EPP Domain Status Codes and What They Mean

Your domain isn't working. Or it won't transfer. Or it's showing a status you've never seen before.

These situations almost always trace back to one thing: an EPP domain status code that's either blocking an operation or signaling something that needs your attention. The problem is that the official ICANN documentation tells you what each code means in technical terms, but not what you're actually supposed to do about it, who has the power to remove it, or what's happening to your website and email while it's set.

This guide covers all 23 EPP status codes with real explanations, troubleshooting steps, and the decisions most people need to make when they encounter them — whether you're a domain owner wondering why a transfer failed, a developer building a registrar integration, or a reseller managing hundreds of domains for clients.

Quick Reference — Most Common Situations:

• ✔ Domain won’t transfer → Look for: clientTransferProhibited or serverTransferProhibited
• ✔ Website is offline → Look for: clientHold, serverHold, or inactive
• ✔ Can’t update nameservers → Look for: clientUpdateProhibited or serverUpdateProhibited
• ✔ Domain about to be deleted → Look for: redemptionPeriod or pendingDelete
• ✔ Everything looks fine → You should see: ok (also shown as active in RDAP)

Every single registered domain has at least one status code at all times. Under normal conditions, you'll see “ok” — or its RDAP equivalent “active” — which means the domain is registered, working, and has no pending operations or restrictions. But domains often carry multiple status codes simultaneously, and some combinations have immediate consequences for your website, email, and ability to make changes.

Status codes exist because the domain registration system involves multiple parties — ICANN, registries, registrars, and registrants — each with different levels of authority over a domain at different times. The status code system is the mechanism that allows these parties to enforce policies, protect registrants from hijacking, flag technical states, and manage domain lifecycle transitions in an orderly way.

There are two layers to the status code system: codes set by registrars (called client codes) and codes set by registries (called server codes). Understanding which layer a code comes from tells you immediately who has the authority to remove it.

How to Check Your Domain’s Status

Domain status codes are publicly visible through several methods. The right one for your situation depends on what information you need and how quickly you need it.

WHOIS Lookup

WHOIS is the traditional protocol for querying domain registration data. Status codes appear in the output under “Domain Status.” You can do a WHOIS lookup at:

Your registrar’s website

ICANN’s Lookup tool: lookup.icann.org

InterNIC’s WHOIS: internic.net/whois.html

Command line: whois yourdomain.com (on Linux/macOS)

WHOIS output for a healthy domain looks something like this:

Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Domain Status: clientDeleteProhibited
Domain Status: clientRenewProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
...

This is actually a very common and healthy combination — it means the registrar has set all four client protection locks, which is standard practice for many registrars.

RDAP (Registration Data Access Protocol)

RDAP is the modern replacement for WHOIS. It works over HTTPS, returns structured JSON data, and uses slightly different terminology for status codes (e.g., “clienttransferprohibited” instead of “clientTransferProhibited,” and “active” instead of “ok”). ICANN’s RDAP endpoint is available at rdap.verisign.com for .com domains. For a human-readable RDAP result, use lookup.icann.org.

# RDAP query via curl
curl -s "https://rdap.verisign.com/com/v1/domain/EXAMPLE.COM" | python3 -m json.tool

Via the Domain Registrar API

If you’re managing domains programmatically, GetDetails() returns the current status codes for any domain in your portfolio. This is the most reliable method for automation and monitoring.

You can also check status codes through the DomainNameAPI WHOIS Lookup tool or the RDAP Lookup.

Client Codes vs. Server Codes: The Most Important Distinction

This is the piece that most explanations gloss over, but it’s the key to understanding who can fix your problem and how quickly.

Server codes almost always take precedence over client codes. If a domain has serverHold, the domain won’t resolve in the DNS even if all client codes look normal.

The Domain Lifecycle: How Status Codes Change Over Time

A domain moves through predictable status phases from the moment it’s registered to the moment it’s either renewed, transferred, or ultimately purged from the registry database. Understanding this lifecycle helps you anticipate what codes you’ll see and when.

