clienttransferprohibited Status Codes, Decoded

If you have looked up a domain and seen **clientTransferProhibited**, the short answer is simple: it means the domain is locked against transfer to another registrar. In most cases, that is normal and deliberate. It is usually a registrar-applied safeguard to reduce the risk of unauthorised transfers, not a sign that the name, website or DNS is malfunctioning.

This status often worries people because the wording sounds severe. In practice, it is one of the most common domain status codes you will see. The key is to separate transfer restrictions from wider domain health. A transfer lock affects registrar moves. It does not, by itself, mean the domain has expired, the website is down, or email has stopped. To understand the reason in a specific case, check the registrar account notices and the domain’s RDAP record. Since 28 January 2025, RDAP has been the definitive source for gTLD registration data, after WHOIS port 43 obligations for gTLD registries and registrars ended.

What clienttransferprohibited means

**clientTransferProhibited** is a domain status code that tells you the domain cannot currently be transferred from its present registrar to another registrar. In plain English, the registrar has placed a transfer lock on the name.

The most important point is that this is usually a protective setting. Registrars commonly apply it by default to help prevent hijacking, accidental transfers, or unauthorised account activity. So when you see **clientTransferProhibited**, think of it as a security brake rather than a fault.

The term breaks down neatly:

• **client** means the status is set by the registrar
• **transfer prohibited** means outgoing transfer to another registrar is blocked for now

This does not usually prevent the domain owner from renewing the name, updating nameservers, changing DNS records, or using the domain for a website and email, assuming no other status is in play.

It also does not tell you, on its own, *why* the lock exists. It may be a standard domain lock, a temporary security measure, or a restriction tied to recent registration or transfer activity.

If you are checking a gTLD, RDAP is now the primary place to confirm the current status. Older WHOIS habits still linger, but for gTLD registration data, RDAP is the authoritative source.

clienttransferprohibited vs registry and server status codes

A useful way to read domain statuses is to ask a simple question: who set the restriction? With **clientTransferProhibited**, the answer is usually the registrar. With **server** statuses, the restriction sits at registry level.

That distinction matters because registrar-side settings are often easier to change. If the registrar has applied a routine transfer lock, the domain holder can often remove it in the control panel or by completing a support or security step. A registry-level restriction may require more than a simple account toggle.

In broad terms:

• **client** statuses are set by the registrar that manages the domain account
• **server** statuses are set at the registry level for the extension

For example, a client transfer prohibition often appears as part of ordinary anti-hijack protection. A server-side restriction may reflect a stronger registry control, a dispute process, or another higher-level hold that the registrar cannot simply override in the account interface.

This is why two transfer blocks can look similar but behave differently. A domain can appear locked in both cases, yet the route to resolution is not the same.

When reviewing a domain, do not rely on the wording alone. Check the full RDAP status list and any registrar messages together. That combination usually tells you whether you are dealing with a routine registrar lock or something more serious at registry level.

Why a domain shows clientTransferProhibited

There is no single universal reason a domain shows **clientTransferProhibited**. The status is common, and the explanation depends on the registrar’s settings, recent account activity, and the domain’s lifecycle stage.

Very often, it is simply routine protection. Many registrars place a transfer lock on domains by default. That helps guard against unauthorised moves to another registrar.

Other common reasons include:

• a standard anti-hijack lock in the account
• an account security setting, such as a registrar lock enabled by default
• a recent registration
• a recent transfer to the current registrar
• recent ownership or contact changes that trigger extra checks
• expiry-related controls
• a pending support, billing, or security review

Timing matters. A domain usually cannot be transferred to another registrar for **60 days** after registration or a registrar transfer. So if the name was newly registered or only recently moved, the status may simply reflect that normal restriction.

If the domain is expired, the picture can become more complicated. Many gTLD names move through an auto-renew grace period of up to **45 days**, then a **30-day** redemption period, then **5 days** of pending delete. During those stages, transfer options may be limited or unavailable.

Avoid guessing from the status alone. Check the registrar’s notices and the RDAP record before drawing conclusions.

Does clienttransferprohibited stop a website or email from working?

