Understanding EPP Status Codes: Complete Reference (2025)

Quick Answer

Table of Contents

What Are EPP Status Codes?

EPP (Extensible Provisioning Protocol) status codes are standardized indicators that show a domain's current state and what actions are allowed or prohibited.

Understanding EPP

EPP is the protocol registrars use to communicate with domain registries. Every domain has one or more EPP status codes that control:

• Whether the domain can be transferred to another registrar
• Whether domain information can be updated
• Whether the domain can be deleted
• Whether the domain can be renewed
• Whether the domain resolves (shows a website)

Why EPP Status Codes Matter

EPP status codes serve critical functions:

1. Security: Prevent unauthorized domain transfers and modifications
2. Domain lifecycle management: Track domain states from registration to deletion
3. Troubleshooting: Diagnose why a domain isn't working or can't be transferred
4. Compliance: Enforce registry policies and legal requirements
5. Protection: Safeguard valuable domains from hijacking

EPP Status Code Categories

EPP codes fall into three main categories:

1. Client Status Codes (client*)

   • Set by your registrar at your request
   • Provide security and control
   • Can usually be removed by contacting your registrar

2. Server Status Codes (server*)

   • Set by the registry
   • Indicate registry-level restrictions or actions
   • Require registry involvement to resolve

3. Pending Status Codes (pending*)

   • Indicate temporary states during operations
   • Automatically resolve when the operation completes
   • Usually last 5-7 days

How to Check EPP Status Codes

You can check EPP status codes through several methods.

Method 1: WHOIS Lookup

whois example.com

Look for "Domain Status" or "Status" field:

Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

Method 2: RDAP Lookup

RDAP (Registration Data Access Protocol) provides more structured data:

curl -s https://rdap.org/domain/example.com | jq .status

Method 3: DomainDetails.com

The easiest method:

1. Visit DomainDetails.com
2. Enter your domain name
3. View EPP status codes in the results
4. See plain-English explanations for each code

Method 4: Registrar Control Panel

Most registrars show EPP status codes in your domain management dashboard:

• GoDaddy: Domain Settings → Additional Settings → Domain Status
• Namecheap: Domain List → Manage → Domain Status
• Google Domains: My Domains → [Domain] → Registration Settings

Understanding Status Code URLs

Each EPP status includes an ICANN URL:

clientTransferProhibited https://icann.org/epp#clientTransferProhibited

These URLs link to ICANN's official explanations at icann.org/epp.

Client Status Codes

Client status codes are set by your registrar at your request and provide security and control over your domain.

clientTransferProhibited

What it means:

• Prevents transfer to another registrar
• Most common security status
• Does not affect domain functionality

When it's used:

• Default setting at many registrars for security
• Protects against unauthorized transfers
• Recommended for valuable domains

How to resolve:

• Contact your current registrar
• Request removal of the status
• Usually removed within minutes to hours
• Required before initiating a transfer

Impact:

• ❌ Cannot transfer domain to another registrar
• ✅ Can update domain information
• ✅ Can renew domain
• ✅ Website and email work normally

Example scenario:

You want to transfer example.com from Registrar A to Registrar B.

Current status: clientTransferProhibited

Steps to transfer:
1. Log into Registrar A
2. Request removal of clientTransferProhibited
3. Wait for status update (usually instant)
4. Obtain authorization code
5. Initiate transfer at Registrar B

clientUpdateProhibited

What it means:

• Prevents changes to domain information
• Locks contact details, nameservers, and other settings
• Prevents accidental or unauthorized modifications

When it's used:

• Extra security for critical domains
• Corporate domain protection
• Preventing unauthorized changes

How to resolve:

• Contact your registrar
• Request temporary removal for updates
• Make necessary changes
• Re-enable status for security

Impact:

• ❌ Cannot change nameservers
• ❌ Cannot update contact information
• ❌ Cannot modify domain settings
• ✅ Can transfer domain (if not also transferProhibited)
• ✅ Can renew domain
• ✅ Website and email work normally

Example scenario:

You need to update nameservers for example.com.