Domain Lifecycle Flow:

Complete Status Code Quick Reference: All 23 Codes at a Glance

Complete Status Code Reference: All 23 EPP Codes Explained

The following covers every standardized EPP status code defined in RFC 5731 and the Registry Grace Period codes defined in RFC 3915. For each code, you’ll find what it means, who sets it, what it affects, and what to do.

✅ ok (RDAP: active)

ok — Quick Answer

“ok” and “active” refer to the same state; “ok” is the EPP/WHOIS representation and “active” is the RDAP representation. A domain can simultaneously show “ok” alongside client protection codes like clientTransferProhibited — this is actually the recommended configuration for most domains, since the protection locks don’t interfere with normal resolution and operation.

⚠️ inactive (RDAP: inactive)

inactive — Quick Answer

Inactive domains are common in two scenarios: newly registered domains that haven’t been pointed to a hosting provider yet, and domains purchased as brand protection reserves with no intention of hosting a website. If a domain has been inactive for several days after registration and you expected it to be live, contact your registrar — some TLDs require documentation before a domain becomes active in the DNS.

🔒 clientTransferProhibited (RDAP: client transfer prohibited)

clientTransferProhibited — Quick Answer

This is one of the most misunderstood status codes. When someone sees “clientTransferProhibited” on their domain and can’t figure out why transfers fail, the answer is almost always this code. It’s not a problem — it’s a protection. Most registrars enable it by default on new registrations to prevent unauthorized outbound transfers.

To transfer a domain to another registrar, you must first unlock it (remove this status), then request the EPP/authorization code, then initiate the transfer. Some TLDs have ICANN’s 60-day transfer lock rule: if a domain was registered or transferred within the last 60 days, it cannot be transferred even if clientTransferProhibited is removed.

🔴 serverTransferProhibited (RDAP: server transfer prohibited)

serverTransferProhibited — Quick Answer

Three common reasons for serverTransferProhibited: (1) A legal dispute or UDRP proceeding has resulted in the registry placing a hold on changes, (2) The registrant requested a premium Registry Lock service for extra security, or (3) The domain is in a status that prevents transfer (like redemptionPeriod). Each case has a very different resolution path, so getting specific information from your registrar is the first step.

🚨 clientHold (RDAP: client hold)

clientHold — Quick Answer

clientHold is one of the more disruptive status codes because it takes your website and email offline without any change to your hosting. Visitors see DNS errors, not hosting errors. Common causes include: unpaid domain renewal fees, violation of the registrar’s Terms of Service, failure to respond to ICANN’s WHOIS Data Reminder Policy (WDRP) emails, an ongoing legal dispute, or fraudulent registration data.

If you discover your domain has clientHold and you don’t know why, your registrar’s support team is the only party that can tell you — and fix it.

🚨 serverHold (RDAP: server hold)

serverHold — Quick Answer

serverHold is less common than clientHold but harder to resolve. Typical causes include registry-level abuse determinations (the registry decided the domain was being used for spam, phishing, or malware), court orders, or registry-specific policies. For most registrants, the process starts the same way: contact your registrar, provide documentation if requested, and let them work with the registry.

🔒 clientUpdateProhibited (RDAP: client update prohibited)

This code prevents any updates to the domain record — nameserver changes, contact information changes, DNSSEC records. It’s often set alongside other protection locks as part of a “registrar lock” bundle. If you need to change your nameservers and the update fails, check for this status first.

🔴 serverUpdateProhibited (RDAP: server update prohibited)

Like its client counterpart, but set by the registry. Common in Registry Lock services and during certain dispute proceedings. Any update attempt — including nameserver changes through your registrar panel or API — will be rejected at the registry level until this is lifted.

🔒 clientDeleteProhibited (RDAP: client delete prohibited)

Prevents the domain from being deleted by the registrar. This is a pure protection code — it has no effect on DNS, email, or your ability to use the domain. It’s part of the standard “registrar lock” bundle that most registrars apply by default.

