domain Theft Protection

Scenario the lock prevents:

1. Attacker gains access to domain owner's registrar account
2. Changes registrant email to attacker's email
3. Immediately initiates transfer to attacker-controlled registrar
4. Original owner loses control before they notice

With 60-day lock:

• Contact changes trigger 60-day transfer restriction
• Original owner receives notification of contact change
• Has time to regain account access and revert changes

Dispute Resolution Window

The 60-day period provides time for:

• Trademark holders to file UDRP complaints
• Credit card companies to process chargebacks
• Registrars to investigate fraud reports
• Law enforcement to take action if needed

Which Domains Are Affected?

The 60-day transfer lock applies differently depending on the type of domain extension.

gTLDs (Generic Top-Level Domains) - AFFECTED

ICANN's Transfer Policy applies to all ICANN-accredited gTLDs:

Legacy gTLDs:

• .com
• .net
• .org
• .info
• .biz

New gTLDs (examples):

• .io
• .co
• .app
• .dev
• .xyz
• .online
• .store
• Most other new extensions

ccTLDs (Country-Code Top-Level Domains) - NOT AFFECTED

Country-code domains are governed by their respective national registries, not ICANN's transfer policy:

NOT subject to ICANN 60-day lock:

• .uk (United Kingdom) - uses IPS tag transfer system
• .eu (European Union)
• .de (Germany)
• .ca (Canada)
• .au (Australia)
• .us (United States - despite being US-based)
• .in (India)
• .fr (France)
• .nl (Netherlands)

Important: These domains may have their own transfer restrictions set by national registries. Check with your registrar for ccTLD-specific rules.

Sponsored TLDs - VARIES

Some sponsored TLDs have unique policies:

• .edu - restricted to educational institutions
• .gov - restricted to government entities
• .mil - restricted to military

Change of Registrant Lock Explained

The Change of Registrant (CoR) lock is the most frequently encountered 60-day restriction because it can be triggered by routine administrative updates.

What Exactly Triggers a CoR Lock?

Definite triggers:

• Registrant Name field changes
• Organization field changes
• Registrant Email field changes

May trigger (registrar-dependent):

• Significant address changes
• Country changes
• Adding or removing an organization

The Confirmation Process

When you make registrant changes, ICANN requires:

1. Notification to old email: Alert sent to previous registrant email
2. Notification to new email: Confirmation request sent to new email
3. 14-day confirmation window: Changes must be confirmed within 14 days
4. 60-day lock applied: After confirmation, transfer lock activates (unless opted out)

If confirmation isn't completed:

• Changes may be reverted
• Domain may be suspended
• Lock may or may not apply depending on registrar

ICANN Policy Update (2024-2025)

The ICANN Registration Data Policy updated on February 21, 2024, with implementation through August 2025, includes relevant changes:

Key change: The policy confirms the Change of Registrant lock period remains at 60 days (though earlier discussions proposed reducing it to 30 days).

Organization field significance: Starting August 2025, if the Organization field contains a company name, that organization is recognized as the legal domain owner. Individual names become contact persons only.

How to Opt Out of the 60-Day Lock

For Change of Registrant locks, ICANN allows registrars to offer an opt-out option. Here's how it works:

The Opt-Out Process

Critical timing: You must opt out BEFORE making the registrant change. You cannot retroactively opt out.

General steps:

1. Log into your registrar account
2. Navigate to domain settings or contact information
3. Look for opt-out checkbox before making changes
4. Check "Opt out of 60-day transfer lock" or similar
5. Then make your contact changes
6. Confirm changes as required

What Opt-Out Does and Doesn't Do

What opting out DOES:

• Removes the 60-day transfer restriction after registrant changes
• Allows immediate transfer eligibility after contact updates
• Useful when selling domains or consolidating portfolios

What opting out does NOT do:

• Override the 60-day lock on new registrations
• Override the 60-day lock after a transfer
• Remove existing locks already in place
• Change any other transfer requirements (authorization code, unlock, etc.)

Risks of Opting Out

Security trade-offs:

• Less protection against unauthorized ownership changes
• Attackers who gain account access can change contacts and transfer immediately
• Less time to notice and respond to compromises

When opting out is appropriate:

• Selling a domain and need to transfer quickly
• Consolidating domains to a new registrar
• Planned ownership changes within your organization
• You have strong account security (2FA, monitoring)

Registrar-Specific Policies

Different registrars implement ICANN's opt-out provision differently.

