clientUpdateProhibited: What It Means & How to Remove It

What clientUpdateProhibited means

"Updates" here means changes to the domain object at the registry: nameserver (delegation) changes, registrant and contact data changes, and status changes. While the code is present, the registry rejects them all.

Note the nuance: some registrars manage DNS records on their own nameservers, and editing those records isn't a registry update — so you may still be able to change A or MX records while locked. Changing which nameservers the domain points to, however, is a registry update and will be blocked.

Is it good or bad news?

Good news in the common case. Paired with clientTransferProhibited and clientDeleteProhibited, it's part of the standard protection set that stops an attacker from redirecting your domain's nameservers — the fastest way to hijack traffic and intercept email without transferring the domain at all.

It becomes friction only when you legitimately need to change nameservers or contacts and the lock is still on.

How to remove it

• •Log in to your registrar and disable the domain lock (often one toggle covers update, transfer, and delete prohibitions together).
• •Make your change — nameservers, contacts, whatever prompted the unlock.
• •Re-enable the lock when you're done. Leaving domains unlocked indefinitely is an unnecessary risk.
• •If you don't control the registrar account (e.g., a previous employee or agency registered the domain), you'll need to recover account access first — only the sponsoring registrar can remove a client code.

clientUpdateProhibited vs serverUpdateProhibited

serverUpdateProhibited is the registry-level equivalent — typically a paid registry lock service or a legal hold. Your registrar's unlock toggle won't remove it; the registrar must ask the registry. If you see both codes, both must be cleared before updates go through.