Domain Status Codes Explained: What clientTransferProhibited, serverHold, and Other EPP Codes Mean for Your Domain

Domain Status Codes Explained: What clientTransferProhibited, serverHold, and Other EPP Codes Mean for Your Domain

If you’ve ever tried to transfer a domain to a new registrar only to see a red “Transfer Prohibited” error, you’ve already met EPP status codes. The Extensible Provisioning Protocol (EPP) codes are flags set by registries and registrars that define the current state of a domain name. Knowing what each code means—and how to change it—can save you from expired domains, failed transfers, or lost business.

Whether you’re a website owner, a developer managing multiple domains, or a domain investor, understanding these codes is essential. Let’s break down the most common ones with real-world examples and actionable advice.

What Are EPP Domain Status Codes?

EPP status codes are part of the technical protocol that registries (like Verisign for .com) use to communicate with registrars. Each status code either grants or restricts an action—such as transferring, deleting, or renewing a domain. They fall into two categories:

• Client‑set codes: Selected by your registrar (or by you, through your registrar’s control panel).
• Server‑set codes: Placed by the registry, often because of a dispute, expiration, or legal hold.

You can see the current status of any domain by performing a WHOIS Lookup on Whose.Domains. Look for the “Domain Status” line—it will list one or more EPP codes.

Client‑Set Codes (You Control These)

clientTransferProhibited

This is the most common code you’ll encounter. When a domain is marked clientTransferProhibited, it cannot be transferred to another registrar. This is a standard security measure to prevent unauthorized transfers—if a hijacker steals your login, they still can’t move your domain away.

Real‑world example: You buy a domain and your registrar automatically applies this code for 60 days after registration or transfer. It’s also often added as a default lock by the registrar.

Actionable advice: Before starting a transfer, you must request your registrar to remove this code. Most have a “Unlock Domain” button in the control panel. After the transfer completes, the lock is usually re-applied automatically.

clientDeleteProhibited

Prevents the domain from being deleted. Useful if you want to avoid accidental deletion by a rogue admin or a support agent.

clientRenewProhibited

Blocks manual renewals (though auto‑renewal may still work). Rarely used, except by registrars as a temporary hold while resolving billing issues.

clientUpdateProhibited

Prevents changes to the domain’s contact information, nameservers, or registrar. Good for extra security if you’re not planning any changes.

clientHold

This code removes the domain from the DNS. Visitors won’t be able to reach your website or email. Registrars sometimes use it to park domains that haven’t been configured or to enforce payment holds.

Example: You let your credit card expire but your domain hasn’t fully expired yet. The registrar might set clientHold as a warning.

Server‑Set Codes (Registry‑Controlled)

serverHold

This one is serious. serverHold is applied by the registry when a domain is no longer active in the zone file—meaning it doesn’t resolve in DNS. Common causes include:

• Expiration: After a domain expires, it may enter a 30‑day grace period where the registry places a serverHold until you renew.
• ICANN verification failure: If you don’t verify your registrant contact email within 15 days, the registry may place a serverHold.
• Abuse or legal hold: UDRP (Uniform Domain‑Name Dispute‑Resolution Policy) actions often trigger server‑set holds.

Real‑world scenario: You forget to renew your domain. After the grace period, it goes into a “redemption” period (typically 30 days) with serverHold and a high ransom fee to restore it.

Actionable advice: Always set up auto‑renewal and keep your contact email address current. If you see serverHold on your domain, check the expiration date and contact your registrar immediately—restoration fees can be $100+ for a .com.

serverTransferProhibited

Registry‑imposed block on transfers. This can happen during a dispute (e.g., UDRP) or while a domain is in the redemption period after expiration. Unlike clientTransferProhibited, you cannot remove it yourself—you must wait for the cause to be resolved or contact your registry.

serverDeleteProhibited

Prevents deletion (usually in legal or bankruptcy situations). Extremely rare for standard owners.

serverRenewProhibited

Blocks renewal at the registry level. Often seen on domains that are under investigation or in dispute. If you encounter this, your only recourse is to resolve the underlying issue with the registry or through legal channels.

serverUpdateProhibited

Registry lock on all updates. Common during ownership disputes or after a domain is stolen, as part of a recovery process.

Pending Codes: Wait and Watch

Some codes indicate an operation is in progress:

• pendingTransfer – A transfer request has been submitted and is waiting approval or expiration of the 5‑day auto‑approval period.
• pendingCreate – The domain is still being provisioned (rarely lasts more than a few minutes).
• pendingDelete – The domain has been scheduled for deletion (e.g., after an unsuccessful redemption).
• pendingRenew – Renewal is being processed by the registry.

If you see a “pending” status that lasts longer than a day, contact your registrar.

How to Check Your Domain’s Status Codes

The easiest way is to use a WHOIS Lookup tool. Enter your domain and look for the “Domain Status” section. Advanced users can also run an RDAP Lookup, which provides richer data including the exact cause of some server‑set codes.

If you’re shopping for a new domain, check its status with Domain Availability—a domain that shows “status: serverHold” might be about to become available, but you can’t register it until that hold is lifted.

Practical Tips for Managing Domain Status

• Keep a lock on 24/7. Unless you’re actively transferring, always leave clientTransferProhibited enabled. It’s the best defense against hijacking.
• Monitor your expiration dates. Set calendar alerts at least 30 days before expiry. Use a Domain History check to see past renewal patterns.
• Verify your WHOIS contact email. If you ignore the verification email from your registrar, ICANN may place a serverHold that takes your site offline.
• Use a registrar that gives you control. Some budget registrars lock domains by default and make it hard to unlock them. Choose one that lets you toggle EPP codes easily in the dashboard.
• Know the difference between “client” and “server” codes. You can remove client codes; server codes require registry intervention. If you see a server code you didn’t expect, contact support immediately.

Real‑World Troubleshooting Scenarios

Scenario A: You’re trying to transfer your domain to a cheaper registrar. The WHOIS shows clientTransferProhibited. Solution: Log into your current registrar, find the domain lock setting, and disable it. The code will change to ok (normal). Then initiate the transfer.

Scenario B: Your website suddenly stops loading. WHOIS shows serverHold. You check your emails and find an unread notice from your registrar: “Your domain expired 3 days ago.” Solution: Renew immediately (you’re still in the grace period). The serverHold will be removed within 24 hours.

Scenario C: You inherited a domain from a defunct company. WHOIS shows serverTransferProhibited and pendingDelete. This means the domain was either stolen or ordered deleted by a court. You’ll need to contact the registry or your legal team.

Conclusion

Domain status codes may look like cryptic tech jargon, but they’re actually your first line of defense—and your early warning system. By regularly checking your domain’s EPP codes (a WHOIS Lookup takes 10 seconds), you can prevent unwanted transfers, catch expirations early, and keep your online presence running smoothly.

Bookmark this guide, check your domains today, and never let a hidden code catch you off guard.