GoDaddy

Opt-out available: Yes

How to opt out:

1. Go to Domain Control Center
2. Select domain and navigate to Contact Information
3. Before editing, check "Opt-out of 60-day lock"
4. Make your contact changes
5. Complete verification process

Notes:

• GoDaddy sends confirmation emails for contact changes
• Opt-out must be selected before initiating changes
• Domain Protection users may have additional verification steps

Namecheap

Opt-out available: Yes

How to opt out:

1. Sign into Namecheap account
2. Go to Domain List > Manage domain
3. Navigate to Sharing & Transfer section
4. Find Contact Information settings
5. Check opt-out option before making changes

Notes:

• Namecheap clearly labels the opt-out option
• Changes require email verification
• Auth code can be generated after contact changes (if opted out)

Cloudflare Registrar

Opt-out available: Limited

Policy:

• Cloudflare follows ICANN policy strictly
• Updating Registrant contact may trigger 60-day lock
• Contact Cloudflare support for specific scenarios

Notes:

• Cloudflare requires domains use Cloudflare DNS
• Some changes may require support intervention

Name.com

Opt-out available: Yes

How to opt out:

1. Log into Name.com account
2. Go to Account Settings > Preferences
3. Enable "Opt-out of 60-day transfer lock" as default preference
4. This applies to future contact changes

Notes:

• Can set opt-out as default for all domains
• Individual domain settings may override account default

Dynadot

Opt-out available: Yes (default)

Policy:

• Dynadot has opted users OUT of the transfer lock by default
• Users are not subject to 60-day lock after contact changes
• Can change this preference in account settings

Notes:

• One of the most domain-investor-friendly policies
• Good for portfolios with frequent transfers

DNSimple

Opt-out available: No

Policy:

• DNSimple does NOT support opting out of 60-day lock
• All contact changes trigger the lock period

Notes:

• More security-focused approach
• Plan transfers before making contact changes

Porkbun

Opt-out available: Yes

How to opt out:

• Contact Porkbun support for guidance
• Opt-out may be available on case-by-case basis

NameSilo

Opt-out available: Yes

Policy:

• NameSilo allows opt-out during contact changes
• Clear interface for managing transfer restrictions

The Future: ICANN Transfer Policy Changes

Major changes to the transfer lock policy are in progress.

GNSO Transfer Policy Review (2024)

At ICANN 82 in Seattle (late 2024), the GNSO Council voted to accept the final report of its Transfer Policy working group. Key recommendations include:

Elimination of 60-Day Lock:

• The working group recommended eliminating the 60-day transfer lock entirely
• This applies to all three scenarios (registration, transfer, CoR)
• Aims to improve domain market liquidity and user experience

Timeline:

• GNSO Council approved recommendations in late 2024
• Recommendations go to ICANN Board for approval
• Policy drafting follows board approval
• Implementation expected no earlier than 2026
• Registrars will have transition period to implement

What This Means for Domain Owners

In the near term (2025):

• Current 60-day policies remain in effect
• Plan accordingly for transfers and contact changes
• Use opt-out where available

In the future (2026+):

• Greater flexibility for transfers
• Faster domain market transactions
• Need for alternative fraud prevention measures
• Enhanced authorization code security requirements

Enhanced Security Measures

The policy changes also include security enhancements:

Authorization Code Improvements:

• Codes should achieve at least 128 bits of entropy
• Stronger, more random codes to prevent guessing
• Aligns with RFC 9154 standards

Other Security Considerations:

• Enhanced notification requirements
• Improved dispute resolution processes
• Better logging and audit trails

Working Around Transfer Lock Restrictions

When you need to move domains but face lock restrictions, here are your options:

Scenario 1: Recently Registered Domain

Situation: You registered a domain but need to move it to a different registrar immediately.

Options:

1. Wait it out: The straightforward option - wait 60 days
2. Use the registrar's DNS: Keep domain at current registrar but point DNS elsewhere
3. Register at preferred registrar: If you haven't used the domain yet, let it expire and re-register (risky - others might register it)

Best practice: Register domains at your preferred registrar from the start.

Scenario 2: Just Completed a Transfer

Situation: You transferred a domain but now want to move it again.

Options:

1. Wait 60 days: Standard approach
2. Transfer back to original: Both registrars must agree, but this exception exists
3. Use DNS pointing: Keep registration where it is, manage DNS elsewhere

Scenario 3: Need to Change Ownership and Transfer

Situation: You're selling a domain and need to update registrant info to the buyer, then transfer.

Options:

1. Opt out before changes:

   • Opt out of 60-day lock
   • Make contact changes
   • Transfer immediately after

2. Transfer first, then change contacts:

   • Transfer domain to buyer's registrar
   • Wait 60 days (transfer lock)
   • Update contacts at new registrar
   • Buyer has domain sooner, contact change happens later

3. Push transfer (same registrar):

   • If buyer has account at same registrar
   • Push domain to their account
   • No inter-registrar transfer = no 60-day lock
   • Contact changes within same registrar usually don't prevent "push"

Scenario 4: Consolidating Domain Portfolio

Situation: You have domains at multiple registrars and want to consolidate.

