Your domain name is one of your organization's most important digital assets. It powers your website, email communications, and online identity. But what happens when your domain registrar places a restriction on that domain that prevents you from renewing it?
Most domain owners are familiar with domain locks that prevent unauthorized transfers. Far fewer know that registrars can also apply restrictions that prevent renewal requests. One such restriction is clientRenewProhibited. It is publicly visible through the Registration Data Access Protocol (RDAP), but its implications are not always obvious.
Can a registrar prevent you from renewing a domain for which you are the legitimate registrant? Under what circumstances can this happen, and what can you do to remove the restriction?
1. Who controls your domain registration? Understanding registrars, registries, and RDAP
When you register a domain name, you acquire contractual rights to use that domain for a specified period, subject to applicable policies and your registration agreement. You do not acquire unconditional ownership in the same sense as physical property.
The registrant is the individual or organization holding those registration rights. The registrar, such as GoDaddy or Namecheap, manages the registration on the registrant's behalf. The registry, such as Verisign for .com, maintains the authoritative registration database. Registrars communicate with registries using the Extensible Provisioning Protocol (EPP), which supports domain registrations, renewals, transfers, updates, and deletions. RDAP makes registration information publicly accessible, including the registrar, registration dates, and EPP status codes. Since January 2025, RDAP has been the definitive registration-data lookup protocol for generic top-level domains, replacing WHOIS.
These status codes reveal restrictions on what can be done with a domain. However, RDAP generally does not explain why a particular restriction was applied, and that distinction becomes particularly important when renewal is prohibited.
2. The four client...Prohibited status codes explained
Four EPP status codes deserve attention because they restrict operations that would otherwise be available to the sponsoring registrar.
| Status code | What it restricts |
|---|---|
clientTransferProhibited | Transferring the domain to another registrar |
clientDeleteProhibited | Deleting the domain registration |
clientUpdateProhibited | Updating the domain registration object |
clientRenewProhibited | Explicitly renewing the domain registration |
The word client indicates that the restriction originates on the registrar side of the EPP relationship. Corresponding server restrictions are controlled by the registry. The first three statuses provide recognizable security protections. They can help prevent unauthorized transfers, deletions, or configuration changes following registrar account compromise.
clientRenewProhibited, however, is different. It prevents a legitimate operation that a domain owner ordinarily wants to perform: extending the domain's registration period. This raises questions about when such a restriction is appropriate and how a domain owner can have it removed.
Reference: ICANN - EPP Status Codes
3. clientDeleteProhibited protects your domain
Imagine an attacker gaining unauthorized access to your domain registrar account. Without appropriate security controls, the attacker might attempt to transfer your domain to another registrar, modify its configuration, or delete the registration.
clientDeleteProhibited tells the registry to reject explicit deletion requests, helping prevent unauthorized or accidental deletion. Similarly, clientTransferProhibited protects against unauthorized transfers, while clientUpdateProhibited restricts modifications to the domain registration. These protections are particularly valuable for organizations whose domains support business-critical services. ICANN's Security and Stability Advisory Committee (SSAC) has recommended registrar and registry locks as safeguards against unauthorized domain changes.
However, these protections are not absolute. Registrar-controlled locks may be removed through the registrar's authorized management systems. Organizations requiring stronger protection can consider registry-level locks, which typically involve additional authorization procedures. One important limitation is that clientDeleteProhibited does not protect a domain from expiration. A deletion lock is not a substitute for successful renewal.
Reference: ICANN SSAC - A Registrant's Guide to Protecting Domain Name Registration Accounts
4. clientRenewProhibited deserves closer examination
Unlike the other restrictions, clientRenewProhibited does not have an immediately obvious domain-hijacking prevention benefit. According to ICANN, this is an uncommon status, usually applied when a domain is involved in a legal dispute or is subject to deletion. The technical effect is straightforward: the registry rejects explicit EPP renewal requests while the status is present. The sponsoring registrar must remove the restriction before a normal renewal command can succeed.
