What does the clientHold domain status mean?

The registrar has told the registry to keep the domain out of the DNS. The registration still exists and still belongs to its holder, but the TLD's servers stop delegating it, so the website and email stop working. Registrars set it for unpaid renewals, an unverified registrant email, abuse complaints or legal orders; only the registrar can remove it.

Can a domain in pendingDelete be recovered?

For gTLDs like .com, no. pendingDelete is the final five days before the registry deletes the name, and neither the owner nor the registrar can restore it. The last chance was the redemption period before it. After deletion, the name can be registered again by whoever gets it first.

How long after expiry is a .com domain deleted?

It depends on the registrar. The registry allows an auto-renew grace period of up to 45 days, followed by a 30-day redemption period and 5 days of pendingDelete, so rarely more than about 80 days. A registrar can delete earlier, which starts redemption sooner. Country-code TLDs follow their own rules.

Is clientTransferProhibited a problem?

No. It's the normal registrar lock that stops the domain being transferred away without your approval, and most domains carry it. The domain resolves normally. You only need to remove it, in the registrar's panel, when you want to transfer the domain yourself.

clientHold, pendingDelete and Domain Expiry: What Each Means

What clientHold means

clientHold is an EPP status code set by the registrar. It tells the registry not to publish the domain in the DNS. The registration still exists and still belongs to its holder, but the TLD’s nameservers stop pointing at the domain’s nameservers. To the rest of the internet, the domain vanishes: lookups return NXDOMAIN, the website goes down, and mail to it fails.

ICANN’s own description of the status calls it uncommon and links it to legal disputes, non-payment, and domains headed for deletion. In practice the triggers are:

Unpaid renewal. Some registrars put expired domains on hold instead of, or before, pointing them at a parking page.
Unverified registrant contact. Under ICANN’s registrar agreement, when a gTLD domain is registered or the registrant’s contact details change, the registrar has to verify the email address. If nobody clicks the verification link within 15 days, the registrar suspends the domain, often with clientHold. This one catches people who registered with an address they don’t read.
Abuse or a policy complaint. Phishing, malware or spam reports, or a chargeback on the payment.
A legal order.

Only the registrar can remove clientHold. The fix is in its control panel or with its support team, never in your DNS settings: you can edit records all day and none of it will be visible until the domain is delegated again.

serverHold looks the same from outside but is set by the registry. Typical reasons are registry-level policy enforcement, an abuse or legal action at registry level, or a dispute between the registry and the registrar. You still go through your registrar; it is the one with a relationship with the registry.

Check the status and whether the domain is delegated

The RDAP lookup shows the status codes, expiry date and nameservers. RDAP writes status codes in lowercase with spaces (client hold, pending delete), WHOIS uses the EPP form (clientHold https://icann.org/epp#clientHold). They’re the same codes; the RDAP vs WHOIS guide explains the difference between the two formats.

To see whether the domain is actually delegated, ask the TLD’s own servers. For .com:

dig +norec @a.gtld-servers.net example.com NS

A delegated domain gets a referral, with its nameservers in the AUTHORITY section:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, ...
;; AUTHORITY SECTION:
example.com.        172800  IN  NS  ns1.dnshost.example.
example.com.        172800  IN  NS  ns2.dnshost.example.

A domain on hold, in redemption, or deleted isn’t in the zone:

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, ...

For another TLD, find its servers with dig +short NS org. (or whichever TLD) and query one of them the same way. A DNS lookup shows the result from the public-resolver side.

The status codes you’ll actually see

Status (EPP)	Set by	What it means for the owner
`ok` (RDAP: `active`)	—	No restrictions. Normal.
`clientTransferProhibited`	Registrar	Normal transfer lock. Domain works. Unlock it in the registrar’s panel only when you transfer.
`clientUpdateProhibited`, `clientDeleteProhibited`	Registrar	Locks against changes or deletion. Normal on many domains.
`serverTransferProhibited` and other `server…Prohibited`	Registry	Registry-level lock. Often a paid “registry lock” for high-value names, or set during a dispute. Domain works.
`addPeriod`	Registry	The first days after registration, during which the registrar can cancel for a refund. Domain works.
`autoRenewPeriod`	Registry	The domain expired and the registry auto-renewed it; the registrar can still delete it. Domain may or may not work, depending on the registrar.
`clientHold`	Registrar	Removed from the DNS. Domain doesn’t resolve. Contact the registrar.
`serverHold`	Registry	Removed from the DNS by the registry. Domain doesn’t resolve. Contact the registrar.
`redemptionPeriod`	Registry	Deleted by the registrar, recoverable for a limited time for a restore fee. Domain doesn’t resolve.
`pendingRestore`	Registry	A restore was requested during redemption and is being processed.
`pendingDelete`	Registry	Final days before deletion. Not recoverable for gTLDs.
`pendingTransfer`	Registry	A transfer to another registrar is in progress.
`inactive`	Registry	No nameservers are set, so nothing resolves. Add nameservers at the registrar.

