What is a registry lock and how does it protect a domain from hijacking?

A registry lock is a security feature that adds a procedural barrier at the domain registry level to prevent unauthorized transfers, deletions, or modifications. While standard security like two-factor authentication protects your account at the registrar (the company you buy the domain from), a registry lock operates one level higher at the registry (the central database for a top-level domain like .com or .net). It places a flag on the domain that prevents any changes from being processed automatically, even if an attacker compromises your registrar account. To make a change, the legitimate owner must typically authenticate with both the registrar and the registry via multiple verified channels, often involving phone calls to pre-authorized personnel. The underlying concept is enforcing a multi-party authorization process that is incredibly difficult for an attacker to replicate, as it requires compromising two separate organizations and their specific verification procedures. This makes it a powerful defense against domain hijacking by adding a critical, manual verification step that is isolated from a single point of account compromise.