🔴 serverDeleteProhibited (RDAP: server delete prohibited)

Registry-level delete protection. Common during legal proceedings (where deleting the domain would be destroying evidence or a contested asset), or when a Registry Lock service is in place. The domain operates normally; it simply cannot be deleted while this is active.

⚠️ clientRenewProhibited (RDAP: client renew prohibited)

This one is serious in the medium term: the domain is functional now, but it cannot be renewed, which means it will expire and eventually be deleted. This code is typically set during a legal dispute where renewal would extend a contested asset, or during a UDRP proceeding. If you see this code, contact your registrar immediately — if the domain is about to expire, the timeline matters.

🔴 serverRenewProhibited (RDAP: server renew prohibited)

Registry-set renewal block. Same consequences as clientRenewProhibited, but only the registry can lift it. If you see this status and don’t understand why, treat it as urgent: a domain that can’t be renewed will eventually expire. Engage your registrar to find out what triggered it.

⚠️❗ redemptionPeriod (RDAP: redemption period)

redemptionPeriod — Quick Answer

The redemptionPeriod is your last real chance to recover a domain. The cost is typically much higher than renewal — often $75–$200 depending on the TLD and registrar — because the registry charges a redemption fee in addition to the normal renewal cost. Once this period ends and the domain enters pendingDelete, restoration is no longer possible.

Common reasons a domain enters redemptionPeriod: you or your registrar didn’t renew it before the expiration date, there was a payment failure, or the registrar deleted it due to a policy violation. Check your email (spam folder too) for notifications from your registrar before assuming this happened without warning.

❗❗ pendingDelete (RDAP: pending delete)

pendingDelete — Quick Answer

pendingDelete appears in three contexts: (1) standalone after redemptionPeriod expiry — no restoration is possible; (2) combined with redemptionPeriod — the domain is in its 30-day window and can still be restored; (3) combined with pendingRestore — a restore request has been submitted and is being processed. Context matters completely here.

⏳ pendingRestore (RDAP: pending restore)

⏳ pendingTransfer (RDAP: pending transfer)

A domain in pendingTransfer will complete the transfer automatically after the waiting period unless the current registrar explicitly rejects it. The ICANN Transfer Policy allows registrants to explicitly approve transfers early (which speeds them up) or reject unauthorized ones.

⏳ pendingCreate (RDAP: pending create)

⏳ pendingRenew (RDAP: pending renew)

⏳ pendingUpdate (RDAP: pending update)

ℹ️ addPeriod (RDAP: add period)

ℹ️ renewPeriod (RDAP: renew period)

ℹ️ autoRenewPeriod (RDAP: auto renew period)

ℹ️ transferPeriod (RDAP: transfer period)

Which Status Codes Block Transfers?

Transfer attempts fail for several reasons, but status codes are the most common blocker. Here’s a complete picture:

Status Code

Blocks Transfer?

Who Removes It?

How Long Does It Take?

clientTransferProhibited

• ❌ Yes

Registrar

Hours (usually self-service)

serverTransferProhibited

• ❌ Yes

Registry (via registrar)

Days to weeks

clientHold

• ❌ Yes (domain suspended)

Registrar

Resolve underlying issue first

serverHold

• ❌ Yes (domain suspended)

Registry

Depends on reason

pendingTransfer

• ❌ Yes (transfer already in progress)

N/A

Wait for current transfer to complete

redemptionPeriod

• ❌ Yes

N/A

Must restore first

pendingDelete

• ❌ Yes

N/A

Cannot transfer; must re-register after purge

ok

✅ Transfer allowed

N/A

Proceed with auth code request

ICANN’s 60-Day Transfer Lock Rule

Even if all transfer-prohibiting status codes are removed, a domain cannot be transferred if it was registered or transferred within the last 60 days. This is an ICANN policy requirement, not a registrar-specific restriction. The lock resets each time a successful transfer completes.

Need to transfer a domain or check its current lock status? Start a domain transfer or search for a new domain.

Which Status Codes Take Your Website Offline?