Locks (…Prohibited) are good. Holds and the expiry statuses are the ones that take a site down.

The expiry timeline for gTLDs

For .com, .net, .org and most other generic TLDs, a domain that isn’t renewed goes through the same stages. The exact days depend on the registry and the registrar, so treat this as the shape, and check your registrar’s terms for its numbers.

Before expiry. ICANN requires registrars to send renewal reminders before the expiry date. They go to the registrant email, which is why an outdated address is the root of so many lost domains. Auto-renew fails quietly when the card on file has expired.

Expiry and the auto-renew grace period (up to 45 days at most registries). On the expiry date, many registries automatically renew the domain and bill the registrar, and the RDAP expiry date jumps a year ahead. That does not mean you renewed. The registrar now decides: it can keep the domain for you until you pay, or delete it within the grace period and get its money back. During this window the registrar usually makes the domain stop working so you notice, by switching the nameservers to a parking page or setting clientHold. Renewing now normally costs the regular renewal price. Some registrars also auction expired domains during this period.

Redemption grace period (30 days, redemptionPeriod). Once the registrar deletes the domain, the registry holds it for 30 days. It’s out of the zone, so nothing resolves. The registrant can still get it back, only through the same registrar, by paying a restore fee that is usually many times the normal renewal price, plus the renewal.

pendingDelete (5 days). After redemption, the domain sits in pendingDelete for five days. Nobody can restore it, not you, not the registrar, not the registry on request.

Release. The registry deletes the name and it becomes available to anyone. Popular names are caught within moments of release by drop-catching services.

Whatever the exact numbers, the practical lesson is simple: the cheaper and easier recovery is early in the timeline. Every stage costs more and has fewer options than the one before.

What to do, by stage

Expiry is approaching. Log in to the registrar, confirm auto-renew is on, the payment method is valid, and the registrant email is one you read. Renew for more than one year if the domain matters. Put the expiry date in a calendar that isn’t tied to that email address.

Expired, in grace (autoRenewPeriod, or parked). Renew now at the registrar. Then check that the nameservers are back to your own. Some registrars restore them automatically, some don’t, and the parking nameservers stay in place.

clientHold. Read the registrar’s emails, including spam, for a verification or abuse notice. Click the verification link if that’s the cause; otherwise contact support and ask exactly why the hold was set and what lifts it. Once removed, the TLD zone usually picks the domain up within minutes to hours depending on the registry, but resolvers that cached the NXDOMAIN keep it until their negative cache expires.

serverHold. Contact the registrar and ask it to find out the reason from the registry. If the cause is an abuse report, have your evidence ready: a cleaned site, logs, the compromised account fixed.

redemptionPeriod. Ask the registrar for a restore immediately and pay the fee. Don’t wait for a better price; there isn’t one, and the window is fixed.

pendingDelete. It’s gone for this cycle. Your only option is to try to register it again when it’s released, alongside everyone else, typically through a backorder service.

What breaks when a domain lapses

It’s more than the website.

Email. MX lookups fail. Senders’ mail servers retry for a while, often several days, then bounce. Mail sent during a hold that outlasts the retry window is lost.
Certificates. Existing TLS certificates stay valid until their own expiry, but renewal fails because the CA can’t validate the domain. If the outage outlasts your certificate, the site comes back with a certificate error.
Everything that trusts the domain. If the domain is deleted and someone else registers it, they receive mail for your addresses, including password resets for every account registered with them, and they can get certificates for your names. A lapsed domain is a security problem, not just an outage.

After recovery, check all of them: the nameservers, A/AAAA and MX records with a DNS lookup, the certificate with the SSL check, and email authentication with the email check.

Country-code TLDs follow their own rules

Everything above describes gTLDs under ICANN contracts. ccTLDs such as .kr, .uk, .de or .jp set their own policies. Some suspend a domain for a while after expiry and then cancel it; some have no redemption period, or a differently named one; some don’t use EPP status codes in public lookups at all. For .kr, DechoNet’s lookup comes from KISA’s WHOIS service and shows the status strings that service returns. Check the registry’s or your registrar’s published policy for the actual stages and dates.

If it’s someone else’s domain

You’re waiting for a name to drop, or checking whether a domain you rely on is in trouble.

redemptionPeriod or pendingDelete on someone else’s domain means it’s out of service now. pendingDelete means it will be released when the five days end. RDAP doesn’t always say when the status was set, so if timing matters, record the day you first saw it.
You can’t register it before release, and nobody can sell you a guarantee. Backorder services try to register it the instant it drops; for popular names several compete.
autoRenewPeriod on someone else’s domain doesn’t mean it will drop. The owner can still renew, and some registrars sell expired names during this period, so many never reach pendingDelete.
If a partner’s or supplier’s domain is on hold, tell them. They may not have noticed, especially if the registrar’s emails were going to the domain that just stopped working.

RDAP vs WHOIS: where these status codes come from and how to query them.
Nameserver mismatch: when the domain is delegated, but not to where you think.
SSL certificate expired: the other expiry that takes sites down.

Check your own domain now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.