An expiry date is a scheduled event and everything else the registry tells you is news. A domain can be suspended, in a redemption period, or pending deletion with an expiry date that is still months away, and a watcher that only reads the date will report all of those as fine.
Key takeaways
Status codes carry situations the expiry date cannot express.
Three families: protective locks, registrar actions, and the deletion lifecycle.
Missing protective locks on an important domain is a finding in itself.
An unexpected nameserver change is the loudest signal the registry can give you.
Every change is reported; only some changes are alarming.
Three families of code
Family
Examples
What it means
Protective
clientTransferProhibited, clientUpdateProhibited
The domain is locked against transfer or change. You want these.
Registrar action
clientHold, serverHold
The registrar or registry has stopped resolving it. Usually payment or abuse.
Lifecycle
redemptionPeriod, pendingDelete
It has already expired and is on a clock. Days matter now, not months.
The lifecycle family is the one that catches people. A domain that expired last month is not gone — it goes through a redemption period during which it can usually be recovered for a fee, and then a pending-delete window after which it is released. A watcher that reports on expiry dates and stops reporting once a domain expires has gone quiet at precisely the point where a few days matter.
What each change triggers
Fig 1. How a status change is handled. Three of the four branches alarm, which is unusual for this series and reflects that status codes only change when something has happened.
App integration
Machine learning
Networking
Management
Analytics
Missing locks
The protective codes are the ones you want present, and their absence on an important domain is a finding the register should raise once rather than an alarm it repeats. A domain without clientTransferProhibited can be transferred away with less friction than one that has it, and turning it on is a single setting in every registrar dashboard.
So the weekly check includes a one-off note: “example.com has no transfer lock. Most registrars offer this free.” Once acknowledged, it is not raised again unless the situation changes.
Nameservers
Not a status code, and the loudest thing on the whole record. Nameservers change when somebody moves hosting, and they change when somebody has taken control of a domain. Both are rare, and the second is the reason this is checked weekly rather than monthly.
Fig 2. How a nameserver change is handled. It is almost always benign and the response is sized for the case where it is not.
App integration
Machine learning
Networking
Management
Including both the old and new nameservers in the message is what makes it a ten-second triage. Somebody who moved the hosting recognises the new ones immediately; somebody who did not recognises that they do not, and that is exactly the distinction the message needs to support.
Next: the escalation, and who it actually goes to.