Domain expiry and registrar lock: what the status codes mean and what you can still do

Two kinds of status

Many domains publish status codes in their public registration record, though which codes appear, and whether the public record shows them at all, depends on the domain ending and its registry, so check what yours shows. Some codes describe protections, and some describe where the domain is in its life. ICANN publishes what the common ones mean. Knowing which kind you are looking at tells you whether you can change it yourself and how quickly you must act.

The protection locks

clientTransferProhibited tells the registry to refuse any request to move the domain to another registrar. clientDeleteProhibited and clientUpdateProhibited do the same for deletion and for changes. ICANN describes all three as set through the registrar. Some registrars apply them automatically and others only on request, and to move, delete or change the domain you first ask your registrar to lift the lock. They are a defence against a hijack or a fraudulent request, and a lock that is off when it should be on, or on when you are trying to move the domain, is worth a note.

serverTransferProhibited is a registry-level lock, uncommon, and usually appears during legal disputes or redemption. Lifting it is slower because the registrar has to go through the registry.

• A locked domain is not broken; it is waiting for you to ask your registrar to unlock it.
• Check the lock before planning a registrar move, not on the day.

What happens when a renewal is missed

autoRenewPeriod is a grace window after a term ends, during which the registry renews the domain automatically; ICANN calls it informational, and says that if you do not want the renewal you should contact your registrar straight away. redemptionPeriod means the registrar has asked the registry to delete the domain. It is held for 30 days, and about five calendar days after that it is purged and can be registered by anyone. To keep it you contact the registrar immediately, resolve the underlying problem and pay the restore fee. pendingDelete follows if the redemption period passes without a restore.

These stages are registry-side. You do not set them, and you cannot shorten them, which is why catching a lapse before it starts is so much cheaper than reversing it afterwards.

• A domain in redemption has a fixed clock; the registrar is your only route.
• A website and email can stop long before the domain is fully deleted.

What you can and cannot see from outside

Depending on the domain ending and its registry, a public registration lookup may show the expiry date and some or all of the status codes, so check what yours shows. It does not show whether auto-renew is switched on, which card is on file or which email address receives the reminders, because those live inside your registrar account. A reminder sent to an address nobody reads is no warning at all. So a sensible routine combines two things: look at the public record on a schedule, and confirm the account settings yourself each quarter.

• Calendar reminders at 60, 30 and 14 days before expiry.
• A contact address at the registrar that more than one person can read.
• Auto-renew on, with a payment method that does not expire before the renewal.

Where the paid outcome fits

The standing responsibility for this, a published test price of £95 a month that has not been tested with buyers, checks the public record and the certificate against an agreed baseline on a schedule written down in the terms, asks you each quarter to confirm renewal and lock settings, and reports when a check finds the domain within 60 days of its expiry date or the certificate within 14 days of expiring. It publishes no response time and is not a live alarm. It never renews a domain, holds the registrar login or sees your account settings. It does not fit a domain whose ownership is disputed, or one that has already expired, which is a registrar matter first.