The registrar has locked the domain against changes.
The registry rejects updates to the domain object, such as changing its nameservers or contacts, other than the update that removes this status.
- EPP code
- clientUpdateProhibited
- In RDAP
- client update prohibited
- Set by
- Your registrar (client status)
- Defined in
- RFC 5731 §2.3
- How serious
- Nothing wrong
Why it matters
It stops an attacker, or a mistake, from pointing your domain at different nameservers. It does not affect the records inside your DNS zone: you can still edit SPF, DMARC and MX at your DNS host.
When you’d see it
Some registrars set this alongside the transfer lock. You try to change nameservers to a new DNS host and the save fails or the registrar says the domain is locked; turning off the lock, saving, and turning it back on is the usual sequence.
How it shows up in a lookup
In a gTLD WHOIS lookup it appears as “Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited”; RDAP shows it as “client update prohibited”. It is a client status, so only your registrar can add or remove it; the registry enforces it.
What to do
If you meant to change nameservers or registration details, sign in at your registrar and turn off the lock (often called "domain lock" or "transfer lock"), or ask their support to remove it. The change shows up in RDAP within minutes to hours.
Combination rules
pendingUpdate must not be combined with clientUpdateProhibited (RFC 5731 §2.3).
Related codes
Sources
Sources
- RFC 5731 §2.3 (EPP Domain Name Mapping) · checked 5 Oct 2026
- ICANN: EPP Status Codes, What do they mean, and why should I know? · checked 5 Oct 2026
- RFC 8056: EPP and RDAP status mapping · checked 5 Oct 2026