An account credential leak or unauthorized access by a Resource Access Management (RAM) user creates a critical security risk: an unauthorized party could transfer your domain name to another registrar. This can cause website outages, email service interruptions, and even the permanent loss of your domain name and its assets.
The transfer lock feature locks your domain name at the registrar level. It prevents unauthorized cross-registrar transfers, safeguarding your domain name from risks like credential stuffing, phishing, and human error.
Billing
This feature is free of charge. Enabling or disabling the transfer lock does not incur any additional fees.
Procedure
Step 1: Navigate to the security settings for your domain name
Log on to the Alibaba Cloud Domain Names console.
On the Domain Names page, find the target domain name and click Manage in the Actions column.
In the left-side navigation pane, click Security Settings.
Step 2: Enable or disable the transfer lock
Enable: To block transfer-out requests, click Enable in the Actions column.
Disable: To transfer the domain name to another registrar, click Disable.
Disabling the lock exposes your domain name to transfer risks. Only disable it for the duration of the transfer and re-enable it immediately afterward.
Step 3: Complete the security verification
In the confirmation dialog box, follow the prompts to complete identity verification (for example, by entering an email verification code). This ensures that only an authorized administrator performs the operation.
Best practices
Enforce multi-factor authentication (MFA): All accounts with domain name management permissions must enable MFA. This prevents unauthorized access even if transfer lock is enabled and an attacker steals your credentials. For more information, see Configure MFA for your account.