How to Protect Your .co.tz Domain from Theft: EPP Codes, 2FA and Renewals

How domains are really lost

Understanding the real causes helps you spend your effort where it matters. In our experience supporting Tanzanian businesses, almost every lost or hijacked domain falls into one of these groups.

• Stolen or guessed login. The attacker signs in to the registrar account and requests a transfer or changes the nameservers.
• Old contact email. Notices go to an address nobody reads, or to a former employee or web designer who still controls it.
• Expiry. The renewal invoice was missed, the domain expired, and eventually it was released for anyone to register.
• Registered in someone else's name. A web designer or agency registered the domain under their own account, so they, not you, control it.
• Social engineering. Someone phones or emails pretending to be the owner and asks for a transfer code or a nameserver change.

None of these needs advanced technical skill from the attacker. That is good news, because each one has a simple defence.

Does a .co.tz domain have a registrar lock?

On global domains such as .com, a registrar lock (also called a transfer lock) blocks the domain from being moved to another registrar until you unlock it. Many owners expect the same switch on their .co.tz domain, and in the client area it appears to be there.

The .tz registry, run by TZNIC, does not offer a registrar lock. If you try to switch it on you will see the message "An issue was encountered while updating the domain lock status". Nothing is wrong with your domain, and SakuraHost cannot enable the lock on our side either, because the setting does not exist at the registry. Our knowledge base explains this in detail in the .tz registrar lock error guide.

What is an EPP code and why it matters

EPP stands for Extensible Provisioning Protocol, the system registrars use to talk to registries. The EPP code, also called an auth code or authorization code, is a secret string that proves you are the owner. A new registrar must present it to start a transfer.

This makes the code the real gatekeeper of your domain. If you never share it, nobody can move the domain. If someone gets it, together with access to your account, they can. That is why the code is only released to the account owner, why you should never send it by chat or email to people you have not verified, and why you should give it only to the registrar you are moving to.

• Request the code only when you really intend to transfer.
• Never paste it into a public chat, a shared document or a support request from an unknown person.
• If you receive a code you did not request, tell us immediately and change your account password.

If you plan to move a domain, our guide to getting your EPP code walks through the process safely.

Turn on two-factor authentication

Because the EPP code and every other control sit behind your account login, protecting the login is the most important step. A strong password is the minimum. Two-factor authentication (2FA) adds a second check, such as a code sent to your phone, so a stolen password alone is useless.

Use a unique password that you do not use anywhere else, store it in a password manager, and enable two-factor on your SakuraHost client area. Our two-factor authentication guide and the client area security settings explain the options.

Keep contact details and the account owner correct

Renewal reminders, transfer notices and verification messages go to the email address on your account and on the domain registration. If that address belongs to a former employee, a web designer or an inbox you never open, you will not see the warning when something happens.

Use a role-based business address that several trusted people can read, such as a shared company mailbox, and keep a second contact where possible. Make sure the domain is registered in the name of your business or yourself, not in the name of the agency that built your website. You can review and update both in the client area. See how to update the contact email and domain owner and WHOIS details.

Turn on auto-renewal and pay early

Expiry is the most common way a domain is lost, and it is entirely preventable. An expired domain stops working for your website and email, and if it is left long enough it is released and anyone can register it, including a competitor.

In the client area, open your domain and switch on Auto Renew. Keep a working payment method in mind and pay renewal invoices as soon as they arrive. Domains can be renewed for more than one year, which reduces how often you have to remember. If a domain has already expired, act at once: what to do when a domain expires.

A 10-minute domain security checklist

What to do if you think your domain has been hijacked

Move quickly. Change your SakuraHost password, check the nameservers and DNS records on the domain, and open a support ticket with the domain name and what you noticed. If nameservers have been changed to something you do not recognise, tell us at once so we can help you restore them.

Do not give out your EPP code to anyone who contacts you. SakuraHost support will never ask you for your password, and we only release transfer codes to the verified account holder.

Frequently asked questions