It’s always DNSclientHold and serverHold: why your domain stopped resolving
If every lookup for your domain suddenly returns “doesn’t exist” while your DNS records look fine, check the registry status. A hold removes the whole domain from DNS at the TLD, above anything you control.
What the statuses mean
| Status | Set by | Effect |
|---|---|---|
clientHold | Your registrar | The domain is removed from the TLD zone. Nothing resolves. |
serverHold | The registry | Same effect, set above the registrar (legal, abuse or registry policy). |
Both statuses pull your delegation out of the TLD’s zone, so the .com (or other TLD) servers answer NXDOMAIN for your domain. Your nameservers and records are untouched; resolvers simply can’t find them any more.
Common causes
- Unverified contact email. Under ICANN’s rules, a registrar must verify the registrant’s email after registration or a contact change. If the verification link isn’t clicked within 15 days, the registrar suspends the domain. This is the most common surprise, especially when the email went to an old address or a spam folder.
- Expired registration or failed payment.
- An abuse report or a dispute.
How to check
Look up the domain’s status codes in RDAP (the modern WHOIS), or run the checker on this site: its Registry step reads the registry directly and shows On hold when either status is set. The TLD delegation step will show NXDOMAIN at the same time.
How to fix it
- Find the reason with your registrar: check the account for verification or billing notices.
- Click the verification link, pay the renewal or answer the abuse report.
- Ask the registrar to remove the hold. Once they do, the registry puts the delegation back, usually within minutes.
How long recovery takes
Resolvers that looked up your domain during the hold cached NXDOMAIN. For .com and .net, that negative answer lasts up to 15 minutes per name, so each subdomain recovers on its own clock. Resolvers that still had your nameservers cached from before the hold may never have noticed it. Internal resolvers you can’t flush, such as AWS’s VPC resolver, simply wait out their caches. Purging Google, Cloudflare and OpenDNS for each important name speeds up the public side.
How to prevent it
- Use a registrant email that a team reads, not one person’s inbox.
- Watch the domain’s registry status, not just uptime. A hold shows up in RDAP before customers notice.
- Turn on registrar lock and auto-renew.
See what Google, Cloudflare, OpenDNS, Quad9 and major ISPs are serving, how long each will cache it, and the registry status.
Open the checkerMore guides: How long DNS propagation takes · How to flush DNS caches