What is Domain Protection?
Domain Protection is a security service that guards your domains against the most common ways people lose them: accidental expiry, unauthorised transfers, and unwanted changes to critical settings. It layers registrar-level safeguards locks, verified changes, ownership proof and, on the higher tier, fee-waived recovery on top of your normal registration, so your domains stay secure and, where the registry allows, recoverable. It does not replace renewing your domain (see below).
Which plans are available?
Two tiers Essential (portfolio-wide baseline) and Advanced (per-domain enhanced protection for your most important names):
| Essential | Advanced | |
|---|---|---|
| Scope | Whole portfolio | Per domain |
| Registrar Lock (where TLD supports it) | Yes | Yes |
| 2FA on sensitive actions (EPP, unlock, contact edits) | Yes | Yes |
| Domain Registration Certificate | Yes | Yes |
| Domain Recovery – RGP fee waiver | — | Yes |
| Domain Health Check | — | Yes |
| DNSSEC enablement | — | Yes |
| Domain Reputation Monitoring | — | Yes |
You can run Essential across your whole portfolio and add Advanced to your key domains at the same time.
Can I switch between Essential and Advanced?
Yes. You can upgrade any domain to Advanced at any time from your control panel, and changes take effect immediately. Advanced is applied per domain, so you can protect a handful of key names while keeping Essential across everything else.
Coverage & eligibility
Does Essential cover all my domains?
Yes — Essential applies portfolio-wide and automatically covers every domain in your account whose extension supports each feature. Where a TLD doesn't support a given feature, the system applies the best available protection for that domain automatically; you don't need to configure anything per domain.
What if my TLD doesn't support a feature?
Some registries restrict certain features most commonly WHOIS Privacy and Registrar Lock. When that happens:
- Your control panel shows clear messaging for that domain (e.g. "Registrar Lock is not available for this domain extension"), so you're never left guessing.
- We automatically apply the best available protection for that extension.
- The rest of your protection — 2FA on sensitive actions, ownership certificate, expiry safeguards, and on Advanced the health, DNSSEC and reputation features continues to apply wherever the registry permits.
How do I know what my specific domain supports?
The live indicator in your Instra control panel is the source of truth. Open the domain and the protection panel shows exactly which features are available for that extension, with a short explanation for anything unavailable. Because registry policies change, the control panel always reflects the current, correct position for your domain — more reliably than any static list.
Which TLDs are supported? (Registrar Lock & WHOIS Privacy)
Domain Protection covers a very large TLD range 900+ extensions support Registrar Lock and 780+ support WHOIS Privacy, including all the most common ones. The quick reference below covers the extensions customers ask about most. For anything not listed, check the domain's protection panel.
| TLD | Registrar / Transfer Lock | WHOIS Privacy |
|---|---|---|
| .com, .net, .org | Yes | Yes |
| .info, .biz | Yes | Yes |
| .co, .io, .ai, .me | Yes | Yes |
| .tv, .cc, .xyz | Yes | Yes |
| .online, .site, .store, .shop | Yes | Yes |
| .app, .dev, .tech, .club, .pro | Yes | Yes |
| .uk, .co.uk, .org.uk | Yes | No |
| .us | Yes | No |
| .ca | Yes | No |
| .fr | Yes | No |
| .cn | Yes | No |
| .in | Yes | No |
| .sg | Yes | No |
| .nyc | Yes | No |
| .be, .mx | Yes | No |
| .de | No | No |
| .es, .it, .nl, .eu | No | No |
| .ch | No | No |
| .jp, .ru | No | No |
| .com.au | No | No |
| .cz, .co.nz | No | Yes |
Legend: Yes = supported · No = not supported by the registry. This is a reference subset your control panel shows the definitive status for every domain.
Which TLDs are eligible for Registrar (Transfer) Lock?
Registrar Lock is supported on 900+ extensions, including all major gTLDs (.com, .net, .org, .info, .biz), popular new TLDs (.io, .ai, .app, .dev, .shop, .online, .store and hundreds more), and many ccTLDs such as .uk, .us, .ca, .fr, .cn, .in and .sg.
Not supported (registry policy), including: .de, .es, .it, .nl, .eu, .ch, .jp, .ru, .com.au, .at, .dk, .pl, .pt, .ie, .fi, .no, .se, .nu, .ad, .ro, .gr, .com.br.
Which TLDs are eligible for WHOIS Privacy?
WHOIS Privacy is supported on 780+ extensions, covering effectively all common gTLDs and new TLDs.
