Back to Checks
aws

Route 53 domain has Transfer Lock enabled

route53_domains_transferlock_enabled
Service: route53Severity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Route 53 registered domains are assessed for a transfer-lock state, indicated by the clientTransferProhibited status on the domain.

Prowler logoProwlerprowler-provider-aws

Risk

Without transfer lock, a domain can be illicitly moved to another registrar, enabling domain hijacking. Attackers could alter DNS, redirect traffic, harvest credentials, and disrupt email and apps-compromising confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks route53_domains_transferlock_enabled

Recommendation

Enable transfer lock on domains to prevent unauthorized registrar moves. Enforce least privilege on domain management, require MFA, and monitor status changes. For planned transfers, remove the lock only under approved change control and re-enable immediately afterward.

Remediation

CLI

aws route53domains enable-domain-transfer-lock --domain-name <example_domain_name>

Terraform

resource "aws_route53domains_registered_domain" "<example_resource_name>" {
  domain_name   = "<example_domain_name>"
  transfer_lock = true  # Enables transfer lock (sets clientTransferProhibited)
}

Other

1Open the AWS Management Console and go to Route 53
2In the left pane, select Registered domains
3Click the domain name <example_domain_name>
4In Actions, choose Turn on transfer lock
5Confirm to enable the lock

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.route53.route53domains_client import (
    route53domains_client,
)


class route53_domains_transferlock_enabled(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []

        for domain in route53domains_client.domains.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            if domain.status_list and "clientTransferProhibited" in domain.status_list:
                report.status = "PASS"
                report.status_extended = (
                    f"Transfer Lock is enabled for the {domain.name} domain."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Transfer Lock is disabled for the {domain.name} domain."
                )

            findings.append(report)

        return findings

References