Current status: clientUpdateProhibited

Steps:
1. Contact your registrar
2. Request removal of clientUpdateProhibited
3. Update nameservers immediately
4. Request registrar re-enable clientUpdateProhibited

clientDeleteProhibited

What it means:

• Prevents domain deletion
• Protects against accidental deletion
• Common default setting for security

When it's used:

• Automatic at most registrars
• Prevents accidental deletion
• Protects valuable domains

How to resolve:

• Contact your registrar
• Request removal (usually requires verification)
• Status removed to allow deletion
• Deletion is immediate after status removal

Impact:

• ❌ Cannot delete domain
• ✅ Can transfer domain
• ✅ Can update domain
• ✅ Can renew domain
• ✅ Website and email work normally

Warning: Be very careful when removing this status. Domain deletion is usually immediate and irreversible.

clientRenewProhibited

What it means:

• Prevents domain renewal
• Rare status, usually indicates an issue
• May be set during disputes

When it's used:

• Domains in legal disputes
• Domains being phased out
• Registry or registrar enforcement

How to resolve:

• Contact your registrar immediately
• Resolve any outstanding issues
• May require legal action for disputes

Impact:

• ❌ Cannot renew domain
• ⚠️ Domain will expire if not resolved
• ✅ Website works until expiration
• ✅ Can potentially transfer (if not also transferProhibited)

clientHold

What it means:

• Domain does not resolve (no website, no email)
• Set by registrar at your request or due to issues
• Stronger than just removing DNS records

When it's used:

• Parking domains without DNS configuration
• Preventing domain use during disputes
• Non-payment of registrar fees
• Abuse or policy violations

How to resolve:

• Contact your registrar
• Resolve any payment or policy issues
• Request removal of status
• Configure proper DNS settings

Impact:

• ❌ Website does not load
• ❌ Email does not work
• ❌ Domain does not resolve at all
• ✅ Can transfer (if not also transferProhibited)
• ✅ Can update (if not also updateProhibited)

Example scenario:

Your domain is on clientHold due to non-payment.

Symptoms:
- Website shows "This site can't be reached"
- Email bounces
- DNS queries return no results

Resolution:
1. Log into registrar account
2. Pay outstanding balance
3. Request removal of clientHold
4. Wait 1-4 hours for DNS propagation
5. Verify domain resolves

Server Status Codes

Server status codes are set by the registry (not your registrar) and indicate registry-level restrictions.

serverTransferProhibited

What it means:

• Registry prevents domain transfer
• Cannot be removed by registrar
• Usually indicates registry or legal issue

When it's used:

• Newly registered domains (transfer lock period)
• Domains in registry disputes
• Registry policy enforcement
• Security holds

How to resolve:

• Contact your registrar (they must contact the registry)
• May require waiting out transfer lock period (60 days)
• May require resolving legal or policy issues

Impact:

• ❌ Cannot transfer domain
• ✅ Can update domain (unless also updateProhibited)
• ✅ Can renew domain
• ✅ Website and email work normally

Common cause:

You just registered example.com today.

Status: serverTransferProhibited

Reason: Registry transfer lock (60 days)

Action: Wait 60 days from registration before transferring

serverUpdateProhibited

What it means:

• Registry prevents updates to domain information
• More serious than clientUpdateProhibited
• Indicates registry-level restriction

When it's used:

• Domains in legal disputes
• Trademark violations
• Registry policy enforcement
• Fraud investigations

How to resolve:

• Contact your registrar
• Registrar must work with registry
• May require legal resolution
• Can take weeks or months

Impact:

• ❌ Cannot change any domain settings
• ❌ Cannot update contact information
• ❌ Cannot change nameservers
• ✅ Website and email work (existing configuration)

serverDeleteProhibited

What it means:

• Registry prevents domain deletion
• Protects important domains
• Common for premium or reserved domains

When it's used:

• Registry-level protection
• Premium domains
• Domains in legal proceedings
• Registry policy enforcement

How to resolve:

• Usually cannot be removed
• Contact registry through your registrar
• May require special circumstances

Impact:

• ❌ Cannot delete domain
• ✅ Can transfer, update, and renew (unless other statuses prevent)

serverRenewProhibited

What it means:

• Registry prevents renewal
• Very serious status
• Domain may be scheduled for deletion

When it's used:

• Policy violations
• Trademark disputes
• Court orders
• Registry enforcement actions

How to resolve:

• Contact registrar immediately
• May require legal action
• May be irreversible

Impact:

• ❌ Domain will not renew
• ⚠️ Domain will expire and be deleted
• ⚠️ Act immediately to resolve

serverHold

What it means:

• Registry prevents domain from resolving
• More serious than clientHold
• Domain does not work at all

When it's used:

• Legal disputes
• Fraud investigations
• Court orders
• Registry policy violations
• Non-payment to registry

How to resolve:

• Contact your registrar immediately
• Registrar must work with registry
• May require legal resolution
• Can take days to weeks

Impact:

• ❌ Website does not load
• ❌ Email does not work
• ❌ Domain does not resolve
• ⚠️ Serious issue requiring immediate attention

Example scenario:

Your domain was flagged for suspected phishing.

