clientUpdateProhibited status

What clientUpdateProhibited means

clientUpdateProhibited tells the registry to reject requests to update the domain, except a request to remove this status itself. Blocked updates include changing the name servers, the contacts held by the registry, DNSSEC (DS) records and other statuses. In RDAP it appears as client update prohibited.

The status is set by the sponsoring registrar and is often part of its "domain lock" feature, together with clientTransferProhibited and clientDeleteProhibited. It stops the domain from being quietly pointed at different name servers, a common step in domain hijacking.

It does not stop the domain from working. The domain keeps resolving with its current name servers, and the DNS records you manage at your DNS provider (A, CNAME, MX, TXT and so on) can still be edited there, because those records are not stored at the registry.

Official definition: ICANN, EPP Status Codes: What Do They Mean, and Why Should I Know? (clientUpdateProhibited)

Why a domain has this status

• The registrar applies it by default, or the registrant turned on domain lock for extra security.
• The domain is involved in a dispute. During a UDRP proceeding, for example, the registrar must lock the domain so that its registrant and registrar cannot be changed.
• The registrar is holding the domain in place while an account or verification issue is being resolved.

What you should do

• If you don't need to change anything, leave it on. It is a protective status.
• To change name servers or DNSSEC records, turn off the domain lock in your registrar account first (some registrars do this for you when you save the change), make the change, then turn the lock back on.
• If you only need to edit DNS records such as A, CNAME or MX, you don't have to remove the lock: edit them at your DNS hosting provider.
• If you can't remove the lock yourself, contact your registrar. They may keep it in place during a dispute or until an issue with the account is resolved.

Check a domain's status

Look up any domain to see its current status codes, registrar, expiration date and name servers from the registry's RDAP or WHOIS service.

Related status codes

• serverUpdateProhibited: The registry has locked the domain against changes such as new name servers or contacts; only the registry can lift the lock.
• clientTransferProhibited: The registrar has locked the domain against transfers to another registrar, the standard protection against domain hijacking.
• clientDeleteProhibited: The registrar has locked the domain against deletion, protecting it from being deleted by mistake or by an attacker.
• pendingUpdate: A request to update the domain, such as a contact or name server change, has been received and is waiting to be completed.

Frequently asked questions

Can I change DNS records while clientUpdateProhibited is set?

Yes. DNS records such as A, MX and TXT live on your name servers, not at the registry, so you can edit them as usual. The lock only blocks registry-level changes such as switching name servers or updating DNSSEC keys.

Why can't I change my domain's name servers?

If the domain has clientUpdateProhibited, the registry rejects name server changes until the registrar removes the lock. Turn off domain lock at your registrar, save the new name servers, then turn the lock back on. If serverUpdateProhibited is set, the registry itself has to lift its lock first.

Further reading

• What is RDAP? How registries publish status codes and other registration data
• RDAP vs WHOIS: why the same status has two names
• How to find a domain owner