Usually, no. **clientTransferProhibited** does **not** by itself stop a website or email from working. It is a transfer restriction, not a hosting or DNS shutdown command.

That distinction is important because many users see the word “prohibited” and assume the whole domain has been disabled. In most cases, that is not what this status means. A domain can remain fully active while still being locked against transfer to another registrar.

On its own, this status does not normally suspend:

• DNS resolution
• nameserver delegation
• website hosting
• web content delivery
• email routing or delivery

So if a site is down or email has stopped, the cause is usually elsewhere. Common culprits include expired hosting, broken DNS records, nameserver changes, email configuration errors, or a separate domain status that affects resolution or delegation.

That said, context matters. If the domain is expired, under review, or showing additional statuses, the wider service picture can change. A transfer lock may appear alongside other controls, but the lock itself is not the direct reason a website or mailbox has failed.

The sensible approach is to diagnose the service issue separately from the transfer issue. Check RDAP for domain statuses, then check DNS, hosting and mail settings in the registrar or provider account.

How to remove clienttransferprohibited

If you need to move a domain to another registrar, removing **clientTransferProhibited** is usually a practical account task rather than a technical repair. The exact steps vary by registrar, but the process is often straightforward.

Work through this order:

• Sign in to the registrar account that currently manages the domain
• Open the domain management page and look for a setting such as domain lock or transfer lock
• Check whether the lock can be turned off directly
• Confirm the domain is eligible for transfer
• Review whether the domain was registered or transferred within the last **60 days**
• Check for any pending identity, billing, or account security steps
• If needed, contact support and ask why the transfer lock is active
• Once eligible and unlocked, request the authorisation code if the registrar requires one for transfer out

Be careful not to assume every lock is optional. Some restrictions cannot be removed immediately, especially if the domain is inside the **60-day** no-transfer window after registration or a registrar transfer.

Also review the domain’s current stage if it has expired. In expiry and post-expiry periods, transfer options may narrow.

Finally, verify the status in RDAP after making changes. Since 28 January 2025, RDAP has been the definitive source for gTLD registration data, making it the best place to confirm whether the transfer lock has actually been lifted.

Why clienttransferprohibited can remain after you unlock the domain

If you see clienttransferprohibited in the record after switching off the transfer lock in your registrar account, that does not necessarily mean the unlock failed. In practice, domain transfers are controlled in layers. One layer is the registrar setting you can usually toggle yourself. Another is the wider transfer policy framework, and another can be the presence of other status codes that still block the move.

In simple terms, clienttransferprohibited means the registrar has marked the name so it cannot be transferred to another registrar at that moment. Removing that mark is only one part of the process. The change may take a little time to appear across systems, and the registry record may not update instantly.

There is also a common timing rule that catches many owners by surprise. A domain usually cannot be transferred to another registrar for 60 days after first registration or after a registrar transfer. So even if the client lock is removed correctly, the name may still be non-transferable until that period has passed.

You should also check for companion statuses. Some of them do not directly mention transfer, but still stop the practical steps needed to move a name.

• clientupdateprohibited may stop changes needed before transfer
• clienthold can take the name out of the zone entirely
• redemptionPeriod and pendingDelete mean the name is already in late expiry stages

The key point is this: unlocked does not always mean transferable today.

Other domain status codes you may see with clienttransferprohibited

Status codes are shorthand for what can and cannot be done with a domain at a given time. Seeing clienttransferprohibited alongside others is common, and each code points to a different kind of restriction or condition.

clientupdateprohibited usually means the registrar has blocked changes to the domain record. That may affect nameservers, contact details, or other settings. It is often a control setting rather than a sign of a dispute, but it can still interfere with transfer preparation.

clientdeleteprohibited means the domain cannot be deleted through ordinary registrar actions. For most owners, this is more protective than alarming. It tends to be used to prevent accidental loss.

clienthold is more serious in practical terms. It usually means the domain is not being published in the DNS zone, so the website and email may stop working. This often needs prompt attention.

redemptionPeriod means the domain has moved beyond ordinary expiry handling and into a recovery stage. At that point, options are narrower and usually more urgent.

pendingDelete is more final. It means the name is on its way out of the registry and cannot usually be renewed, updated, or transferred through normal channels.

ok is the healthiest-looking code. It generally means no special restrictions are active at registry level, beyond normal policy limits.

