We use cookies to improve your experience. Please read our cookies policy here.


Investigation Lock

At a glance

  • Use the investigation lock to lock individual domain names or accounts that may be being used for illegal activity
  • The lock removes the domain from the zone file so it will no longer resolve
  • All information relating to the domain name is locked preventing registrant transfers and account modifications
  • The lock is for use in situations where you need to investigate if a domain name is being used for illegal activity, and to keep domain names suspended when that investigation has been concluded if appropriate.

If you suspect a domain name is being used for an illegal activity you may use the investigation lock. The investigation lock can be applied to individual domain names or whole accounts containing any number of domain names. The lock will:

  • Remove the domain name from the zone file. This means that the domain name will not resolve to a web page and email directed to it will not be delivered.
  • Lock all information relating to the domain name. This prevents registrant transfers, registrar changes, nameserver modifications and domain name cancellation.
  • Set the domain name’s status on the WHOIS to “suspended”.
  • If applied to an account, lock all domain names on the account. If applied to a single domain name only, that domain name will be locked. Other domain names in the same account will be unaffected.
  • Domain names that are locked remain registered but suspended through the usual renewal cycle, and are cancelled 90 days after expiry.

When should the lock be used?

When you have credible evidence of suspected illegal activity carried out using the domain name, you may use the investigation lock. The lock should be applied while you investigate the report that prompted you to lock the domain name. Once the investigation has been carried out, you may then either:

  • Unlock the domain name, or
  • Leave the domain name locked

You should not use the lock for any reason other than on receiving credible evidence that the domain name is being used for illegal activity. Any other use of the lock will constitute misuse. Examples of situations in which you should and should not use the lock are set out below.

We recommend that you review your terms and conditions of registration to ensure that they include your right to suspend services related to a domain name in these circumstances.

Situations in which you should consider using the lock:

  • You receive notification from the police that the domain name is being used for criminal activity
  • You become aware of facts that indicate credibly that the domain name is being used for criminal activity
  • You receive an allegation with credible supporting information and evidence that the domain name is being used for criminal activity
  • You receive multiple allegations from separate parties that the domain name is being used for criminal activity
  • The domain name is listed on our Phishing feed.

Situations in which you should not use the lock:

  • The registrant has not paid monies owed to you
  • The registrant is suspected or accused of civil wrongs, e.g. a breach of contract or IP infringement (although you may wish to take other action if you are hosting the relevant content)
  • The registrant has been accused of criminal activity by one person who does not supply supporting information or evidence of the criminality
  • The alleged criminal activity has nothing to do with the registrant’s domain name

Cancellation and invoicing

  • If an Investigation Lock is put in place prior to being invoiced, you will not be charged for the registration
  • If the domain name is subsequently unlocked, the registration fee will be included in your next invoice
  • We do not issue refunds for locked domain names
  • A domain name with an Investigation Lock in place will go through the standard renewal cycle upon expiry.

Abuse of the lock

Abuse of this lock will not be tolerated. For example, a person with a grievance against the registrant may seek to disrupt their business by alleging that the domain name is being used illegally. We are unable to provide exhaustive advice to cover every potential situation in which it might be necessary or desirable to use the lock. You must use your own judgment to take a decision in each case, and you will be responsible for decisions taken.

Domain names that are locked are included in your deletion limit. Registrars are limited in the number of domain names that can be cancelled (deleted) prior to invoicing. The limit has been imposed to prevent domain name tasting and is detailed in the acceptable use policy for each of our systems. If use of the lock causes you to exceed you deletion limit you may have access to the lock and delete commands suspended. If this happens as a result of a genuine malicious attack we will review the limit on a case by case basis.

Any misuse of the lock could result in your tag being suspended.

Using the lock command

The investigation lock operation consists of two commands. One command sets the lock and the other removes it. The lock and unlock commands are available in EPP, the automaton and web domain manager. We do not automatically inform the registrant when the lock is set or removed, so you should consider your obligations to your customers when deciding your policy and procedure for this lock.

Minerva House, Edmund Halley Road, Oxford Science Park, OX4 4DQ, United Kingdom