Look up any domain in WHOIS or ICANN Lookup and you'll see one or more status codes:
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
They come from EPP, the protocol registrars use to talk to registries. Newer RDAP lookups show the same codes in plain words ("client transfer prohibited"). Most are locks or harmless notes. A few mean your domain is off the internet or about to be lost.
clientTransferProhibited
The most common status, and a good one. ICANN's description: "This status code tells your domain's registry to reject requests to transfer the domain." It's what registrars call domain lock or transfer lock, and it stops someone moving your domain to another registrar.
Leave it on unless you're transferring. To move the domain, turn the lock off in your registrar's control panel. If the registrar gives you no way to do that, ICANN's Transfer Policy requires it to remove the lock within five calendar days of your request.
Removing the lock isn't always enough. Under the current policy a registrar may still refuse a transfer:
- within 60 days of registration;
- within 60 days of a previous transfer;
- for 60 days after a change of registrant (new owner name or organisation), unless you opted out before the change.
For the steps, see transfer a domain safely.
The codes, grouped by what they mean
Locks: good to have
| Status | Meaning |
|---|---|
clientTransferProhibited |
Registrar lock against transfers |
clientUpdateProhibited |
Registrar lock against changes (contacts, nameservers) |
clientDeleteProhibited |
Registrar lock against deletion |
serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited |
The same locks set at the registry: either a registry lock you asked for, or the registry's own action |
client codes are set by your registrar, server codes by the registry
itself. Your registrar can't remove a server code; the registry has to.
Normal: nothing to do
| Status | Meaning |
|---|---|
ok (RDAP: active) |
No locks and nothing pending |
addPeriod |
Grace period just after registration |
autoRenewPeriod |
The registry renewed it at expiry; a grace period follows |
Act now
| Status | Meaning | What to do |
|---|---|---|
clientHold |
Your registrar has taken the domain out of DNS: often unpaid, expired, or a dispute | Contact the registrar |
serverHold |
The registry has taken it out of DNS | Contact the registrar, which deals with the registry |
redemptionPeriod |
The domain was deleted after expiry; you have 30 days to restore it | Contact the registrar immediately; restoring costs extra |
pendingDelete |
Redemption is over; it will be released within days | Usually too late to restore |
pendingTransfer |
A transfer to another registrar is in progress | If you didn't ask for it, contact your registrar immediately |
inactive |
No nameservers are set | Set nameservers if the domain should be in use |
A hold means the domain doesn't resolve at all: website, email, everything. For expiry, see domain expired. For a transfer or change nobody on your side asked for, see nameservers changed without permission.
serverTransferProhibited that you didn't ask for can also mean a dispute
or a problem the registry wants sorted out; ask your registrar.
What a well-protected domain shows
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
plus the three server versions if you use a registry lock. A domain that
only shows ok has no lock at all: turn on the transfer lock at your
registrar.
Check your domain
The domain expiry checker shows your domain's status codes, registrar and expiry date. Nameward's monitoring alerts you if the transfer lock is turned off, or the registrar or nameservers change.