Not all status codes affect DNS. Many protection codes (like clientTransferProhibited) leave your website running perfectly while preventing unauthorized changes. The ones that actually affect DNS resolution are:

Status Code

Website Goes Offline?

Why

clientHold

• ❌ Yes

Registrar tells registry to remove delegation from DNS

serverHold

• ❌ Yes

Registry removes delegation from DNS

inactive

• ❌ Yes (never was online)

No nameservers configured

redemptionPeriod

• ❌ Yes

Domain removed from active zone

pendingDelete

• ❌ Yes

Domain removed from active zone

ok

✅ Website works

Domain is active in DNS

clientTransferProhibited

✅ Website works

Only blocks transfers

clientUpdateProhibited

✅ Website works

Only blocks updates

clientDeleteProhibited

✅ Website works

Only blocks deletion

serverTransferProhibited

✅ Website works (usually)

Only blocks transfers unless combined with a hold

pendingTransfer

✅ Website works

DNS is active during transfer process

addPeriod / renewPeriod / autoRenewPeriod / transferPeriod

✅ Website works

Informational grace period; no DNS impact

Which Status Codes Affect Email?

Email depends entirely on DNS — specifically, MX records. If a domain is not active in the DNS, no email can be sent to or from addresses at that domain. The same status codes that take your website offline will also break email:

Status Code

Email Works?

Notes

clientHold

• ❌ No

DNS suspended; MX records not reachable

serverHold

• ❌ No

DNS suspended

inactive

• ❌ No

No DNS delegation; MX records not served

redemptionPeriod

• ❌ No

Domain removed from active zone

pendingDelete

• ❌ No

Domain removed from active zone

ok (+ any protection codes)

✅ Yes

DNS is active; email delivers normally

pendingTransfer

✅ Yes

Email works during transfer

One important nuance: if your domain is in clientHold or serverHold, email sent to your domain addresses during that period is typically lost. It doesn’t queue up and deliver when the domain is restored — it bounces or is silently dropped. If you’re dealing with a suspended domain that hosts email, resolve the hold as quickly as possible and communicate with contacts through an alternate channel.

Check your domain’s current EPP status right now: DomainNameAPI WHOIS Lookup.

Real Troubleshooting Scenarios

Scenario 1: “My Domain Won’t Transfer — The Receiving Registrar Says It’s Rejected”

Run a WHOIS lookup and look at the Domain Status field. The most likely culprit:

• 1.clientTransferProhibited — Log in to your current registrar and unlock the domain (look for “Disable transfer lock” or “Domain lock”). Wait a few minutes for the change to propagate, then request your EPP code and restart the transfer.
• 2.serverTransferProhibited — Contact your registrar. Ask them to contact the registry on your behalf to remove the lock. Provide any documentation they ask for.
• 3.ICANN 60-day lock — If the domain was just registered or recently transferred, you must wait out the 60-day period before any transfer is possible.

Scenario 2: “My Website Is Down but My Hosting Is Fine”

If your hosting control panel shows everything is running but your website isn’t loading and DNS lookups return nothing, the problem is almost certainly domain-side.

• 1.Check for clientHold or serverHold in WHOIS. Either one removes the domain from DNS.
• 2.Check for inactive — if you recently changed registrars or made nameserver changes, the domain may have lost its nameserver configuration.
• 3.If the status looks fine, check whether you’re within a transfer period and your new registrar hasn’t yet confirmed the nameserver settings.

Scenario 3: “My Domain Is in redemptionPeriod. Can I Get It Back?”

Yes, but act immediately.

You typically have 30 days from when the domain entered redemptionPeriod. After that, it moves to pendingDelete for ~5 days and then is purged permanently.

Contact your registrar today. They can initiate a restore on your behalf, but they’ll charge a restore fee (often $75–$200) on top of the standard renewal cost. This is significantly more expensive than simply renewing before expiry.

The restore fee is set by the registry, not the registrar, and cannot be waived.

