Domain Lifecycle and Transfer Cheat Sheet: Grace Periods, Redemption, Locks, EPP Codes, Status Codes and Disputes

Domains follow a lifecycle set partly by ICANN policy, partly by the registry that runs each extension and partly by your registrar’s own terms. This sheet puts the stages, status codes, transfer rules and dispute routes in one place, so you can tell from an RDAP lookup how much time you have and who can help.

Read this first: the rules below describe generic top level domains (gTLDs) such as .com, .net, .org and the newer extensions, which follow ICANN consensus policies. Country code domains (.uk, .ca, .au, .de and so on) follow their own registry’s rules. Even within gTLDs, grace periods and fees after expiry vary by registry and registrar, so treat every number marked “typical” as a starting point and check your registrar’s terms. The lock lengths below are the current rules. ICANN has adopted changes to its Transfer Policy, including shorter locks, that registrars will apply from a future date, so check your registrar’s current terms before relying on lock lengths.

Look it up first

Task	Command or tool	What to read
Registrar, dates, status, nameservers	Our domain lookup tool, or curl -sL https://rdap.org/domain/example.com	The registrar entity, the events (registration, expiration, last changed, transfer) and the status list
Legacy WHOIS	whois example.com (macOS and Linux)	Registrar:, Registry Expiry Date:, Domain Status: lines
Nameservers actually delegated	dig +short NS example.com	Should match what your DNS provider expects
DNSSEC at the registry	dig +short DS example.com	Any output means a DS record exists and must match the DNS host’s keys
Expired or not resolving	dig example.com	status: NXDOMAIN means the name is not in the zone (expired, on hold or never registered)

Run the commands on your own computer. -s hides curl’s progress meter and -L follows the redirect from rdap.org to the right registry. On Windows use curl.exe in PowerShell, and nslookup -type=NS example.com instead of dig. Registrant names and emails are usually redacted in RDAP and WHOIS for privacy.

The gTLD lifecycle at a glance

Stage	Typical length	Status you may see	Can the registrant get it back?	Set by
Registered, active	1 to 10 years	ok or active, often clientTransferProhibited	It is theirs	Registration term
Add grace period	5 days after registration (typical)	addPeriod	Yes	Registry
Expiry date	Day 0	Unchanged at first; the registry often auto-renews and the registrar decides what happens next	Yes, renew at normal or slightly higher price	Registration term
Registrar grace (post-expiry renewal window)	0 to about 45 days, varies by registrar	autoRenewPeriod; the registrar may park the domain or show a renewal page	Yes, at the registrar’s renewal price. ICANN requires the original registrant to be able to renew for at least 8 consecutive days at some point after expiry	Registrar terms, within ICANN’s Expired Registration Recovery Policy
Redemption grace period	30 days after the registrar deletes the name (most gTLDs)	redemptionPeriod, then pendingRestore while being restored	Yes, but usually with a restore fee on top of renewal	Registry, required by ICANN for most gTLDs
Pending delete	5 days (typical)	pendingDelete	No	Registry
Available	After pending delete ends	Not found	Only by registering it again, if nobody else does first	Anyone

Registrars may auction or sell expired names during their own grace window, so the safe assumption is that you can lose the domain at any point after expiry. Reminders: ICANN’s Expired Registration Recovery Policy requires registrars to send at least two notices before expiry (roughly one month and one week ahead) and one within five days after expiry, and to interrupt DNS resolution at some point after expiry so the owner notices. The expired domain guide covers recovery step by step.

EPP status codes

Status codes come from the EPP standard (RFC 5731, with grace statuses from RFC 3915). RDAP writes them in plain words, for example client transfer prohibited. “Client” statuses are set by the registrar; “server” statuses are set by the registry and only the registry can remove them.

Status	Set by	Meaning	Normal?
ok	Registry	No restrictions, nothing pending	Yes
clientTransferProhibited	Registrar	Registrar lock: transfers are refused until it is removed in the registrar account	Yes, recommended
clientUpdateProhibited	Registrar	Contact and nameserver changes blocked	Yes, if you asked for it
clientDeleteProhibited	Registrar	Deletion blocked	Yes
clientRenewProhibited	Registrar	Renewal blocked, often during a dispute or non-payment	Ask the registrar
clientHold	Registrar	Domain removed from DNS: site and email stop. Often unpaid, unverified contact details or abuse	No. Contact the registrar
serverTransferProhibited	Registry	Registry level transfer block: registry lock, a dispute, or a recent change	Yes with registry lock, otherwise ask
serverUpdateProhibited, serverDeleteProhibited	Registry	Registry level change or delete block, usually registry lock or a legal hold	Yes with registry lock
serverHold	Registry	Removed from DNS by the registry: legal order, dispute or policy violation	No. Registrar must explain
inactive	Registry	No nameservers delegated, so it does not resolve	No, add nameservers
pendingTransfer	Registry	A transfer to another registrar is in progress	Only if you started it. If not, contact your registrar now
pendingDelete	Registry	Scheduled for deletion; no longer recoverable	No
redemptionPeriod	Registry	Deleted but restorable for a fee	No, act now
pendingRestore	Registry	Restore requested from redemption	Temporary
addPeriod, renewPeriod, autoRenewPeriod, transferPeriod	Registry	Grace windows after a create, renew, auto-renew or transfer, mainly about refunds between registrar and registry	Yes

