Your Registrar Can Unplug You With One Status Code

A sysadmin says Namecheap seized all their domains. Deletion isn't needed — one EPP status flag takes any domain offline.

Dafallah Ibrahim

— 2 min read
Share

The top story on Hacker News this morning: a sysadmin reports that Namecheap seized and disabled every domain in their account. There's no outage to engineer around and no provider to blame. Just a flag flipped somewhere.

Here's the part most engineers have never looked at: a registrar doesn't need to delete or transfer your domain to take you offline. It sets one EPP status code, and the domain vanishes from DNS worldwide.

Why this matters

Your entire redundancy plan sits below the delegation. Multi-region apps, dual DNS providers, failover tiers — all of it is reached through NS records the TLD registry publishes. The registrar controls that publication.

The kill radius is bigger than your website. OAuth redirects, SAML metadata URLs, password-reset email, billing webhooks — plus your status page if it lives under the same root domain.

And the triggers are usually mundane: a missed identity-verification email, a chargeback, an abuse complaint, a compromised account. Dramatic seizures make the front page. Quiet holds happen every day.

How it works

Registrars talk to registries through EPP, the Extensible Provisioning Protocol. Every domain carries status codes. You've probably seen clientTransferProhibited in a whois dump — that's a healthy lock.

The kill switch is clientHold. It tells the registry to exclude the domain from the zone entirely. Your nameservers never get queried, because resolvers can't find them. Nothing was deleted; recovery is a single flag — flipped only by the party that set it.

Its bigger brother serverHold comes from the registry itself, usually legal or policy action. Your registrar can't undo that one for you.

Where this helps

  • Mystery outages: when a domain stops resolving, check the whois status before touching DNS config. clientHold in the output means no DNS change will fix anything.
  • Threat modeling your registrar account: an attacker won't start a 5-day transfer that triggers notification emails. They'll quietly repoint nameservers or set a hold. You want update protection plus alerts on any status change.
  • Architecture: keep your status page and a backup auth domain at a different registrar on a different TLD, so one hold can't silence both your service and your explanation.

Watch out

Transfer locks do not prevent suspension. Locks stop transfers and updates — they don't constrain the registrar's own actions.

Redundant DNS doesn't survive a hold either. The hold erases the delegation above your nameservers, so your perfectly healthy secondary provider never gets asked. This defeats a lot of "we're covered" designs.

Also: watch registrar verification emails and expiry notices. Unread ones are a leading cause of holds, and recovery phases get slower and pricier the longer a domain sits disabled.

Try it yourself

# Audit the EPP status of your domains
for d in example.com api.example.com; do
  echo "== $d"
  whois "$d" | grep -i "status"
done

# Ask the .com registry directly what it publishes
dig +short NS example.com @a.gtld-servers.com

clientTransferProhibited means healthy. The word "Hold" or "PendingDelete" means drop everything. And if the dig command returns nothing while your DNS provider still answers queries, you're on hold right now.

TL;DR

  • What happened: a Namecheap account seizure is HN's top story; registrar disables typically mean a clientHold EPP status, not deletion.
  • Why it matters: a hold erases your delegation at the registry level, so redundant DNS can't save you — auth, email, and your status page fall together.
  • Try today: run the whois audit, confirm registrar lock is on, and move your status page off your main domain's registrar.

Read more