Scenario 4: “My Domain Shows pendingTransfer but I Didn’t Request One”

This is an emergency. Contact your current registrar immediately and ask them to reject the transfer in progress. You have until the transfer period expires (usually 5 days from when it was initiated) to stop it. Under ICANN’s Transfer Policy, registrars must provide a way to deny unauthorized transfers.

If you believe your account was compromised, also change your account password and enable two-factor authentication on your registrar account before doing anything else.

Scenario 5: “My Domain API Call to Update Nameservers Returns an Error”

If a programmatic update is failing, check for clientUpdateProhibited or serverUpdateProhibited. If the domain has a registrar lock set, update commands will be rejected at the registry level, not the API level. Remove the lock, retry the update, then reapply the lock if desired.

Decision Tree: What to Do When Something’s Wrong

Is your domain working at all?

└ clientHold: contact your registrar to resolve the hold reason.

└ serverHold: contact your registrar; they’ll escalate to the registry.

└ inactive: add nameservers via your registrar panel or API.

└ redemptionPeriod: contact registrar immediately and request a restore.

└ pendingDelete: too late for restore; monitor for when domain drops.

└ Status shows ok: DNS issue is probably hosting-side, not domain-side.

Domain Status Codes for Developers and Registrar API Users

If you’re building on top of a domain registrar API, status codes appear in domain detail responses and need to be handled in your application logic. Key patterns:

Checking Status Before an Operation

// Using Domain Name API PHP library: check status before attempting transfer
$details = $dna->GetDetails('example.com');
$statusCodes = $details['data']['Status']; // returns array of current status codes

// Check if domain is safe to transfer
$blockers = ['clientTransferProhibited', 'serverTransferProhibited', 'clientHold', 'serverHold'];
$blocked = array_intersect($statusCodes, $blockers);

if (!empty($blocked)) {

    // Cannot transfer; inform user which code is blocking
    foreach ($blocked as $code) {
        echo "Transfer blocked by: " . $code . "\n";
    }
} else {
    // Safe to proceed; request auth code
    $authCode = $dna->GetAuthCode('example.com');
}

Monitoring for Expiration-Risk Codes

// Monitor domains for at-risk status codes
$atRiskCodes = ['redemptionPeriod', 'pendingDelete', 'clientRenewProhibited', 'serverRenewProhibited'];

$domainList = $dna->GetList([]);
foreach ($domainList['data'] as $domain) {
    $details = $dna->GetDetails($domain['DomainName']);
    $status = $details['data']['Status'];

    $risks = array_intersect($status, $atRiskCodes);
    if (!empty($risks)) {
        // Alert: domain at risk
        sendAlert($domain['DomainName'], $risks);
    }
}

RDAP Status Mapping Reference

EPP Code (WHOIS)

RDAP Code

ok

active

inactive

inactive

clientDeleteProhibited

client delete prohibited

clientHold

client hold

clientRenewProhibited

client renew prohibited

clientTransferProhibited

client transfer prohibited

clientUpdateProhibited

client update prohibited

serverDeleteProhibited

server delete prohibited

serverHold

server hold

serverRenewProhibited

server renew prohibited

serverTransferProhibited

server transfer prohibited

serverUpdateProhibited

server update prohibited

pendingDelete

pending delete

pendingTransfer

pending transfer

pendingCreate

pending create

pendingRenew

pending renew

pendingUpdate

pending update

pendingRestore

pending restore

addPeriod

add period

renewPeriod

renew period

autoRenewPeriod

auto renew period

transferPeriod

transfer period

redemptionPeriod

redemption period

Useful tools: WHOIS Lookup — Domain Search — Domain Transfer — Registrar API.

Frequently Asked Questions

What does clientTransferProhibited mean?

It means your registrar has instructed the registry to reject any transfer request for this domain. It’s usually a security feature that prevents unauthorized outbound transfers. To transfer the domain, you must ask your registrar to remove this status first.

Can I remove clientTransferProhibited myself?

Most registrars provide a self-service unlock option in their domain management panel, labeled something like “Unlock domain” or “Disable transfer lock.” If there’s no self-service option, contact your registrar’s support team.

