EPP status clientHold / serverHold (domain suspended)

What’s actually happening

The whole site stops resolving at once — not one page, all of it, plus email and any subdomains. Browsers show NXDOMAIN because the registry pulled the domain's NS records out of the zone file, so resolvers get nothing back. A WHOIS or RDAP lookup shows the status field set to clientHold or serverHold. Nothing in your DNS provider or web host changed, which is what throws most people off.

Common causes

• Domain expired and the registrar parked it on clientHold pending renewal
• Unpaid registrar invoice or a chargeback on the renewal payment
• Failed ICANN WHOIS/RDAP verification — the confirmation email to the registrant went unclicked within 15 days
• serverHold set by the registry for a compliance, abuse, or trademark/UDRP dispute
• Court order or law-enforcement request routed through the registry

How to fix it

1. Confirm the hold with a WHOIS/RDAP lookupRun `whois example.com` or check rdap.org and read the EPP Status Codes line. clientHold means your registrar set it; serverHold means the registry did. The distinction tells you who you have to call.
2. For clientHold, fix the account-level issue at the registrarRenew an expired domain, clear the outstanding invoice, or click the ICANN verification email (resend it from the registrar dashboard if it expired). Once the registrar removes the status, they send an EPP update to the registry.
3. For serverHold, open a ticket with the registrar — you cannot lift it yourselfOnly the registry can remove serverHold, and they act through your registrar. You'll usually need to resolve whatever compliance or abuse complaint triggered it and supply documentation. Expect this to take days, not minutes.
4. Wait for zone re-publication and re-check resolutionAfter the status clears, the registry republishes your NS records on its next zone generation (often within minutes to a couple hours). Verify with `dig example.com NS @a.gtld-servers.net` against the TLD's authoritative servers before checking your own resolver, since recovered NXDOMAIN responses can sit in resolver negative caches for the SOA minimum TTL.