Registration
Domain Status Codes and Locks Explained
Every registered domain carries status codes that say what the registry will and will not allow: transfers, changes, deletion and renewal. This guide explains what each code means, who sets it, and how much you can read into a lock that is, or is not, published.
The short answer
Status codes are switches on the registration. Codes that start with client are set by the registrar. Codes that start with server are set by the registry that runs the top-level domain. A TransferProhibited code blocks moving the domain to another registrar, UpdateProhibited blocks changes such as new name servers, and DeleteProhibited blocks deletion.
Registrar locks protect against mistakes and casual attacks. Registry locks are harder to remove, because the registry asks for extra verification before lifting them. Neither one is visible in full from the outside: the codes show what is published, not the whole security setup.
Reading the lock grid
Website Recon shows the transfer, update and delete locks as a grid. Each row is an operation, and the two columns show who set the lock: the registrar or the registry. A cell reads Locked with the code that set it, or Not published when no such code is in the registration record. Hover over a locked cell to see what that code blocks.
The codes come from the domain’s RDAP record, the structured successor to WHOIS described in WHOIS vs RDAP. RDAP writes the same statuses in spaced, lower-case form, for example client transfer prohibited, mapped to the EPP names in RFC 8056.
| Code | Set by | What it blocks |
|---|---|---|
| clientTransferProhibited | Registrar | Transfers to another registrar. The registrant can usually turn it off in their registrar account. |
| serverTransferProhibited | Registry | Transfers. Set for registry lock services, disputes or legal orders. |
| clientUpdateProhibited | Registrar | Changes to name servers, contacts and other registration data. |
| serverUpdateProhibited | Registry | Changes to registration data, including name servers and DS records. |
| clientDeleteProhibited | Registrar | Requests to delete the domain. |
| serverDeleteProhibited | Registry | Requests to delete the domain. |
| clientRenewProhibited, serverRenewProhibited | Registrar, registry | Renewal. Unusual; often a sign of a dispute or a planned deletion. |
The registry lock pattern
When a registry publishes all three server locks together (serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited), that is the usual sign of a registry lock service. With registry lock, a change to the domain needs the registrar to ask the registry to unlock it, and the registry confirms the request out of band, often with a phone call or a named contact, before anything moves. After the change, the locks go back on.
Website Recon notes this pattern when it sees it. It is a strong hint, not proof: registries also set server locks for disputes, court orders or their own policies, and a registry lock service may use codes that look the same as an ordinary server lock. For how registry lock fits into a wider defence against hijacking, see Domain Hijacking and Registry Lock.
What status codes cannot tell you
- A missing lock does not prove an operation is allowed. Some registries enforce locks without publishing a matching code, and some ccTLDs use their own rules instead of EPP statuses.
- Published codes do not show the full registry lock setup. Who may approve an unlock, and how, is agreed between the registrant, the registrar and the registry, and none of it appears in RDAP.
- Some registries publish a generic code. A status such as locked or transferProhibited without a client or server prefix does not say who set it or exactly what it blocks.
- Codes can lag. Registration data is a snapshot. A lock removed a minute ago may still show until the record is read again.
Treat published locks as evidence of protection, and missing locks as a question to ask the domain’s owner or registrar, not as a finding on their own.
Other statuses you may see
Besides locks, the registration record can describe where the domain is in its life. Website Recon lists these below the lock grid, each with a plain-language meaning. The most important ones are:
| Code | What it means |
|---|---|
| ok / active | No pending operations or prohibitions are published. |
| clientHold, serverHold | The domain is kept out of DNS, so it does not resolve. Set for unpaid renewals, failed contact checks, abuse or legal orders. |
| inactive | The registry has no name servers for the domain, so it does not resolve. |
| addPeriod | Newly registered and still inside the window in which the registration can be cancelled. |
| autoRenewPeriod | The registry renewed the domain at expiry, and the registrar can still reverse that renewal. |
| redemptionPeriod | The registrar deleted the domain. The registrant can still restore it through the registrar, usually for a fee. |
| pendingDelete | The domain is scheduled for deletion. Read it together with the other statuses: alongside redemptionPeriod or pendingRestore, the domain is still in redemption and can usually be restored. Only on its own does it mean the final stage, after which the name is purged and released. |
| pendingTransfer | A move to another registrar is in progress. |
The grace and deletion statuses are covered in more depth in Domain Expiration, Grace Periods and Deletion. ICANN’s EPP status codes page has the official description of every code.
Checking a domain
Scan the domain in Website Recon and open the Lifecycle and Restrictions section of the registration card. For your own domains, check that the transfer, update and delete locks you expect are published, and ask your registrar about registry lock if the domain is important enough that a hijack would be a serious incident.
FAQ
Is a domain with no transfer lock unsafe?
Not necessarily. It is easier to move, so the registrar account becomes the main protection. For important domains, turning on the registrar transfer lock costs nothing and removes an easy path for attackers.
Can I remove a server lock myself?
No. Server locks are set by the registry. You ask your registrar, and the registry follows its own verification process before lifting them.
Does serverHold mean the domain was taken down for abuse?
Sometimes, but not always. Registries also set it for legal orders, policy breaches or verification problems. It only tells you the registry is keeping the domain out of DNS.
Sources and further reading
- ICANN: EPP Status Codes, What Do They Mean, and Why Should I Know?: official meaning of every client and server status
- RFC 5731: EPP Domain Name Mapping: defines the core status values
- RFC 3915: Domain Registry Grace Period Mapping for EPP: grace, redemption and restore statuses
- RFC 8056: EPP and RDAP Status Mapping: how EPP statuses are spelled in RDAP