What’s the difference between clientTransferProhibited and serverTransferProhibited?

clientTransferProhibited is set by your registrar and can be removed by your registrar. serverTransferProhibited is set by the registry and can only be removed by the registry; your registrar has to request the removal on your behalf.

Why is my domain showing clientHold?

clientHold means your registrar has suspended your domain, taking it offline. Common reasons include an unpaid invoice, a Terms of Service violation, failure to respond to WHOIS accuracy verification emails, or an ongoing dispute. Contact your registrar to find out the specific reason.

My domain is in redemptionPeriod. What do I do?

Contact your registrar immediately. You have 30 days to restore the domain, but it costs significantly more than a normal renewal (typically a registry-charged redemption fee plus renewal). After the 30-day window, the domain enters pendingDelete and cannot be recovered.

Can I transfer a domain that’s in redemptionPeriod?

No. A domain in redemptionPeriod cannot be transferred. You must first restore it (which brings it back to active status), then you can initiate a transfer if needed.

What happens to my website when a domain enters clientHold?

The domain is removed from active DNS, which means your website is inaccessible, email stops working, and any DNS-dependent service (SSL, email deliverability verification, etc.) fails. Hosting is unaffected; only the domain-level DNS resolution stops.

What’s the difference between inactive and ok?

ok (active) means the domain is fully configured and working. inactive means the domain has no nameservers configured, so it doesn’t resolve in the DNS. An inactive domain isn’t suspended; it simply hasn’t been pointed at any hosting.

How long does pendingDelete last?

Approximately 5 days. After that, the domain is purged from the registry database and becomes available for public registration.

Can I register a domain that’s in pendingDelete?

Not directly. Once the domain is purged (after the ~5-day pendingDelete window), it becomes available. Backorder services monitor for domain drops and attempt to register the domain the moment it’s released.

Why does my WHOIS show both ok and clientTransferProhibited?

This is completely normal and actually recommended. ok means the domain is active with no pending operations. clientTransferProhibited is a protection lock that sits alongside ok. The two codes are not contradictory.

What does addPeriod mean?

addPeriod is the 5-day grace period after initial registration. If the registrar deletes the domain during this window, the registry credits back the registration fee. It’s informational only; the domain is working normally.

What does transferPeriod mean?

transferPeriod is the 5-day grace period after a successful transfer to a new registrar. The new registrar can delete the domain and get the transfer fee credited back. The domain is working normally during this period.

What does autoRenewPeriod mean?

autoRenewPeriod is the grace period after the registry auto-renewed the domain on your behalf. Your registrar will typically charge you for this renewal. If you didn’t want the domain renewed, contact your registrar quickly.

What is pendingTransfer?

A transfer request was submitted and is being processed. The domain continues to work normally. The transfer completes after 5 days unless the current registrar denies it or the registrant explicitly approves or rejects it.

Someone submitted a transfer request without my permission. What do I do?

Contact your registrar immediately and ask them to deny the pending transfer. Under ICANN’s Transfer Policy, registrars must provide a way to reject unauthorized transfers. Act quickly; you typically have 5 days before the transfer auto-completes.

What’s the ICANN 60-day transfer lock?

ICANN requires that domains cannot be transferred for 60 days after registration or after a previous transfer completes. This prevents rapid re-registrations used in fraud or hijacking schemes. No status code explicitly says “60-day lock” — it’s a policy layer that registries enforce automatically.

What does serverHold mean?

The registry has suspended the domain. It’s not active in the DNS, so the website and email are down. Only the registry can lift it, which means your registrar must escalate the issue to them. Reasons include registry-determined abuse, court orders, or certain registry policies.

Can my registrar remove a server status code?

Not directly. Server codes are controlled by the registry. Your registrar can only request that the registry remove a server code on your behalf.

What status code should I expect after registering a new domain?

Immediately after registration you’ll see addPeriod, and once nameservers are configured, you should see ok (plus any client protection locks your registrar sets by default). If you see inactive, it means nameservers haven’t been assigned yet.