Status: serverHold

Symptoms:
- Domain completely offline
- No DNS resolution
- Email offline

Resolution:
1. Contact registrar support immediately
2. Provide evidence domain is legitimate
3. Registrar contacts registry
4. Registry investigates
5. If resolved: status removed (3-14 days)
6. If not resolved: may lead to domain suspension

Pending Status Codes

Pending status codes indicate temporary states during domain operations. They usually resolve automatically within 5-7 days.

pendingTransfer

What it means:

• Domain transfer in progress
• Temporary state during transfer process
• Automatically resolves when transfer completes

When it's used:

• After initiating domain transfer
• During 5-day transfer authorization period
• Until transfer completes or is canceled

Timeline:

Day 0: Transfer initiated → pendingTransfer status added
Day 1-4: Waiting period
Day 5: Transfer auto-approves (if not rejected)
Day 5: pendingTransfer status removed

How to resolve:

• Wait for transfer to complete (5 days)
• OR: Approve transfer early at current registrar
• OR: Reject transfer to cancel

Impact:

• ⚠️ Domain works normally during transfer
• ❌ Cannot initiate another transfer
• ❌ Cannot make certain updates
• ✅ Website and email continue working

Example scenario:

You initiated transfer of example.com to new registrar.

Day 0:
- Status changes to pendingTransfer
- Transfer email sent to domain contact
- 5-day countdown begins

Day 1-4:
- Domain continues working normally
- Can approve or reject transfer
- Status remains pendingTransfer

Day 5:
- Transfer auto-completes (if not rejected)
- Status changes to ok at new registrar
- Domain now managed by new registrar

pendingUpdate

What it means:

• Domain update in progress
• Registry is processing changes
• Usually resolves within minutes to hours

When it's used:

• After updating domain information
• During registry processing
• Before changes take full effect

How to resolve:

• Wait for update to process (usually automatic)
• Typically resolves within 1-24 hours

Impact:

• ⚠️ Changes may not be fully visible yet
• ✅ Domain continues working
• ✅ Can still perform other operations

pendingDelete

What it means:

• Domain is scheduled for deletion
• In 5-day grace period
• Can still be restored

When it's used:

• After domain deletion request
• Domain expired and not renewed
• Part of domain lifecycle

How to resolve:

• Contact registrar to restore domain
• Pay restoration fee (if applicable)
• Act quickly (usually 5-day window)

Impact:

• ❌ Domain does not resolve
• ❌ Website offline
• ❌ Email offline
• ⚠️ Can still be restored (for ~5 days)

Timeline:

Day 0: pendingDelete status added
Day 1-4: Grace period (can restore)
Day 5: Domain deleted from registry
Day 5+: Domain enters redemption period (30 days)

pendingRenew

What it means:

• Domain renewal in progress
• Registry processing renewal
• Usually resolves automatically

When it's used:

• After initiating renewal
• During registry processing
• Before renewal confirmation

How to resolve:

• Wait for renewal to process
• Usually automatic within hours

Impact:

• ✅ Domain continues working
• ✅ Renewal will complete automatically

pendingCreate

What it means:

• Domain registration in progress
• Registry processing new registration
• Temporary state during initial registration

When it's used:

• Immediately after registering a new domain
• During registry processing
• Before registration finalizes

How to resolve:

• Wait for registration to complete
• Usually automatic within minutes to hours

Impact:

• ⚠️ Domain may not resolve yet
• ⚠️ DNS may not propagate until status resolves
• ✅ Registration will complete automatically

Special Status: OK

ok

What it means:

• Domain has no restrictions
• All operations allowed
• Normal, healthy state

When you'll see it:

• Newly registered domains (after initial processing)
• Domains with all protection statuses removed
• Domains without security locks

Impact:

• ✅ Can transfer domain
• ✅ Can update domain
• ✅ Can delete domain
• ✅ Can renew domain
• ✅ Website and email work normally

Important note: A domain with only "ok" status has no protection against unauthorized transfers. For security, most domains should have at least clientTransferProhibited or serverTransferProhibited in addition to ok.