Transfer rules (ICANN Transfer Policy, gTLDs)

Rule	Current policy	Notes
Who can transfer	The registrant (registered name holder)	Not the account holder, reseller or designer unless they are the registrant
Auth code (EPP code, transfer code)	Registrar must provide it, or let you generate it, within 5 calendar days of the registrant’s request	Codes are case sensitive; copy and paste
Payment disputes	Registrar must not refuse the code or unlock solely because of a payment dispute with the registrant	Applies to the registrar, not to a designer or reseller you owe money
After initial registration	Registrar may deny a transfer within 60 days	ICANN has adopted a shorter lock that registrars will apply from a future date; check your registrar’s current terms
After a previous transfer	Registrar may deny a transfer within 60 days	ICANN has adopted a shorter lock that registrars will apply from a future date; check your registrar’s current terms
Change of registrant	A material change to name, organization or email triggers a 60 day transfer lock unless you opted out first, where the registrar offers that	ICANN has adopted changes to this lock that registrars will apply from a future date; check your registrar’s current terms. Until then, transfer first, update contacts after
Pending window	Up to 5 days for the losing registrar to act, then the registry completes the transfer	Approving the losing registrar’s email often completes it sooner
Registration period	A gTLD transfer normally adds one year to the expiry date	Some registries and promotions differ
Registrar must deny	A pending UDRP, URS or TDRP proceeding it has been told about, a court order, or a change of registrant lock the registrant did not opt out of	Registrars may also deny for evidence of fraud, a dispute over who the registrant is, non-payment, or an express objection from the registrant. Registries refuse transfers during redemption and pending delete

Moving between accounts at the same registrar (an account push or internal transfer) is not an inter-registrar transfer and usually avoids the locks. The domain transfer guide covers DNS and DNSSEC during a move.

Locks compared

Lock	What it blocks	Who removes it	Use it for
Registrar lock (clientTransferProhibited)	Transfers	Anyone logged in to the registrar account	Every domain
Registry lock (server*Prohibited)	Transfers, updates and deletion	The registry, after manual out of band verification with named contacts	Domains the business cannot live without. Usually extra cost and not offered for every extension; ask your registrar
60 day policy locks	Transfers after registration, a transfer or a registrant change	Time (some registrars lift early on request)	Not optional; plan around them
Two-factor on the account	Logins with a stolen password	You	Every registrar account

Dispute and escalation routes

Route	For	Who files	Outcome	Time limit or notes
Registrar abuse or security team	Hijack, account takeover, unauthorized change	You	Freeze, restore, or ask the other registrar to reverse a transfer	Fastest. Act the same day
TDRP (Transfer Dispute Resolution Policy)	A transfer that broke the Transfer Policy	A registrar only; ask yours to file	Transfer reversed or upheld	Within 12 months of the alleged violation, with an ICANN approved provider
ICANN Contractual Compliance	A registrar not meeting its obligations (no auth code, no response, renewal reminder failures)	Anyone, by online form	ICANN requires the registrar to comply	ICANN does not decide ownership
UDRP (Uniform Domain Name Dispute Resolution Policy)	A domain registered and used in bad faith against your trademark	Trademark holder, with a provider such as WIPO	Transfer or cancellation	Must prove all three: confusingly similar to your mark, no legitimate interest, bad faith. Fees apply
URS (Uniform Rapid Suspension)	Clear-cut trademark abuse in the newer gTLDs	Trademark holder	Suspension only, not transfer	Faster and cheaper than UDRP but narrower. Applies to the newer gTLDs and some older ones by contract, not .com; check the policy for your extension
Country code dispute schemes	ccTLD disputes, for example Nominet DRS (.uk), CIRA CDRP (.ca), auDRP (.au)	Varies	Varies	Each registry sets its own rules
Courts and police	Theft, fraud, extortion, contract disputes	You, usually with a lawyer	Binding orders	Not legal advice; varies by country, so ask a lawyer licensed where you operate

Scenario quick picks

You see	Do this	Guide
Site and email down, RDAP shows redemptionPeriod	Restore through your registrar now; expect a restore fee	Expired domain
clientHold soon after a contact change	Look for the registrar’s verification email; complete it from inside the registrar account	Scary website emails
pendingTransfer you did not start	Contact your registrar immediately and reject the transfer	Domain hijacked
Registrar changed, you did not move it	Losing registrar abuse team, then ask them to file TDRP	Domain hijacked
Domain is in a former designer’s account	Prove you are the registrant, ask for an account push or the auth code	Former designer has my domain
Transfer refused, “within 60 days”	Wait it out, or ask the registrar whether it can lift the lock early	Transfer a domain
Renewal letter from a company you do not know	Ignore it; renew only at your real registrar	Scary website emails

Gotchas

• Registrant email on the same domain. If the domain breaks, you cannot receive the emails that would fix it. Use an address elsewhere.
• Updating contacts before a transfer. Under the current policy this can start a 60 day lock. Transfer first.
• DNS hosted at the old registrar. A transfer can drop the zone. Copy every record before you start.
• DNSSEC. Changing DNS host with an old DS record still at the registry breaks resolution for validating resolvers.
• Auto-renew on an expired card. The most common cause of accidental expiry. Check the payment method yearly.
• Privacy service as registrant. Some privacy or proxy services are technically the registrant. Know how your registrar handles transfers and disputes for privacy protected names.