Options:

1. Plan ahead:

   • Don't make registrant changes before consolidation
   • Transfer domains without triggering CoR lock

2. Stagger transfers:

   • Move domains over time
   • Start with oldest domains (already past lock periods)

3. Use opt-out:

   • Where available, opt out before any needed contact changes

Transfer Lock vs Registrar Lock

These are often confused but serve different purposes.

60-Day Transfer Lock (ICANN Policy)

What it is: Automatic lock imposed by ICANN policy for 60 days after registration, transfer, or registrant changes

Purpose: Fraud prevention and dispute resolution window

Controlled by: ICANN policy - mandatory (except CoR opt-out)

Visible in WHOIS: Not directly visible as a status code

Removal: Wait 60 days (automatic expiration)

Registrar Lock (Domain Lock)

What it is: Security feature that prevents unauthorized transfers

Purpose: Protect domain from theft

Controlled by: You - can enable/disable in registrar account

Visible in WHOIS: clientTransferProhibited status code

Removal: Disable in registrar account settings

How They Interact

Both can prevent transfers:

• Even if 60-day lock has expired, registrar lock can still block transfer
• Even if registrar lock is disabled, 60-day lock can still block transfer
• Both must allow the transfer for it to proceed

Example timeline:

1. Register domain January 1 (60-day lock starts, registrar lock enabled by default)
2. Try to transfer February 1 - BLOCKED by 60-day lock
3. March 2 - 60-day lock expires
4. Try to transfer March 3 - BLOCKED by registrar lock
5. Disable registrar lock - now transfer can proceed

For complete details on registrar lock, see our guide: Understanding Registrar Lock and Transfer Lock

Common Scenarios and Solutions

"I just bought this domain and need to transfer it"

Situation: Purchased domain at GoDaddy, want to transfer to Cloudflare

If newly registered (within 60 days):

• Wait until 60-day lock expires
• Use GoDaddy DNS to point to your hosting in the meantime
• Transfer after lock period

If existing domain (registered 60+ days ago):

• Check if seller made recent registrant changes
• If changes within 60 days without opt-out, you'll need to wait
• If no recent changes, proceed with transfer

"My transfer failed - domain is locked"

Troubleshooting steps:

1. Check registrar lock status:

   • Log into registrar account
   • Look for "Domain Lock" or "Transfer Lock" setting
   • Disable if enabled

2. Check 60-day lock:

   • When was domain registered? (Must be 60+ days)
   • When was last transfer? (Must be 60+ days)
   • Were registrant contacts changed recently? (Must be 60+ days or opted out)

3. Check WHOIS status:

   whois yourdomain.com | grep Status
   

   • clientTransferProhibited = registrar lock (disable in account)
   • serverTransferProhibited = registry lock (contact registrar)

"I need to change ownership but transfer is locked"

Options:

1. Change registrant at current registrar:

   • Update contact info to new owner
   • Wait 60 days (unless opted out)
   • Then transfer if needed

2. Push domain (same registrar):

   • Have new owner create account at same registrar
   • Push/move domain to their account
   • No inter-registrar transfer needed

3. Change contacts with opt-out:

   • Opt out of 60-day lock first
   • Make contact changes
   • Proceed with transfer

"Registrar won't let me opt out"

If your registrar doesn't offer opt-out:

• This is the registrar's choice (ICANN allows but doesn't require opt-out)
• Options:
  1. Accept the 60-day wait
  2. Transfer to a registrar that does offer opt-out (requires waiting for any existing lock)
  3. Plan future registrations at more flexible registrars

Best Practices

For Domain Owners

When registering new domains:

• Register at your preferred long-term registrar
• Consider future transfer needs before registering
• Avoid registering at registrars you'll want to leave

When making contact changes:

• Opt out of 60-day lock if you might transfer soon
• Make all needed changes at once (avoid multiple lock triggers)
• Document the date of changes for transfer planning

When planning transfers:

• Check domain status before starting
• Verify no recent changes that triggered locks
• Allow buffer time for potential issues

For Domain Investors

Portfolio management:

• Use registrars with opt-out options
• Consolidate at investor-friendly registrars (Dynadot, NameSilo)
• Track lock status in your domain management system

Buying domains:

• Verify seller can transfer (no active locks)
• Request opt-out before any contact changes
• Consider same-registrar push transfers when possible

Selling domains:

• Opt out before making buyer's contact changes
• Or transfer first, change contacts after (buyer's responsibility)
• Clearly communicate transfer timelines to buyers

For Businesses

Security vs. flexibility:

• Keep locks enabled for security on critical domains
• Only opt out when specifically needed for transfers
• Document transfer decisions for audit trails

Planning domain consolidation:

• Audit all domains for lock status before planning
• Create timeline accounting for 60-day restrictions
• Consider phased approach for large portfolios

Frequently Asked Questions

Can I transfer a domain within 60 days of registering it?

