Route 53 domain has Transfer Lock enabled

Check ID: route53_domains_transferlock_enabled
Provider: AWS
Service: route53
Severity: HIGH
Categories: identity-access
Resource type: Other

What this check verifies

Route 53 registered domains are assessed for a transfer-lock state, indicated by the clientTransferProhibited status on the domain.

Risk

Without transfer lock, a domain can be illicitly moved to another registrar, enabling domain hijacking. Attackers could alter DNS, redirect traffic, harvest credentials, and disrupt email and apps-compromising confidentiality, integrity, and availability.

Recommendation

Enable transfer lock on domains to prevent unauthorized registrar moves. Enforce least privilege on domain management, require MFA, and monitor status changes. For planned transfers, remove the lock only under approved change control and re-enable immediately afterward.

Remediation

CLI
Terraform
Dashboard steps

aws route53domains enable-domain-transfer-lock —domain-name <example_domain_name>

resource "aws_route53domains_registered_domain" "<example_resource_name>" {
  domain_name   = "<example_domain_name>"
  transfer_lock = true  # Enables transfer lock (sets clientTransferProhibited)
}

References

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-lock.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = route53_domains_transferlock_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Route 53 domain has admin contact privacy protection enabled Route53 public hosted zone has query logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires