A domain name can be central to an organization's operations, yet keeping it registered depends on a third party: the domain registrar. A registrar controls the registration workflow through which customers request renewals, transfers, and changes. When that process breaks down, the consequences can range from an inconvenient support ticket to a business-critical outage.

The risks are not limited to cyberattacks or domain hijacking. A restrictive status code, an unresponsive registrar, a payment that never becomes a registry renewal, or a missed expiration notice can all leave a registrant in a difficult position.

Four documented examples illustrate different parts of that problem. One involves a surprising status configuration on ICANN's own domain. Two involve registrar failures that drew direct ICANN intervention. The last involves a major newspaper whose email stopped working after an overlooked renewal.

An important distinction: None of these cases establishes that the EPP status clientRenewProhibited caused a high-profile outage. The incidents illuminate four different registrar and registration risks—not one common technical failure.

Lesson 1: ICANN.org - a domain lock can include a renewal prohibition

In November 2010, ICANN's Security and Stability Advisory Committee (SSAC) published A Registrant's Guide to Protecting Domain Name Registration Accounts (SAC044). On page 25, the report reproduced a historical WHOIS record for icann.org, then registered through GoDaddy. Alongside the expected security protections, the record displayed four statuses:

CLIENT DELETE PROHIBITED
CLIENT RENEW PROHIBITED
CLIENT TRANSFER PROHIBITED
CLIENT UPDATE PROHIBITED

The transfer, deletion, and update restrictions have readily understood security purposes. They can reduce the risk of unauthorized changes to a domain registration. But the inclusion of CLIENT RENEW PROHIBITED is noteworthy: this status instructs the registry to reject explicit EPP renewal requests while the restriction remains in place.

The report did not explain why the renewal restriction was present, and it did not report any failure to renew icann.org. It would be wrong to treat the record as evidence of an incident. Its value is different: it demonstrates that a renewal prohibition can appear alongside ordinary domain security locks, even on a prominent organization's domain.

For domain owners, the lesson is to distinguish protections you deliberately enabled from restrictions you do not understand. A familiar-looking collection of locks should not be assumed to consist entirely of anti-hijacking controls. If RDAP shows clientRenewProhibited, ask your registrar why it is present and how it handles an authorized renewal.

Original source: ICANN SSAC, SAC044 (November 5, 2010), reproduced icann.org record.

Lesson 2: Freenom / OpenTLD - a legitimate transfer lock can become an obstacle

In 2023, ICANN took enforcement action against OpenTLD B.V., an accredited registrar associated with the Freenom group. On September 20, ICANN issued a breach notice covering several problems, including failures to let eligible registrants renew expired domains and failures to provide transfer authorization codes or remove ClientTransferProhibited when required.

The latter is especially significant. clientTransferProhibited is normally a useful defense against domain hijacking. But the protection depends on the registrar being willing and able to unlock the registration when a legitimate registrant requests it. ICANN's Transfer Policy provides requirements for removing ordinary registrar transfer locks, subject to the applicable exceptions.

OpenTLD did not resolve the identified breaches. On November 9, 2023, ICANN issued a termination notice, effective November 25, citing repeated and unresolved contractual violations. These included the failures concerning renewal and transfer restrictions. The public enforcement record establishes failures to provide required services; it does not show that clientRenewProhibited caused the renewal problems.

The practical impact continued after termination. In December, Domain Name Wire reported on a reader who could not renew a domain at Freenom during the transition to another registrar. ICANN told the publication that its de-accredited registrar transition process involves working with registries to prevent domain deletions caused by the failed registrar's actions or inaction, often through temporary registry auto-renewal. Registrants still needed to arrange their ongoing renewals with the gaining registrar.

The lesson: Domain locks are safeguards only when legitimate owners retain a workable path to manage them. Organizations should know how to obtain an authorization code, remove a transfer lock, and reach an effective escalation channel before they need an emergency transfer. The availability of a registry transition procedure is a safety net, not a substitute for a functioning registrar.

Original sources: ICANN's OpenTLD termination notice (November 9, 2023); Domain Name Wire's reporting on renewal difficulties (December 18, 2023).

Lesson 3: Epik - a payment receipt is not proof of a completed renewal

In March 2023, ICANN began receiving complaints alleging that Epik was not processing domain renewals in a timely manner despite taking customers' payments. Registrants also complained about inadequate responses from customer support. By June 9, ICANN reported receiving 40 renewal-related complaints and opening 19 compliance investigations.

An important nuance emerged from ICANN's account: in almost 70% of the complaints it had received, the gTLD domains had not yet expired. ICANN explained that, in those circumstances, the registrar had not yet violated the particular post-expiration renewal provisions of the Registrar Accreditation Agreement or the Expired Registration Recovery Policy. Other cases involved domains that had already expired and were at risk of deletion, prompting escalated compliance action.