No. ICANN's transfer policy prohibits inter-registrar transfers within 60 days of initial registration. This mandatory lock cannot be waived or opted out. You must wait until the domain is at least 60 days old to transfer it to another registrar.

Why is my domain locked for 60 days after I updated my contact information?

ICANN requires a 60-day transfer lock after changes to registrant Name, Organization, or Email fields. This protects against domain theft through unauthorized contact changes. However, many registrars allow you to opt out of this lock before making changes - check your registrar's settings.

Does the 60-day lock apply to .uk or .eu domains?

No. The ICANN 60-day transfer lock only applies to generic TLDs (.com, .net, .org, etc.) managed under ICANN policy. Country-code domains like .uk, .eu, .de, .ca, and others are governed by their national registries and have different (or no) transfer lock policies.

How do I check if my domain has a 60-day lock?

ICANN's 60-day lock isn't shown as a specific WHOIS status code. To determine if it applies: (1) Check the domain creation date (must be 60+ days ago), (2) Check when the last transfer completed (must be 60+ days ago), (3) Contact your registrar if you recently changed registrant information.

Can I opt out of all 60-day transfer locks?

No. You can only opt out of the lock triggered by registrant contact changes. The locks for new registrations (60 days) and post-transfer (60 days) are mandatory and cannot be opted out. The opt-out for contact changes must also be done before making the changes.

What's the difference between "Transfer Lock" and "Registrar Lock"?

Transfer Lock (60-day lock) is an automatic ICANN policy restriction after registration, transfer, or contact changes. Registrar Lock (domain lock) is a security setting you control that shows as clientTransferProhibited in WHOIS. Both can independently block transfers.

Is ICANN eliminating the 60-day transfer lock?

ICANN's GNSO Council approved recommendations to eliminate the 60-day lock in late 2024. However, this must still be approved by ICANN's Board, and then registrars need time to implement. The changes won't take effect until at least 2026, so current policies remain in effect through 2025.

Can I transfer a domain back to the original registrar within 60 days?

Yes, with an exception. While the 60-day post-transfer lock normally prevents all transfers, ICANN policy allows a domain to be transferred back to the original registrar if both registrars agree. This accommodates accidental transfers or fraud recovery.

Key Takeaways

• Three types of 60-day locks exist: New registration, post-transfer, and change of registrant - each with different triggers and opt-out options

• Only the Change of Registrant lock can be opted out - and only if you opt out BEFORE making the contact changes at a registrar that offers this option

• The policy applies to gTLDs only - country-code domains (.uk, .eu, .ca, etc.) follow their national registry rules, not ICANN's transfer policy

• ICANN approved eliminating the 60-day lock in late 2024, but implementation won't happen until at least 2026 - plan accordingly

• Transfer lock and registrar lock are different - both can independently prevent transfers and must both allow it for a transfer to succeed

• For domain sales and portfolio management, use registrars that offer opt-out (Dynadot, Name.com, Namecheap) and plan contact changes carefully

• Security vs. convenience trade-off - the 60-day lock provides fraud protection, so only opt out when you specifically need transfer flexibility

• Same-registrar push transfers avoid inter-registrar transfer restrictions - useful when buyer and seller use the same registrar

Next Steps

Check Your Domains Now

1. Review registration dates - identify any domains still within 60-day new registration locks
2. Check recent transfers - note any domains within 60-day post-transfer locks
3. Audit contact changes - determine if recent registrant updates triggered locks
4. Understand your registrar's opt-out policy before making future changes

Related Resources

• How to Transfer a Domain Name - Complete transfer process guide
• Understanding Registrar Lock - Domain lock security settings
• Domain Transfer Checklist - Pre-transfer verification steps
• What is ICANN? - Understanding domain governance

Research Sources

This article was researched using current information from authoritative sources:

• ICANN Transfer Policy
• FAQs for Registrants: Transferring Your Domain Name - ICANN
• ICANN to kill off 60-day domain transfer lock - Domain Incite
• ICANN 60-Day Lock After Change of Registrant - DNSimple Help
• ICANN Transfer Policy - Name.com Knowledge Base
• ICANN Transfer Policy - DreamHost Knowledge Base
• Opting out of the 60-day transfer lock - Name.com
• How do I set/release registrar lock for a domain? - Namecheap
• Transfer your domain to Cloudflare - Cloudflare Docs
• Unlock or lock my domain - GoDaddy Help