clientTransferProhibited and Other Domain Status Codes

You run a WHOIS lookup on your domain and see clientTransferProhibited. It sounds like a problem. It is not: it is the normal transfer lock, and on your own domain you want it there. Other codes on the same line, such as clientHold or redemptionPeriod, are real emergencies. This guide explains every status code you are likely to meet, who set it, and what, if anything, to do.

Where status codes come from

Registrars talk to registries through a protocol called EPP (Extensible Provisioning Protocol). Each domain object in the registry database carries one or more status values defined by that protocol. WHOIS and RDAP simply display them.

Two things make them easy to read:

• The prefix tells you who set the code. client… was set by the registrar (the registry's client). server… was set by the registry. You can ask your registrar to remove a client code; a server code needs the registry, usually via the registrar, and usually has a formal reason behind it.
• WHOIS and RDAP spell them differently. WHOIS shows the EPP form, clientTransferProhibited. RDAP uses words: client transfer prohibited. ok in EPP is active in RDAP. They are the same thing.

A domain can carry several codes at once. ok is the exception: it only appears when no other restriction is set.

$ whois example.com | grep -i 'domain status'
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

$ curl -s https://rdap.example/domain/example.com | jq .status
[
  "client delete prohibited",
  "client transfer prohibited",
  "client update prohibited"
]

(rdap.example stands for the TLD's RDAP server.)

Locks: the codes you want to see

Code	Meaning	Action
ok / active	No restrictions at all.	Consider turning on the transfer lock.
clientTransferProhibited	Registrar's transfer lock. Transfer requests to another registrar are rejected.	None. Remove it only when you really transfer.
clientUpdateProhibited	Changes to the domain (nameservers, contacts) are blocked at registry level.	Remove temporarily when you need to change nameservers.
clientDeleteProhibited	The domain cannot be deleted.	None.
clientRenewProhibited	Renewal is blocked. Rare; seen in disputes or account problems.	Ask the registrar why.
serverTransferProhibited	Registry-level transfer block.	See below.
serverUpdateProhibited, serverDeleteProhibited	Registry-level locks against changes and deletion.	Normally part of a registry lock service you ordered.
serverRenewProhibited	Registry blocks renewal. Rare; dispute or policy case.	Registrar support.

When serverTransferProhibited is normal

serverTransferProhibited appears in three ordinary situations:

1. New registration or recent transfer. Many registries block transfers for the first 60 days after creation or after an inter-registrar transfer.
2. Registry lock. A paid service for high-value names: the three server…Prohibited codes are set, and removing them needs a manual, out-of-band verification between registrar and registry. It protects against a compromised registrar account.
3. A dispute or legal process, for example a UDRP complaint. The lock keeps the name where it is until the case is decided.

If none of these fits, ask the registrar.

Holds: the domain is switched off

These are the codes that explain "my site and email stopped working and DNS looks fine at the provider".

Code	Meaning
clientHold	The registrar has removed the domain from the TLD zone. The delegation is gone; nothing resolves.
serverHold	The registry has done the same.
inactive	The domain has no nameservers assigned, so there is nothing to publish.

With a hold in place your DNS provider's zone can be perfect and it makes no difference, because the parent zone no longer points to it:

$ dig +short example.com NS @a.gtld-servers.net
$                        # empty: not delegated

Typical reasons for clientHold:

• Unpaid renewal. The domain expired and the registrar suspended it. See what happens when a domain expires.
• Unverified registrant contact. After registration, a transfer, or a change of registrant email, ICANN-accredited registrars must verify the email (or phone). If you do not click the link within 15 days, they are required to suspend the domain. Look for the verification mail, including in the spam folder, and ask the registrar to resend it.
• Abuse or a payment dispute. Phishing reports, malware, a chargeback. Only the registrar can tell you.

serverHold is usually legal or policy-related: a court order, a registry abuse action, or a TLD eligibility requirement that was not met. Your registrar is still the first point of contact.

inactive is fixed by setting nameservers. Some registries require at least two.

Lifecycle codes: time-limited periods

Code	When	Typical length (gTLD)	What it means for you
addPeriod	right after registration	5 days	The registrar may delete the name for a refund. Not a restriction on use.
renewPeriod	after an explicit renewal	5 days	Same, for the renewal fee.
autoRenewPeriod	after expiry, when the registry auto-renewed	up to 45 days	Possibly unpaid. Check with the registrar.
transferPeriod	after a completed transfer	5 days	Informational.
redemptionPeriod	after the registrar deleted the name	30 days	Only the former owner can restore it, for a fee.
pendingRestore	restore requested, waiting for the registrar's report	a few days	Wait; chase the registrar if it takes long.
pendingDelete	after redemption	5 days	Cannot be recovered. Will be released.

Lengths vary by TLD, and country-code TLDs often use a different lifecycle altogether. Read them as the common gTLD pattern.

pendingDelete has one subtlety: seen together with redemptionPeriod it still means the redemption stage. Alone, it means the final five days.

Pending codes: an operation is in progress

• pendingTransfer — a transfer to another registrar has been requested. If you did not request it, contact your current registrar immediately and have it rejected; the window is five days. If you did, see how to transfer a domain name.
• pendingCreate, pendingUpdate, pendingRenew — the registry is processing a request, sometimes with manual checks (common in restricted TLDs).
• pendingDelete — see above.

A quick triage

1. Site and mail down, DNS at the provider looks right → look for clientHold, serverHold, inactive, redemptionPeriod, pendingDelete.
2. Transfer rejected → look for clientTransferProhibited (unlock at the registrar) or serverTransferProhibited (60-day rule, registry lock, dispute).
3. Nameserver change rejected → clientUpdateProhibited or serverUpdateProhibited.
4. Expiry date looks fine but something feels off → autoRenewPeriod means "renewed by the registry", not "paid by you".
5. pendingTransfer you did not start → call the registrar now.

Common mistakes

• Removing the transfer lock "to be safe" and leaving it off. An unlocked domain with a leaked auth code is one email approval away from leaving.
• Debugging DNS for hours without looking at the registration status.
• Ignoring the registrant verification email because it looks like spam.
• Assuming server codes can be removed from the registrar control panel.
• Reading ccTLD output with gTLD expectations. Many country-code registries show their own status vocabulary.

Check it with OrbitProbe

The OrbitProbe WHOIS lookup queries RDAP and lists every status code next to the registrar, the dates, the nameservers and the DNSSEC state, with the source server and the time of the query. If a hold or a lifecycle code is present you see it at once, instead of finding out from a customer. The background on where the data comes from is in WHOIS vs RDAP.