Not supported (registry restrictions), including: .ca, .ch, .cn, .co.uk, .com.au, .de, .es, .eu, .fr, .id, .in, .nl, .nu, .nyc, .org.uk, .sg, .uk, .us, .it, .jp, .ru, .se, .be, .at, .dk, .pl, .pt, .ie, .fi, .no, .ro, .gr, .mx, .com.br, .vote.
For many of these, the registry publishes minimal data by default or applies its own privacy model at the registry level.
Why protect a domain if my TLD isn't supported for locks or privacy?
Because Registrar Lock and WHOIS Privacy are only two of the protections — and the ones most often hit by registry restrictions. Even when those two aren't available, Domain Protection still delivers real value on that domain:
- Expiry & renewal safeguards and reminders that reduce the risk of accidental loss.
- Domain Recovery (RGP fee waiver) on Advanced, where the registry supports restore often the single most valuable protection, since redemption fees are far higher than a renewal.
- 2FA on sensitive actions (transfers/EPP, unlock, contact changes), managed at your account a verification layer independent of the registry.
- Domain Registration Certificate as portable proof of ownership.
- Advanced extras Domain Health Check, DNSSEC enablement and Domain Reputation Monitoring which are not tied to registry lock/privacy support.
In short: an unsupported lock or privacy flag doesn't leave the domain unprotected it just means those specific registry-controlled features aren't part of the mix for that extension.
Recovery & the redemption period
What does recovery include?
On Advanced Protection, if an eligible domain expires and enters the Redemption Grace Period, we restore it at the standard renewal price only with no registry redemption fee (where the registry supports the restore). Redemption fees are typically much higher than a normal renewal, so this is often the most valuable single benefit of Advanced. TLD limitations apply, and recovery follows the registry's rules.
What is the Redemption Grace Period (RGP)?
The RGP is a registry-defined recovery window that begins after a domain expires and is deleted from the active zone. During this window the domain can usually still be restored to the original owner, but registries normally charge a significant redemption fee to do so. With Advanced Protection, eligible restores in this window may avoid that fee and only require a standard renewal payment.
What happens if my domain expires?
A domain typically moves through these stages after expiry:
- Grace period still easily renewable at the normal price.
- Redemption Grace Period (RGP) recoverable, but registries usually charge a redemption fee (waived on Advanced for eligible domains).
- Pending delete / release the domain drops and becomes available for public registration again.
Advanced Protection may allow fee-waived recovery during the RGP depending on registry rules. The safest approach is always to renew before expiry.
Is domain recovery guaranteed?
No. Recovery depends on the registry's policies, the stage of the domain lifecycle, and availability at the time. Domain Protection increases your recovery options and removes the redemption fee where supported, but it cannot override registry rules or guarantee recovery in every scenario.
Renewals & transfers
Does Domain Protection replace domain renewal?
No. Domain Protection is a security layer, not a renewal. Your domains must still be renewed before their expiry date. Protection reduces the risk of losing a domain and improves your recovery options, but it does not keep a domain registered on its own.
How do renewals work with Domain Protection?
Your normal renewal cycle is unchanged renew as usual before the expiry date (auto-renew is recommended for critical domains). Domain Protection adds expiry safeguards and reminders on top of that, and on Advanced adds the RGP fee waiver as a safety net if a renewal is ever missed. The protection plan itself renews alongside your domains.
I have a domain with another provider can I transfer it in to protect it?
Yes. You can transfer eligible domains into Instra and apply Domain Protection once the transfer completes. To transfer in you'll generally need to unlock the domain at your current provider, obtain the authorisation/EPP code, and ensure the domain is outside any registry transfer-lock window (commonly the first 60 days after registration or a previous transfer). Once the domain is in your account, apply Essential portfolio-wide and add Advanced if it's business-critical. Some ccTLDs have registry-specific transfer steps the control panel will guide you through anything specific to that extension.
Can I apply Advanced Protection to multiple domains?
Yes. Advanced is applied per domain, so you can protect as many individual domains as you like. Customers typically apply Advanced to domains that are business-critical, tied to an active website, used for email, or high-value / premium names.
Good candidates for Advanced Protection
Who should use Advanced Protection?
Advanced is recommended for domains that are:
- Core to your business or brand identity
- Tied to revenue-generating websites
- Used for company email
- High-value or premium names
Protecting these reduces the risk of downtime, data loss, or brand disruption, and gives you fee-waived recovery as a safety net.
Need more help? Contact Instra Support and we'll walk you through protection options for your specific domains.