Recommended configuration:

# Secure configuration
ok
clientTransferProhibited

# Even more secure
ok
clientTransferProhibited
clientUpdateProhibited
clientDeleteProhibited

# Minimal security (not recommended)
ok

EPP Status Code Reference Table

Common EPP Status Combinations

Real-world domains typically have multiple EPP status codes. Here are common combinations and what they mean.

Secure Default Configuration

ok
clientTransferProhibited
clientUpdateProhibited
clientDeleteProhibited

What this means:

• Domain is healthy and working
• Protected against unauthorized transfers
• Protected against unauthorized updates
• Protected against accidental deletion
• Maximum security for valuable domains

When you'll see it:

• Corporate domains
• High-value domains
• Brand protection
• Enterprise environments

Standard Security Configuration

ok
clientTransferProhibited

What this means:

• Domain is healthy and working
• Protected against unauthorized transfers
• Can still update settings easily
• Balanced security and convenience

When you'll see it:

• Most registrars' default setting
• Personal domains
• Small business domains

Minimal Protection (Risky)

ok

What this means:

• Domain has no restrictions
• Vulnerable to unauthorized transfer
• No protection against hijacking
• Easy to modify and delete

When you'll see it:

• Newly registered domains (temporarily)
• Domains with all locks removed
• Preparation for transfer

Warning: Not recommended for valuable domains.

Domain Transfer in Progress

ok
clientTransferProhibited (at losing registrar)
pendingTransfer

What this means:

• Transfer was successfully initiated
• Waiting for approval or 5-day auto-approval
• Domain still works normally

When you'll see it:

• During active domain transfer
• Days 0-5 of transfer process

Domain on Hold (Non-Payment)

clientHold
clientTransferProhibited

What this means:

• Domain does not resolve (offline)
• Cannot transfer to another registrar
• Usually due to non-payment

When you'll see it:

• Unpaid invoices
• Expired payment methods
• Account suspension

How to fix:

1. Log into registrar account
2. Pay outstanding balance
3. Contact support to remove clientHold
4. Wait for DNS propagation

Domain on Registry Hold (Serious)

serverHold
serverTransferProhibited
serverUpdateProhibited

What this means:

• Domain completely locked by registry
• Domain does not resolve
• Very serious issue
• Cannot transfer, update, or modify

When you'll see it:

• Legal disputes
• Trademark violations
• Fraud investigations
• Court orders

How to fix:

1. Contact registrar immediately
2. Provide requested documentation
3. Registrar escalates to registry
4. May require legal resolution
5. Can take weeks to resolve

Newly Registered Domain

ok
serverTransferProhibited

What this means:

• Domain successfully registered
• Transfer locked for 60 days (ICANN policy)
• Can update settings normally
• Cannot transfer yet

When you'll see it:

• First 60 days after registration
• First 60 days after transfer

Timeline:

Day 0: Domain registered
Day 0-59: serverTransferProhibited active
Day 60: serverTransferProhibited removed
Day 60+: Can transfer domain

Domain Being Deleted

pendingDelete

What this means:

• Domain scheduled for deletion
• 5-day grace period
• Can still be restored
• Domain does not resolve

When you'll see it:

• After requesting domain deletion
• After expiration without renewal
• Beginning of deletion process

How to restore:

1. Contact registrar within 5 days
2. Request domain restoration
3. Pay restoration fee (if applicable)
4. Domain restored to active status

Security-Related Status Codes

Understanding security status codes helps protect your domain from hijacking and unauthorized changes.