What status appears during a domain renewal?

If you manually renewed, you’ll see renewPeriod for a few days. If the registry auto-renewed it, you’ll see autoRenewPeriod. Both are grace periods and normal; the domain is working during both.

What does clientRenewProhibited mean and should I be worried?

It means your registrar has told the registry to reject renewal requests for this domain. The domain is still functioning, but it will eventually expire and cannot be renewed. This is often set during disputes or UDRP proceedings. Contact your registrar as soon as you see it.

Can I see domain status codes via the command line?

Yes. On Linux/macOS: whois yourdomain.com. Look for lines starting with “Domain Status:”. For RDAP: curl -s /com/v1/domain/YOURDOMAIN.COM | python3 -m json.tool

What’s the restore fee for a domain in redemptionPeriod?

Restore fees are set by the registry and vary by TLD. For .com, the registry redemption fee from Verisign is charged on top of the normal renewal. Expect to pay anywhere from $75 to $200+ in total depending on your registrar’s markup. This is non-negotiable — it goes to the registry.

Do all TLDs have the same grace periods?

No. Grace periods (addPeriod, renewPeriod, autoRenewPeriod, redemptionPeriod) are defined by individual registry policies and can vary significantly, especially for ccTLDs (country-code TLDs like .uk, .de, .au). Some ccTLD registries don’t have a redemption period at all — domains are purged immediately after deletion.

Why is clientTransferProhibited shown for ICANN’s own domains?

Major organizations often request all four client protection codes (clientDeleteProhibited, clientTransferProhibited, clientUpdateProhibited, clientRenewProhibited) as a standard security baseline. Even ICANN’s own domains use these codes. High-value domains often also have serverUpdateProhibited and serverTransferProhibited from a Registry Lock service for maximum security.

What is the Registry Lock service?

Registry Lock is a premium security service offered by some registries where server-level codes (serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited) are manually set and require offline verification to change. It protects against hijacking that might compromise a registrar account. Large enterprises, financial institutions, and domain investors use it for critical domains.

Do status codes appear in RDAP differently than WHOIS?

Yes. RDAP uses lowercase with spaces and slightly different terms: “ok” becomes “active,” “clientTransferProhibited” becomes “client transfer prohibited.” The RDAP URL for each status also includes the full ICANN documentation link for that code.

How do I prevent my domain from being hijacked?

Enable all four client protection codes: clientDeleteProhibited, clientTransferProhibited, clientUpdateProhibited, and clientRenewProhibited. For high-value domains, ask your registrar if they support Registry Lock (server-level protection). Also enable two-factor authentication on your registrar account.

Can a domain have multiple status codes simultaneously?

Yes — and this is normal. Most well-managed domains show several codes at once: ok alongside all four client protection locks, for example. The codes work together and don’t conflict unless one overrides another (e.g., serverHold overrides clientUpdateProhibited in terms of urgency).

What is RDAP and how is it different from WHOIS?

RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It runs over HTTPS, returns structured JSON, supports authentication, and is more privacy-compliant. RDAP is what all major registries and registrars are moving toward. The status codes are the same in both; only the format and some terminology differ.

If my domain has serverTransferProhibited, can I still change my DNS settings?

Usually yes — serverTransferProhibited only blocks transfers. Unless serverUpdateProhibited is also set, DNS and nameserver changes can still be processed.

How quickly does DNS come back online after a hold is removed?

Once clientHold or serverHold is removed, the registry re-delegates the domain in the DNS. Propagation happens within minutes at the registry level, but worldwide DNS cache expiry can take up to the TTL value of the old records (typically 24–48 hours for some resolvers). Most users will see the site again within a few hours.

What’s a CSR in the context of domain status?

CSR (Certificate Signing Request) is unrelated to domain status codes — it’s part of SSL certificate provisioning. You might encounter both when setting up a new domain, but they operate at different levels. Domain status codes are at the registry/registrar level; CSRs are at the certificate authority level.

Can I check a domain’s EPP status via API?