ICANN issued Epik a formal breach notice on June 1, 2023, primarily for unpaid accreditation fees, while also highlighting outstanding complaints about the registrar's services. In its June 30 update, ICANN reported that Epik had cured that notice, acknowledged delays in processing customer requests, and renewed or permitted transfer of the affected gTLD registrations for which proof of payment had been provided.

The essential distinction is between a commercial transaction with the registrar and a completed registration operation at the registry. A customer can have an invoice, a payment confirmation, and an expectation of another year's service without that expectation yet being reflected in the authoritative registration record.

The lesson: Verify renewals independently. Retain receipts and correspondence, but also check registry expiration information and obtain the registrar's confirmation that the customer's renewal is final. If the registry has automatically renewed the domain at expiration, an advanced expiration date alone might not prove that the customer-paid renewal was completed. Those records also become important evidence if escalation to ICANN Contractual Compliance is necessary.

Original sources: ICANN's June 9, 2023, account of the Epik complaints; ICANN's June 30, 2023, resolution update.

Lesson 4: The Washington Post - an unnoticed expiration can interrupt email

In February 2004, The Washington Post experienced a failure that required neither a compromised registrar account nor a disputed domain. The registration of washpost.com, used for staff email, had expired on January 29. On February 5, external email was disrupted for hours when the domain stopped functioning as expected.

The newspaper's public website, hosted under washingtonpost.com, remained available. That separation made the incident particularly revealing: one domain could appear healthy to readers while another domain, less visible to the public but essential to operations, failed. The newspaper reported that renewal notices from Network Solutions had gone to an unmonitored mailbox. The registrar said it had sent multiple warnings, including at least seven notifications over the preceding months.

The annual registration cost was reported as just $35. The operational impact was disproportionate to that amount. Journalists and other employees temporarily lost external email communication with sources, clients, and colleagues, while incoming messages bounced. The domain was renewed after the problem was discovered.

There is no documented connection between the outage and clientRenewProhibited. This was an expiration-management failure, illustrating a different weakness: a domain can be technically critical without having a clear, actively monitored business owner.

The lesson: Treat email and infrastructure domains with the same attention as the main corporate website. Keep registrar contact addresses monitored, use independent expiration alerts, and make sure renewal responsibility does not reside with a single employee or mailbox. Where possible, ensure critical registrar notifications do not depend solely on an email address under the domain that may expire.

Original source: Jonathan Krim, “Failure to Renew Domain Disrupts E-Mail at Post,” The Washington Post (February 5, 2004).

Four cases, four different kinds of registrar risk

These stories should not be grouped together as though they share a single cause. ICANN.org illustrates an unexplained renewal-lock configuration without an incident. OpenTLD demonstrates that a registrar can fail to honor renewal and transfer rights. Epik shows that payment and actual renewal processing can become disconnected. The Washington Post shows how inadequate internal ownership and notification handling can cause a real outage.

Together, they expose a larger security and operational dependency. Registrants rely on their registrar not only to resist unauthorized requests, but also to execute authorized requests reliably. A good security lock is useful; an effective renewal process is indispensable. Neither should be assumed to guarantee the other.

What organizations should do differently

A practical domain-resilience program does not require sophisticated tooling to start, but it does require independent verification.

  1. Inventory every operational domain. Include domains used for employee email, outbound mail, customer portals, redirects, API endpoints, and legacy services—not only your primary website.
  2. Monitor RDAP status and expiration changes. Record the sponsoring registrar, registry expiration date, and EPP status codes. Investigate unexpected appearance of clientRenewProhibited and unexpected removal of transfer, deletion, or update locks.
  3. Test registrar recovery procedures. Know who can authorize a renewal or transfer, how the transfer lock is removed, where authorization codes are obtained, and how urgent problems are escalated.
  4. Separate payment verification from registration verification. Confirm that the renewal was processed and the intended registration period is secured, not merely that a payment succeeded or DNS continues working.
  5. Use multiple owners and independent alerts. Maintain monitored registrar contacts and renewal reminders outside the domain's own email system. Renew critical names well before expiration and retain records of support interactions.

For covered generic top-level domains, registrants can also use ICANN's Contractual Compliance complaint process when a registrar fails to meet applicable obligations. The relevant rights and remedies depend on the domain's lifecycle state, registry, and policies; country-code domains may follow different rules.

Conclusion

A domain can be locked against attackers and still be difficult for its rightful registrant to manage. A renewal can be paid for but not completed. An expiration can interrupt vital communications even when the organization's public website remains online.

These incidents are reminders that domain security is not just about preventing malicious changes. It is also about ensuring that legitimate registration operations can be completed—and independently verified—when they matter most.

Your domain is only as resilient as the people, processes, and registrar systems responsible for keeping it registered.