Registry Lock (Highest Security)

Some registries offer "Registry Lock" - an enhanced security service:

ok
clientTransferProhibited
clientUpdateProhibited
clientDeleteProhibited
serverTransferProhibited
serverUpdateProhibited
serverDeleteProhibited

What this provides:

• Maximum possible protection
• Requires registry approval for any changes
• Multi-step verification process
• Protection against sophisticated attacks

How to get it:

• Available for TLDs like .com, .net, .org
• Usually requires premium service
• Contact your registrar to enable
• Typically costs $100-$1,000/year

When you need it:

• High-value domains worth millions
• Critical infrastructure domains
• Brand protection for major corporations
• Domains targeted by sophisticated attackers

Change process with Registry Lock:

1. Request change through registrar
2. Registrar contacts registry
3. Registry contacts domain owner directly (phone/email)
4. Owner verifies change request
5. Registry approves change
6. Change implemented
7. Registry re-enables lock

Typical timeline: 1-3 business days

Transfer Lock Best Practices

For valuable domains:

1. Always enable clientTransferProhibited

   Default should be: ON
   Remove only when transferring
   Re-enable immediately after transfer
   

2. Use strong registrar account security

   • Enable two-factor authentication
   • Use strong, unique password
   • Set up account alerts
   • Monitor login activity

3. Keep contact information current

   • Ensure email is active
   • Monitor for transfer approval requests
   • Respond quickly to security alerts

4. Consider additional locks

   Valuable domains should have:
   - clientTransferProhibited ✅
   - clientUpdateProhibited ✅
   - clientDeleteProhibited ✅
   

5. Monitor EPP status regularly

   • Check monthly for unexpected changes
   • Use domain monitoring services
   • Set up change alerts

Domain Hijacking Prevention

EPP status codes are your first line of defense against domain hijacking:

Attack vector: Unauthorized transfer to attacker's registrar

Protection:

clientTransferProhibited ← Prevents this attack

Attack vector: Change DNS to attacker's servers

Protection:

clientUpdateProhibited ← Prevents this attack
Two-factor authentication ← Additional layer

Attack vector: Delete domain and re-register

Protection:

clientDeleteProhibited ← Prevents this attack

Multi-layer security approach:

1. EPP status locks (described above)
2. Registrar account security (2FA, strong password)
3. Email security (secure email account)
4. Domain monitoring (alerts for changes)
5. DNSSEC (prevents DNS spoofing)

Troubleshooting EPP Status Issues

Common problems and how to resolve them.

Problem 1: Cannot Transfer Domain

Symptoms:

• Transfer fails or is rejected
• Registrar says domain is locked
• Cannot obtain authorization code

Diagnosis:

Check for these status codes:

whois example.com | grep -i "status"

Look for:

• clientTransferProhibited
• serverTransferProhibited
• pendingTransfer

Solutions:

If clientTransferProhibited:

1. Log into current registrar
2. Navigate to domain settings
3. Disable transfer lock/protection
4. Wait for status update (usually instant)
5. Obtain authorization code
6. Initiate transfer at new registrar

If serverTransferProhibited:

Check registration/transfer date:
- If < 60 days ago: Wait until 60 days pass
- If > 60 days ago: Contact registrar for help

If pendingTransfer:

- Another transfer is in progress
- Wait for current transfer to complete (5 days)
- Or cancel current transfer first

Problem 2: Domain Not Resolving

Symptoms:

• Website shows "This site can't be reached"
• Email bounces
• DNS queries fail

Diagnosis:

Check for hold status:

whois example.com | grep -i "hold"

Look for:

• clientHold
• serverHold

Solutions:

If clientHold:

Common causes:
1. Non-payment: Pay outstanding balance
2. Parking: Configure DNS or remove hold
3. Dispute: Resolve issue with registrar

Steps:
1. Log into registrar account
2. Check for unpaid invoices
3. Pay any outstanding balance
4. Contact support to remove hold
5. Configure DNS settings
6. Wait 1-4 hours for propagation

If serverHold:

This is serious - contact registrar immediately

Possible causes:
- Legal dispute
- Trademark violation
- Fraud investigation
- Court order

Steps:
1. Contact registrar support ASAP
2. Ask for specific reason
3. Provide requested documentation
4. Work with registrar to resolve
5. May require legal assistance
6. Can take days to weeks

Problem 3: Cannot Update Domain Settings

Symptoms:

• Cannot change nameservers
• Cannot update contact info
• Settings save but don't apply

Diagnosis:

Check for update prohibit status:

whois example.com | grep -i "update"

Look for:

• clientUpdateProhibited
• serverUpdateProhibited
• pendingUpdate

Solutions:

