Get paged before your domain is stolen.
A domain that quietly loses its transfer lock can be hijacked in hours — taking your email, site, and logins with it — and no uptime monitor will ever tell you. Merlonix reads your registry lock status and alerts you the moment that lock comes off.
How it works
01
Scan your domain in seconds
The free domain-health tool reads your registry (RDAP) record and shows your registrar-lock posture immediately — whether the domain is transfer-locked, and whether it is in any registry danger state.
02
Add it as a monitored asset
Enable domain monitoring and Merlonix re-reads the registry on your cadence, recording the EPP status codes over time alongside your registration expiry.
03
We watch the lock, not just the expiry
Most domain monitors only warn you before a registration lapses. Merlonix also watches whether the transfer lock that protects you against theft is still in place.
04
A removed lock pages you
When a transfer lock that used to be present disappears — the leading indicator of an unauthorized transfer or a compromised registrar account — you get an alert, while there is still time to act. A registry danger state (redemption / pending-delete) is critical.
What we read from the registry
The EPP status codes every monitor throws away.
Your registry record already carries the locks that protect your domain. We surface them in plain language — and watch the one transition that means someone is coming for your domain.
Why registrar-lock monitoring matters
The failure that is faster and worse than expiry
An expired registration usually has a redemption grace period. A hijacked domain does not — once transferred away, your email, your site, and your logins can be gone in hours, and recovery means a dispute that can take weeks. The transfer lock is the cheap defense, and the moment it comes off is the moment to act.
A signal no competitor surfaces
The EPP status codes are right there in the public registry record, but uptime monitors, security-header scanners, and even most domain tools throw them away. Merlonix reads them, shows them in plain language, and alerts on the one transition that matters.
One panel with expiry and the rest
Registrar-lock changes land in the same alert stream and asset list as your registration expiry, SSL, DNS, and uptime checks — the whole domain-lifecycle picture in one place, reaching the same on-call person.
What we promise — and what we don’t
We watch the registry. You keep the lock on.
Merlonix reads your domain’s public registry record, shows your registrar-lock posture, and alerts you when a transfer lock is removed or the domain enters a registry danger state. We report registry state — we do not run your registrar or re-lock the domain for you (that is a one-click action on your side). Only definitive registry states compare, so a transient gap never false-fires. No fabricated status, no guarantee beyond what the registry itself publishes.
Common questions
What is a registrar / transfer lock?
It is the EPP status code clientTransferProhibited (and its server-side equivalent) that your registrar sets to block your domain from being transferred to another registrar without your explicit action. It is the primary, free defense against domain hijacking. Most domains should have it on; a domain without it can be transferred away far more easily.
How does Merlonix know my lock status?
From your domain’s public registry record over RDAP — the same source that carries your registration and expiry dates. The record includes EPP status codes; Merlonix reads them, classifies your transfer/delete/update lock posture and any registry danger state, and shows it in plain language. The free /tools/domain-health scan reports it instantly, no signup.
When does it alert me?
When a transfer lock that was present on a previous check is absent on a later one — the leading indicator of an in-progress unauthorized transfer or a compromised registrar account — you get a warning. When the domain newly enters a registry danger state (clientHold, redemptionPeriod, or pendingDelete) you get a critical alert. When the lock is restored, it recovers. Only definitive registry states compare, so a registry that briefly omits statuses never false-fires.
Can Merlonix re-lock my domain for me?
No, and we will not claim it can. We report your registry state and alert you the moment the transfer lock comes off; re-enabling it is a one-click action at your registrar. Our job is to make sure you find out in minutes instead of after the domain is already gone.
How is this different from domain-expiry monitoring?
Expiry monitoring warns you before your registration lapses — a real but slower, usually recoverable failure. Registrar-lock monitoring watches whether the theft-prevention lock is still in place. A domain can be years from expiry and still be hijacked the moment its transfer lock is removed. Merlonix does both.
The transfer lock is free. Not knowing it came off is expensive.
Monitor your registrar-lock posture and get paged the moment it changes. Start the full-workspace trial — 14 days, no card.