Registrar-Lock & Domain-Hijack Monitoring

Why registrar lock matters

Your domain's registry record carries EPP status codes — including the transfer lock (clientTransferProhibited) that blocks your domain from being transferred to another registrar without your explicit action. It is the primary, free defence against domain hijacking. A hijacked domain can take your email, site, and logins with it in hours, and recovery is a dispute that can take weeks — faster and worse than an expired registration, which usually has a grace period.

What Merlonix reads

From your domain's public registry record (over RDAP — the same source as your registration expiry), Merlonix classifies your lock posture: whether the domain is transfer-locked, delete-locked, and update-locked, plus any registry danger state (clientHold, redemptionPeriod, pendingDelete — the domain is held or on its way to deletion). The free domain-health scan shows this instantly; the asset detail page shows it for monitored domains.

When it alerts

With domain monitoring enabled, Merlonix re-reads the registry on your cadence. When a transfer lock that was present goes absent — the leading indicator of an in-progress unauthorized transfer or a compromised registrar account — you get a warning alert while there is still time to act. When the domain newly enters a danger state you get a critical alert. When the lock is restored, it recovers. Only definitive registry states compare, so a registry that briefly omits statuses never false-fires.

What to do about it

We report registry state and page you the moment the lock comes off; we do not run your registrar. Re-enabling the transfer lock is a one-click action at your registrar — the point of monitoring is that you find out in minutes instead of after the domain is already gone. Registrar-lock monitoring rides the existing domain-expiry check, so enabling Domain-registration expiry monitoring on an asset covers it. See the Billing page for which plan fits the domains you want to watch.