If clientUpdateProhibited:

1. Log into registrar account
2. Navigate to domain settings
3. Disable update lock
4. Make necessary changes
5. Re-enable update lock for security

If serverUpdateProhibited:

1. Contact registrar support
2. Ask for reason for registry lock
3. Registrar must contact registry
4. May require documentation
5. Can take several days

If pendingUpdate:

1. Wait 24 hours for update to process
2. Check if changes applied
3. If still pending after 24h, contact support

Problem 4: Domain Expired and Can't Renew

Symptoms:

• Renewal option grayed out
• "Cannot renew domain" error
• Domain shows as expired

Diagnosis:

Check status:

whois example.com | grep -i "status\|expir"

Look for:

• clientRenewProhibited
• serverRenewProhibited
• pendingDelete
• redemptionPeriod

Solutions:

If pendingDelete (recent expiration):

Timeline:
- Day 0-5: Grace period (free renewal)
- Day 6-35: Redemption period ($100-200 fee)
- Day 36+: Domain deleted (gone forever)

Steps:
1. Contact registrar immediately
2. If in grace period: renew normally
3. If in redemption: pay restoration fee
4. Act fast - time is critical

If clientRenewProhibited:

1. Contact registrar
2. Resolve any disputes or issues
3. Request removal of status
4. Renew domain immediately

If serverRenewProhibited:

1. Contact registrar urgently
2. Registrar must work with registry
3. May indicate serious policy violation
4. May not be resolvable
5. Document all communications

Problem 5: Unexpected Status Changes

Symptoms:

• Status codes you didn't request
• Security locks mysteriously removed
• New restrictions appeared

Diagnosis:

Check registrar account:

1. Review account activity logs
2. Check email for notifications
3. Look for unauthorized access
4. Review recent registrar changes

Solutions:

If security locks removed:

⚠️ URGENT - Possible domain hijacking attempt

Immediate steps:
1. Change registrar password immediately
2. Enable 2FA if not already enabled
3. Re-enable all security locks
4. Contact registrar security team
5. Check for unauthorized transfers in progress
6. Monitor domain for changes
7. Review email for transfer requests

If new restrictions added:

Possible causes:
1. Registrar policy change
2. Registry enforcement
3. Legal/trademark issue
4. Automatic security enhancement

Steps:
1. Contact registrar for explanation
2. Review registrar emails/notifications
3. Address any policy violations
4. Request removal if inappropriate

How to Change EPP Status Codes

Removing Client Status Codes

Step 1: Access Domain Management

Log into your registrar's control panel and navigate to the domain.

Step 2: Locate Security Settings

Look for sections named:

• Domain Lock
• Transfer Lock
• Domain Security
• EPP Status Codes
• Registrar Lock

Step 3: Modify Status

Each registrar has different interfaces:

GoDaddy:

1. My Products → Domains
2. Click domain name
3. Additional Settings → Edit Domain Settings
4. Turn off "Domain Lock"
5. Confirm changes

Namecheap:

1. Domain List → Manage
2. Scroll to "Domain Lock"
3. Toggle lock off
4. Confirm with account password

Google Domains:

1. My Domains → [Domain]
2. Registration Settings
3. Toggle "Transfer lock" off
4. Confirm changes

Step 4: Verify Changes

# Wait 5-10 minutes, then check
whois example.com | grep -i "status"

# Should see status removed

Requesting Server Status Changes

You cannot change server status codes directly. You must work through your registrar.

Step 1: Contact Registrar

Create support ticket with:
- Domain name
- Current server status code
- Reason for removal request
- Documentation (if applicable)

Step 2: Registrar Contacts Registry

Your registrar submits request to registry:
- Verifies your identity
- Confirms request legitimacy
- Forwards to registry

Step 3: Registry Reviews

Registry reviews request:
- Checks for valid reason
- May require documentation
- May require legal clearance

Step 4: Resolution

If approved:
- Status removed
- Changes propagate
- Timeline: 1-14 days

If denied:
- Reason provided
- May need legal action
- May be permanent

Best Practices for Status Changes

1. Document why you're removing protections

   • Keep records of reasons
   • Note when protections were removed
   • Plan to re-enable ASAP

2. Make changes during business hours

   • Ensure support is available
   • Can quickly resolve issues
   • Faster verification