Why would a registrar prohibit renewal?
There are several possible explanations.
Legal and administrative restrictions. A registrar may restrict domain operations because of legal proceedings, compliance issues, or other administrative requirements. However, not every domain dispute requires a renewal prohibition. ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP), for example, specifies a dispute lock that does not interfere with renewal.
Registrar operational controls. Some registrars use renewal restrictions as part of their normal provisioning processes.
Domain lifecycle management. Renewal restrictions may also appear when a domain is subject to deletion or other lifecycle-related administrative actions.
The problem is that RDAP does not normally distinguish between these explanations. A domain owner examining the public record may see the same status whether the restriction is routine or associated with an unresolved issue. And unlike a transfer lock, a renewal restriction directly affects the registrant's ability to extend the registration through the ordinary renewal process.
Does renewal prohibition prevent automatic renewal?
Not necessarily, and this is an important technical distinction.
There are two separate renewal mechanisms.
Explicit renewal: The registrar submits an EPP renewal command to the registry, typically after a registrant purchases an additional registration period. clientRenewProhibited blocks this transaction while the restriction remains in effect.
Registry automatic renewal: Many gTLD registries automatically extend a registration when it reaches its expiration date. This is a registry-level lifecycle operation, not an explicit renewal command submitted by the registrar.
Consider a hypothetical example. A domain expires on October 27 while its RDAP record contains clientRenewProhibited. The registrar has not completed an explicit renewal, but the registry automatically extends the registration. The website continues functioning, DNS still resolves, and RDAP may show an expiration date one year later.
A domain owner might reasonably conclude that the registration has been renewed successfully.
However, the registry may have placed the domain in an Auto-Renew Grace Period, during which the registrar can still reverse the automatic renewal according to registry policy.
For many gTLDs, this period can extend up to 45 days.
The fact that a domain continues resolving after its expiration date does not prove that the customer's renewal has been finalized.
It is also important not to confuse registry automatic renewal with the auto-renewal setting offered by a registrar. The latter typically involves charging the customer and arranging renewal of the registration.
For an organization relying on its domain for business operations, the distinction matters. A successful payment, a functioning website, and an advanced registry expiration date do not necessarily establish that the registrar has completed the customer's renewal transaction.
References:
5. What domain owners can do to remove the restrictions
Because these are registrar-controlled EPP statuses, the registrant must generally work through the sponsoring registrar to remove them. Some registrars provide self-service controls, particularly for transfer locks, while others require customer support or additional verification.
Removing transfer and deletion restrictions
For clientTransferProhibited, registrants generally have established rights under ICANN's Transfer Policy, subject to applicable exceptions. Where the registrar does not offer a self-service method, it must ordinarily remove the restriction within five calendar days of an eligible registrant request.
For clientDeleteProhibited and clientUpdateProhibited, the registrant should contact the registrar or use its available domain-management controls. Removal may require identity verification or additional authorization, particularly when the restriction is associated with an enhanced protection service.
Registry-controlled server restrictions require coordination with the registry and may involve more stringent verification.
Removing clientRenewProhibited
The first step is to ask the sponsoring registrar why the renewal restriction was applied.
The registrar should be asked to clarify whether the restriction is related to a legal dispute, billing, administrative requirements, or its normal operational configuration. Domain owners should also establish whether the registrar automatically removes the restriction when processing an authorized renewal.
If the domain is eligible for renewal, the registrar can normally remove the status using an EPP update operation and then submit an explicit renewal request.
For a business-critical domain, obtain written confirmation of the renewal and independently verify the outcome through RDAP. Because the registry may already have automatically renewed the domain at expiration, a changed expiration date alone is not always sufficient evidence that the customer's renewal transaction has been finalized.
Unlike ordinary transfer-lock removal, there is no equivalent general ICANN rule requiring clientRenewProhibited to be removed within five calendar days. Renewal rights instead depend on the applicable registration agreement, registry lifecycle, and ICANN policies.
What if the registrar refuses?