A simple way to read them is:

• ok: normal state
• clienttransferprohibited: cannot transfer out
• clientupdateprohibited: cannot edit
• clientdeleteprohibited: cannot delete
• clienthold: not resolving normally
• redemptionPeriod: expired and in recovery
• pendingDelete: nearing release

How to check status codes in RDAP after WHOIS changes

For gTLDs, RDAP is now the main place to verify domain status. ICANN's RDAP became the definitive source for gTLD registration data on 28 January 2025, when WHOIS port 43 obligations for gTLD registries and registrars ended. If you still rely on old WHOIS habits, it is worth updating your process.

RDAP matters because it presents structured registration data in a more consistent way. One of the most useful fields is the status list, where you can see codes such as clienttransferprohibited, clientupdateprohibited, redemptionPeriod, pendingDelete, or ok. These codes often tell you more about the domain's real state than the visible account settings at a registrar.

Status checks became even more important after privacy changes reshaped public data. Since GDPR took effect on 25 May 2018, much registrant personal data in WHOIS has often been redacted. That means ownership clues may be limited, but status codes usually remain visible and highly informative.

When checking RDAP, focus on a few essentials:

• the exact status codes shown
• the registrar named in the record
• creation, expiry, and last change dates
• whether the data appears to be registry or registrar supplied

If a registrar dashboard says unlocked but RDAP still shows clienttransferprohibited, give it a little time, then recheck. If the mismatch persists, ask the registrar which control is still active and whether a policy-based transfer bar applies.

clienttransferprohibited on expired domains

Expiry changes the picture quickly. A domain can show clienttransferprohibited at the same time as it moves through post-expiry stages, and those stages often matter more than the lock itself. Once a name has expired, transfer options may become limited, delayed, or unavailable depending on where it sits in the lifecycle.

For many gTLDs, the path is broadly familiar. After expiry, a name may enter an auto-renew grace period of up to 45 days. After that, it may move into a 30-day redemption period, followed by 5 days of pending delete. Not every name behaves identically in practice, but this sequence is a useful guide.

During the earlier post-expiry window, you may still be able to renew the domain with the current registrar. That is often the cleanest route before attempting any registrar change. If the name is already deep into expiry handling, removing clienttransferprohibited may no longer solve the real problem.

As the domain progresses, the available actions usually narrow:

• early after expiry: renewal may still be possible
• in redemptionPeriod: recovery may still be possible, but urgency rises
• in pendingDelete: normal recovery and transfer options are usually gone

So if an expired domain shows clienttransferprohibited, do not treat it as a routine unlock issue. Check the full status set and the expiry timeline. In many cases, the expiry stage, not the transfer lock, is what determines your next realistic move.

When to contact the registrar or get specialist help

Self-service works well for simple lock changes, but there are clear moments when it is sensible to escalate. The most common is where the account view and the public RDAP record do not match for longer than seems reasonable. If your dashboard says the domain is unlocked yet RDAP still shows clienttransferprohibited, ask the registrar to confirm which control remains in place.

You should also contact the registrar promptly if an unlock request fails, if you cannot access the account that controls the domain, or if the domain appears to carry a registry-level restriction rather than an ordinary registrar-set one. In those situations, standard checkboxes and account tools may not resolve the issue.

Take particular care if expiry is near or the name has already expired. Time matters more once a domain enters grace, redemption, or delete stages. A delay that feels minor at the start can become decisive later.

Useful cases for escalation include:

• disputed control of the registrar account
• inconsistent status information across systems
• repeated failed unlock or transfer preparation steps
• signs of a registry-level block
• an approaching expiry deadline

Keep your request focused. Ask what exact status is preventing action, whether a 60-day transfer bar applies, and what the next available step is. If the commercial stakes are sensitive, a confidential Westmore review can help clarify the position before options narrow.