3. Have necessary information ready

   • Account password
   • Two-factor authentication
   • Authorization to make changes
   • Documentation for server status changes

4. Re-enable protections immediately

   Bad workflow:
   1. Remove clientTransferProhibited
   2. Transfer domain
   3. Forget to re-enable
   
   Good workflow:
   1. Remove clientTransferProhibited
   2. Initiate transfer
   3. Re-enable at new registrar immediately
   

5. Monitor for unexpected changes

   • Check status weekly during sensitive operations
   • Set up monitoring alerts
   • Review registrar emails promptly

Best Practices for EPP Status Management

Security Best Practices

1. Enable Transfer Protection

   All domains should have:
   ✅ clientTransferProhibited
   
   Valuable domains should add:
   ✅ clientUpdateProhibited
   ✅ clientDeleteProhibited
   

2. Use Two-Factor Authentication

   • Enable 2FA at registrar
   • Use authenticator app (not SMS)
   • Store backup codes securely

3. Keep Contact Information Current

   • Monitor domain contact email daily
   • Use dedicated email for domains
   • Set up email forwarding as backup

4. Regular Status Audits

   Monthly checklist:
   - Review all domain EPP statuses
   - Verify security locks are enabled
   - Check for unexpected changes
   - Update documentation
   

5. Consider Registry Lock for High-Value Domains

   • Domains worth $100K+
   • Critical business domains
   • Frequently targeted domains

Operational Best Practices

1. Plan Status Changes in Advance

   Before transfer:
   - Schedule transfer window
   - Lower DNS TTL 24h in advance
   - Remove transfer lock
   - Obtain auth code
   - Initiate transfer
   - Monitor for 5 days
   - Re-enable locks at new registrar
   

2. Document Your Domains

   Maintain spreadsheet with:
   - Domain name
   - Registrar
   - Expiration date
   - Current EPP status codes
   - Last status change date
   - Reason for current status
   

3. Set Up Monitoring

   • Use domain monitoring service
   • Set alerts for EPP status changes
   • Monitor WHOIS for changes
   • Track expiration dates

4. Understand Before Changing

   • Research what each status means
   • Know the implications
   • Have rollback plan
   • Don't remove all protections at once

Recovery Best Practices

1. Have Emergency Contacts

   Keep list of:
   - Registrar support phone/email
   - Registrar account manager
   - Registry contact info
   - Legal counsel (for serious issues)
   

2. Document Everything

   • Screenshot before changes
   • Save all email communications
   • Record support ticket numbers
   • Note dates and times

3. Know the Timelines

   Important deadlines:
   - Transfer: 5 days to approve/reject
   - Grace period: Usually 5 days
   - Redemption: 30 days
   - Pending delete: 5 days
   - 60-day transfer lock: Cannot bypass
   

4. Have Backup Plans

   • Know restoration costs
   • Have multiple payment methods on file
   • Keep backup of DNS settings
   • Document critical domain configurations

Frequently Asked Questions

What does clientTransferProhibited mean?

clientTransferProhibited means your domain is locked and cannot be transferred to another registrar. This is a security feature that prevents unauthorized transfers. To transfer your domain, contact your current registrar to temporarily remove this status, then re-enable it at your new registrar after the transfer completes.

How long does serverTransferProhibited last?

serverTransferProhibited typically lasts 60 days after domain registration or transfer (ICANN policy). After 60 days, this status is automatically removed. If your domain has had serverTransferProhibited for longer than 60 days, it may indicate a registry dispute or legal issue - contact your registrar.

Can I remove server status codes myself?

No, you cannot remove server status codes yourself. Server status codes are set by the registry (not your registrar) and require registry involvement to remove. Contact your registrar, who will submit a request to the registry on your behalf. Resolution can take 1-14 days depending on the reason for the status.

What's the difference between clientHold and serverHold?

clientHold is set by your registrar (often due to non-payment) and can be removed by contacting your registrar and resolving the issue. serverHold is set by the registry and indicates a more serious problem like legal disputes or fraud investigations. serverHold requires registry involvement and can take much longer to resolve.

Why does my newly registered domain have serverTransferProhibited?

ICANN requires all domains to have a 60-day transfer lock after registration or transfer. This prevents domain theft through quick successive transfers. This is normal and will automatically be removed after 60 days. You can still update settings and use the domain normally during this period.