Yes. Using a domain registrar API like Domain Name API, the GetDetails() method returns the current status code array for any domain in your portfolio. For domains you don’t own, WHOIS and RDAP lookups return the public status information.

What EPP status code appears when a domain is first registered?

addPeriod. This is the 5-day grace period after initial registration. The domain is fully functional as long as nameservers are configured.

Does clientTransferProhibited prevent nameserver changes?

No. clientTransferProhibited only blocks transfers to another registrar. Nameserver changes are controlled by clientUpdateProhibited — a completely separate code.

What is the difference between a registrar lock and a registry lock?

A registrar lock is a set of client-level codes set by your registrar (clientDeleteProhibited etc.). A Registry Lock is a premium service where the registry itself sets server-level codes, requiring offline verification to change anything. Registry Lock is significantly more secure.

Can I use Domain Name API to set clientTransferProhibited programmatically?

What happens to a domain’s DNS records during pendingTransfer?

DNS records remain unchanged during a transfer. The nameservers in place before the transfer stay in place after completion. The transfer only moves which registrar manages the domain.

How do I get an auth code (EPP code) for a domain that has clientTransferProhibited?

First remove clientTransferProhibited (unlock the domain), then request the auth code from your registrar. Some registrars display it automatically after unlocking; others email it to the registrant.

If my domain is in pendingDelete, can a third party register it immediately?

No — the domain is still reserved until it’s purged (after the 5-day window). Once purged, it becomes available for public registration and anyone, including drop-catching services, can register it.

Are EPP status codes the same for all TLDs?

The core codes defined in RFC 5731 are standardized across generic TLDs (.com, .net, .org, etc.). Some ccTLDs use their own proprietary status systems; check the specific registry’s documentation for country-code domains.

What causes pendingTransfer to take longer than expected?

Usually the current registrar has neither approved nor denied the transfer and the 5-day waiting period hasn’t elapsed. Some registrars deliberately delay. If more than 5 business days pass, contact your gaining registrar to escalate.

Does changing nameservers affect domain status codes?

No. Nameserver changes and status codes are completely independent parts of the domain’s registry record.

Can a domain have both clientHold and serverHold at the same time?

Yes. Both must be resolved before the domain becomes active: your registrar handles clientHold, and your registrar must escalate serverHold to the registry.

Can I transfer my domain away if my current registrar is holding it in clientHold?

Generally no. Most registries reject transfer requests when a domain is in clientHold because the domain is suspended. Resolve the hold first, then initiate the transfer.

What WHOIS privacy or GDPR redaction looks like vs. a hold?

WHOIS privacy redaction replaces contact data with proxy information but leaves the domain status as ok or with standard lock codes. A hold (clientHold or serverHold) is a completely separate code that affects DNS. They can coexist — a domain can have WHOIS privacy enabled AND be in clientHold.

Can the Domain Name API notify me when a domain enters redemptionPeriod?

Conclusion

Domain status codes are the registrar system’s way of communicating the current state of a domain registration to everyone who needs to know: the registrant, the registrar, the registry, and anyone else who runs a WHOIS or RDAP query. Most of the time, the status codes you see are either “everything is fine” signals (ok, addPeriod, renewPeriod) or standard security measures (clientTransferProhibited, clientDeleteProhibited) that work in the background without affecting your site.

The ones to watch closely are the holds (clientHold, serverHold), the lifecycle-critical codes (redemptionPeriod, pendingDelete), and anything that blocks an operation you need to perform (clientTransferProhibited when you’re trying to transfer, clientUpdateProhibited when you’re trying to change nameservers).

In all cases, the process starts with a WHOIS or RDAP lookup, interpreting what you see, identifying whether the code is client-set or server-set, and reaching out to your registrar with that information already in hand.

Useful tools for domain status management:

• ✔ WHOIS Lookup — find current status codes for any domain
• ✔ Domain Transfer — initiate or track a transfer
• ✔ Domain Registration — register new domains
• ✔ Reseller API — manage domain status programmatically