For covered generic top-level domains, ICANN's Expired Registration Recovery Policy provides eligible registrants with renewal and recovery rights during specified post-expiration periods. If a registrar fails to honor applicable obligations, registrants can raise the issue with ICANN Contractual Compliance. The precise remedies depend on the domain's registration status and the relevant policies.
References:
6. Real-world lessons from registrar failures and domain expiration incidents
Several documented incidents demonstrate the operational risks associated with domain registration management. Although these cases are relevant to registrar restrictions and renewal failures, not all were caused by clientRenewProhibited.
ICANN.org - Renewal prohibited on ICANN's own domain. In its November 2010 security advisory SAC044, ICANN published a historical registration record for icann.org showing all four client prohibition statuses, including clientRenewProhibited. There was no documented renewal failure associated with the status. The example demonstrates that even prominent domains can carry renewal restrictions as part of their configuration. Original source: ICANN SAC044, page 25.
Freenom / OpenTLD - Registrants unable to renew or transfer domains. In November 2023, ICANN terminated OpenTLD's registrar accreditation following unresolved contractual violations, including failures to permit eligible domain renewals and remove transfer restrictions when required. The incident illustrates how registrar noncompliance can prevent legitimate domain management. ICANN termination notice | Domain Name Wire coverage.
Epik - Customers paid, but renewals were not processed. In 2023, ICANN received complaints alleging that Epik failed to process domain renewals despite collecting payments. The incidents highlight why paying a registrar does not, by itself, establish that a domain has been successfully renewed. Original source: ICANN, June 2023.
The Washington Post - Domain expiration disrupted email. In February 2004, email communications at The Washington Post were interrupted for hours after washpost.com expired. Renewal notices had reportedly been sent to an unmonitored mailbox. This was not a documented renewal-prohibition incident, but it illustrates the business impact of registration failures. Original source: The Washington Post.
Together, these examples highlight the importance of distinguishing between domain security protections, registrar operational failures, and renewal restrictions. None establishes that clientRenewProhibited caused a high-profile domain outage, but each provides a useful lesson in the risks of depending on registrar operations.
7. How to monitor domain status and expiration dates proactively
Domain registration monitoring should be part of an organization's cybersecurity and operational risk management program, particularly when its domains support email and customer-facing services. RDAP provides an independent way to inspect registration information. ICANN's RDAP Lookup is a convenient starting point for checking domain status codes, sponsoring registrars, and registry expiration dates.
Organizations should periodically review these records and compare changes over time. The unexpected appearance of clientRenewProhibited deserves investigation, particularly when expiration is approaching. Conversely, the unexpected disappearance of clientTransferProhibited or clientDeleteProhibited may signal that important security protections have been disabled.
Renewal monitoring should also be independent of the registrar's email notifications. Maintain an inventory of business-critical domains, their registrars, expiration dates, and responsible administrators. Set renewal reminders sufficiently early, and ensure that multiple authorized individuals receive them.
After renewing a domain, verify both the registry information and the registrar's confirmation that the paid renewal has been completed. Where registry automatic renewal may have occurred, ask the registrar to confirm that the registration is not simply being maintained temporarily during a grace period.
For critical domains, changes in EPP status codes should be treated as security-relevant events, alongside changes in DNS configuration and registrar account access.
Conclusion
Domain locks play an important role in protecting organizations from unauthorized transfers, deletions, and registration changes. But clientRenewProhibited is different because it restricts an action that legitimate registrants normally need to perform.
The presence of this status does not necessarily indicate a security problem. It may be an administrative or operational control, and it does not necessarily prevent registry automatic renewal. Nevertheless, it places an important dependency on the registrar to process legitimate renewal requests correctly. For a business relying on its domain for email, customer communications, and online services, understanding that dependency is essential.
The question is not simply whether your domain is registered today. It is whether you can reliably renew it tomorrow and whether you would know if something prevented that from happening.
Lappu AI provides basic domain monitoring services free of cost for all of its clients.