How do I check my domain's EPP status?

Use a WHOIS lookup (whois example.com), check your registrar's control panel, or use DomainDetails.com for an easy-to-read view of all EPP status codes with plain-English explanations. EPP codes appear in the "Domain Status" field of WHOIS records.

What does "ok" status mean?

"ok" means your domain has no restrictions and all operations are allowed. While this seems positive, a domain with only "ok" status has no protection against unauthorized transfers. Most domains should have "ok" plus security statuses like clientTransferProhibited.

Can I transfer a domain with pendingTransfer status?

No, you cannot initiate a new transfer while a domain has pendingTransfer status. You must either wait for the current transfer to complete (5 days) or cancel the existing transfer first. Each domain can only have one transfer in progress at a time.

What should I do if my domain has serverHold?

Contact your registrar immediately. serverHold means the registry has suspended your domain due to serious issues like legal disputes, fraud, or policy violations. Your registrar must work with the registry to resolve this. Gather any requested documentation and be prepared for a potentially lengthy resolution process.

How long do pending status codes last?

Most pending statuses resolve automatically within hours to days: pendingCreate (minutes to hours), pendingUpdate (hours), pendingRenew (hours), pendingTransfer (5 days unless approved earlier), and pendingDelete (5 days before final deletion). If a pending status lasts longer than expected, contact your registrar.

Key Takeaways

• EPP status codes control what operations can be performed on your domain
• Client status codes are set by your registrar and can be removed by contacting them
• Server status codes are set by the registry and require registry involvement to resolve
• Pending status codes indicate temporary states and usually resolve automatically
• clientTransferProhibited is essential security - always enable it except during transfers
• serverTransferProhibited automatically applies for 60 days after registration or transfer
• Hold statuses (clientHold or serverHold) prevent your domain from resolving
• ok status alone provides no security - add transfer protection at minimum
• Regular monitoring of EPP status helps detect unauthorized changes early
• Understanding EPP codes enables quick troubleshooting of domain issues
• Documentation of your domain statuses helps manage your portfolio effectively
• Security-focused status combinations protect valuable domains from hijacking

Next Steps

Check Your Domain's EPP Status

1. Run a Domain Lookup

   • Visit DomainDetails.com
   • Enter your domain name
   • Review all EPP status codes
   • Understand what each code means

2. Verify Security Settings

   • Check if clientTransferProhibited is enabled
   • Review all current status codes
   • Compare against security best practices
   • Enable additional protection if needed

3. Document Your Configuration

   • Record current EPP status codes
   • Note when last changed
   • Document reason for current status
   • Set reminder to review quarterly

Improve Your Domain Security

1. Enable Registrar Locks

   • Log into your registrar
   • Enable transfer lock (clientTransferProhibited)
   • Consider enabling update lock for valuable domains
   • Enable delete lock to prevent accidents

2. Set Up Account Security

   • Enable two-factor authentication
   • Use strong, unique password
   • Set up login alerts
   • Review authorized users

3. Monitor Your Domains

   • Sign up for domain monitoring
   • Set alerts for status changes
   • Review WHOIS records monthly
   • Track expiration dates

Monitor Domain Status with DomainDetails Pro

Upgrade to DomainDetails Pro for automated EPP monitoring:

• Status change alerts - Get notified when EPP codes change
• Bulk status checking - Check EPP status for multiple domains
• Historical tracking - See EPP status history over time
• Expiration monitoring - Never miss a renewal
• Security recommendations - Get personalized security advice

Start Your Free Trial →

Related Articles

• Domain Lifecycle Stages: From Registration to Deletion
• How to Transfer a Domain Between Registrars
• Domain Security Best Practices
• What is WHOIS and How Does It Work?

Research Sources

1. ICANN - EPP Status Codes (icann.org/epp)
2. RFC 5731 - Extensible Provisioning Protocol (EPP) Domain Name Mapping
3. RFC 5730 - Extensible Provisioning Protocol (EPP)
4. ICANN - Transfer Policy Documentation
5. ICANN - Registrar Accreditation Agreement
6. Registry Operator Best Practices
7. Domain Name Association - Security Guidelines
8. PIR (Public Interest Registry) - EPP Status Code Documentation
9. Verisign - EPP Implementation Guide
10. IANA - EPP Registry