Domain terms, defined

What every registry status, EPP code and DNS record actually means, written for the person whose domain is in one of them.

A domain name passes through a fixed sequence of registry states, each named by a code the registry publishes and most people never see explained. This glossary defines those states, the EPP status codes behind them, the DNS record types a zone is built from and the three email authentication records that decide whether your mail is trusted. Every definition is sourced from the same status map, stage vocabulary and record list Domainyze monitors with, so what you read here is what our alerts act on.

Domain lifecycle statuses 18 terms The registry states a domain passes through, from active registration to release, with the EPP codes that name each one. DNS records 11 terms Every record type a zone is built from, what each one holds, and the failure each one causes when it is missing or wrong. Email authentication 6 terms The three records that authenticate your mail, how they combine, and the misconfigurations that quietly disable them. Protocols and acronyms 12 terms WHOIS, RDAP, EPP, DNSSEC and TTL, plus the difference between a registry, a registrar and ICANN.

All glossary terms

Domain lifecycle statuses

Registered (active): A domain that is currently held by a registrant and is not near its expiry date. The registry will not let anyone else register it.
Expiring soon: A registered domain whose expiry date falls inside the next 90 days. It is still fully active; the clock is simply visible.
Grace period: The window immediately after expiry in which the registrant can still renew the domain at the ordinary renewal price. Length is set by the registry, commonly around 45 days for generic TLDs.
autoRenewPeriod: The EPP status a registry sets when it has automatically renewed an expired domain on the registrar's account, giving the registrar a window to either collect payment or cancel the renewal for a refund.
clientHold: An EPP status set by the registrar that removes the domain from the DNS zone. The name stays registered, but it stops resolving: no website, no email.
serverHold: The registry's own version of clientHold. The domain is removed from the zone and stops resolving, and the registrar cannot lift it.
clientTransferProhibited: An EPP status that blocks the domain from being transferred to another registrar. It is a lock, not a problem, and most registrars set it by default.
Domain lock (update, delete and registry lock): The remaining EPP prohibitions: clientUpdateProhibited and clientDeleteProhibited set by your registrar, serverUpdateProhibited and serverDeleteProhibited set by the registry, and the bundled registry lock services that apply several at once.
pendingTransfer: A transfer to another registrar has been requested and is waiting on the losing registrar. The domain still works normally while it sits here.
Expired: The registration term has run out and has not been paid for. The name is past its expiry date but has not yet been released.
Redemption period: The recovery window after the grace period, in which only the original registrant can get the domain back, and only by paying a restore fee on top of the renewal. Commonly 30 days on generic TLDs.
pendingDelete: The final registry window before an expired domain is released. Nothing can recover it here, not even the original owner: the name is queued for deletion. Commonly five days on generic TLDs.
Available: The name is not registered. Anyone can register it at any registrar, at the going price for its TLD.
Auction: The domain is being sold on a marketplace rather than released to the public. It may never reach a public drop at all.
Blocked or reserved: The registry will not let anyone register this name at all. It is reserved by policy or blocked by a brand-protection service, and it will not drop.
Reclaimed: A domain you were watching was renewed or restored by its original owner. It went through the recovery windows and came back out registered to the same registrant.
Taken: A domain you were watching dropped and was registered by somebody else. The registration is new, so the registrant changed.
Unknown status: We do not have an authoritative answer about this name yet. It describes our read of the domain, not anything the domain is doing.

DNS records

A record: Maps a hostname to an IPv4 address. It is the record that answers "where is this website".
AAAA record: The IPv6 equivalent of an A record: it maps a hostname to an IPv6 address.
CNAME record: Aliases one name to another, so the resolver looks the second name up instead. Used to point a subdomain at a provider's hostname.
MX record: Names the mail servers that accept email for the domain, each with a priority number. The lowest number is tried first.
NS record: Names the authoritative nameservers for a zone. The registry publishes these for your domain, and they decide who answers every other question about it.
TXT record: Holds arbitrary text. It has no protocol meaning of its own, which is why so many systems use it to publish policy and verification strings.
SOA record: The start of authority: one record per zone, carrying the primary nameserver, the administrative contact and the timers that govern zone transfers and negative caching.
CAA record: Lists the certificate authorities permitted to issue certificates for the domain. A CA is required to check it before issuing.
SRV record: Advertises the hostname and port of a specific service for a domain, under a name that encodes the service and protocol.
DS record: The Delegation Signer record: a hash of your zone's signing key, published in the parent zone by the registry so a resolver can verify that the DNSSEC signatures in your zone are the right ones.
DNS propagation: The period after a DNS change during which some resolvers still answer with the old value, because they cached it before the edit.

Email authentication

SPF: Sender Policy Framework: a TXT record listing the servers permitted to send mail for your domain, ending in a rule for everything else.
SPF 10-lookup limit: A hard cap in the SPF specification: evaluating your record may cost a receiver at most ten DNS lookups. Exceed it and the result is permerror, which counts as a failure.
DKIM: DomainKeys Identified Mail: a cryptographic signature added to each outgoing message, verified against a public key published in your DNS under a selector name.
DKIM selector: The label that names one DKIM key in your zone. It is published in the message header and points at a TXT record at selector._domainkey.yourdomain.
DMARC: Domain-based Message Authentication, Reporting and Conformance: a TXT record at _dmarc that tells receivers what to do with mail failing SPF and DKIM, and where to send reports.
DMARC policy (p=none, quarantine, reject): The p= value in a DMARC record: what you are asking receivers to do with mail that claims to be from your domain and passes neither an aligned SPF check nor an aligned DKIM signature.

Protocols and acronyms

WHOIS: The original protocol for looking up who holds a domain and what state it is in. It returns free-form text, formatted differently by every registry.
RDAP: The Registration Data Access Protocol: the structured, JSON-based successor to WHOIS, served over HTTPS with a standard response shape.
WHOIS privacy and redaction: Why a modern lookup rarely names a person: registrant contact details are either replaced by a privacy service the owner bought, or redacted by the registrar to comply with data protection law.
EPP: The Extensible Provisioning Protocol: the interface registrars use to register, renew, transfer and delete names at a registry. Its status codes are the ones a lookup shows you.
Auth code (EPP code, transfer code): The per-domain password that authorises a transfer to another registrar. Your current registrar issues it, the gaining registrar asks for it, and the registry checks it.
DNSSEC: A set of DNS extensions that cryptographically sign zone data, so a resolver can verify an answer came from the real zone and was not altered in transit.
TTL: Time to live: how many seconds a resolver may cache a DNS answer before asking again. Set per record.
Registrant: The person or organisation a domain is registered to. Not the registrar, not the administrative contact, and not necessarily whoever manages the DNS.
Registrar: The company you buy and manage a domain through. It holds your account, takes your payment, and talks to the registry on your behalf.
Registry: The organisation that operates a top-level domain: it holds the authoritative database of every name in it and sets the rules for that TLD.
TLD, gTLD and ccTLD: The top-level domain is the last label of a name: the com in example.com. A gTLD is a generic one such as .com or .app; a ccTLD belongs to a country or territory, such as .uk or .de.
ICANN: The Internet Corporation for Assigned Names and Numbers: the body that coordinates the domain name system and accredits registrars for generic TLDs.

Every definition here is derived from the vocabulary our lifecycle engine runs on. Looking for a specific registry's timings instead? Those are on the drop times by TLD pages.

FAQ

Frequently Asked Questions

How these definitions are sourced, and where to go next.

Where do these definitions come from?

The facts come from our own monitoring engine: the registry status map, the lifecycle stage vocabulary and the DNS record types our lookup tool queries. The explanations are written by us. That split is deliberate, so a definition here cannot describe a status differently from the badge you see on a domain in the app.

Why do some terms have their own page and others do not?

A term earns its own page when people search for it on its own. The rest are defined on their category page, where a reader comparing several terms has them side by side. Both carry the same definition; the dedicated pages carry more context and a worked example.

The status on my domain is not listed. What now?

Registries publish dozens of codes, and many are local variants of the same few states. Our engine normalises every code it has seen into one of the unified statuses defined here, so an unlisted code almost certainly maps to one of these entries. If a status is genuinely unrecognised it is reported as unknown rather than guessed at.

Can I monitor these states rather than look them up?

Yes. That is what the product does: it watches the registry, the zone and the certificate for every domain you add, and alerts you when one of these states changes. The glossary exists so that the alert you get is one you can read.