Новийs Головна
Категорії новин
Доменні імена Реселлер доменів SSL-сертифікати Корпоративна електронна пошта Хостинг і сервери Політики ICANN і Регістрів Спірні питання щодо домену Продаж доменів Інше Вітання
Категорії новин
X
Доменні імена Реселлер доменів SSL-сертифікати Корпоративна електронна пошта Хостинг і сервери Політики ICANN і Регістрів Спірні питання щодо домену Продаж доменів Інше Вітання

ClientHold, ServerHold, and Abuse Review: What Domain Owners Need to Know

Перегляди:1 Час:2026-06-05 14:20:44 Автор: windy Контакт suppабоt email
ClientHold, ServerHold, and Abuse Review: What Domain Owners Need to Know
Seeing clientHold or serverHold on your domain can be alarming, but it does not always mean your domain is permanently lost or that the case is already closed. These status codes usually mean the domain has been restricted from normal DNS resolution or registry publication while an issue is reviewed or addressed. In abuse cases, the status may relate to phishing, malware, pharming, botnet activity, or spam used to deliver those forms of DNS Abuse. NiceNIC reviews abuse issues based on evidence, severity, current risk, and proportional action, while allowing legitimate domain owners and resellers to submit clarification, cleanup proof, or appeal materials through the official ticket or abuse channel where appropriate.

 
Why This Issue Matters to Domain Owners and Resellers
Domain status codes are technical, but their business impact can be immediate. If a domain is placed on clientHold or serverHold, the website may stop resolving. Email connected to the domain may fail. Customer login systems, payment pages, support portals, advertising campaigns, and API endpoints may also be affected.
For a business owner, this can feel like a sudden shutdown. For a reseller, the situation may be even more difficult because the end customer may see the website offline before understanding the reason. For bulk domain customers, one status issue may create concern about portfolio risk. This is why NiceNIC wants domain owners and resellers to understand what these statuses mean, what they do not mean, and what to do next.
A domain hold status should not be ignored. But it should also not be misunderstood as automatic proof that the domain owner intentionally committed abuse.


What clientHold Means
ClientHold is a registrar-side EPP status code. In practical terms, it usually means the registrar has placed the domain on hold at the registry level, and the domain is normally not published in the zone for resolution while that status remains active.
If your domain is on clientHold, your website and email may stop working because the domain may not resolve through DNS in the normal way.
A domain may be placed on clientHold for different reasons, including unresolved abuse concerns, compliance review, payment or renewal issues, legal issues, inaccurate account data, or other registrar-level requirements.
In the abuse context, clientHold may be used when there is evidence of serious or ongoing DNS Abuse, or when a reported issue has not been remediated in time.
clientHold does not automatically mean:
  • the domain owner intentionally caused abuse;
  • the domain is permanently lost;
  • the case cannot be reviewed;
  • the domain cannot be restored in any situation;
  • the reseller is personally responsible for the end customer's issue.
However, clientHold is serious. If your domain has this status, you should check your NiceNIC account, review the abuse notice or complaint summary if available, and respond quickly with evidence or remediation proof.


What serverHold Means
ServerHold is usually a registry-side EPP status code. In practical terms, it means the registry has placed the domain on hold, and the domain is normally not published in the zone for resolution while that status remains active.
The key difference is control. clientHold is generally applied by the registrar. serverHold is generally applied by the registry. If a domain is on serverHold, NiceNIC may not be able to remove the status directly. In those cases, NiceNIC may help review the case, explain available next steps, collect evidence, and coordinate where appropriate, but the registry may control whether and when the status is removed.
A serverHold status may appear in serious abuse, policy, registry compliance, legal, or registry-level cases. The exact reason depends on the registry and the circumstances.
If your domain is on serverHold, you should not assume that a normal account setting can remove it. You should open or continue an official support or abuse ticket and provide evidence as soon as possible.


What the Complaint or Abuse Signal Does and Does Not Mean
An abuse complaint or abuse signal may come from a security researcher, registry, brand owner, affected user, law enforcement contact, threat intelligence provider, hosting provider, or another reporting party.
It may involve:
  • phishing;
  • malware;
  • botnet-related activity;
  • pharming;
  • spam used to deliver DNS Abuse;
  • suspicious redirects;
  • compromised website files;
  • hacked subdomains;
  • third-party security listings;
  • registry escalation.
ICANN DNS Abuse generally includes malware, botnets, phishing, pharming, and spam when spam is used as a delivery mechanism for those forms of DNS Abuse.
However, an abuse complaint does not automatically mean:
  • the domain owner is guilty;
  • the complainant is automatically correct;
  • the domain was maliciously registered;
  • the domain must remain restricted forever;
  • every business dispute, copyright issue, trademark issue, or content complaint is DNS Abuse;
  • the domain owner or reseller has no opportunity to respond.
A report is a signal. A hold status is a serious operational state. Neither should replace evidence-based review.


How NiceNIC Reviews the Issue Fairly
NiceNIC reviews abuse-related domain status issues according to the NiceNIC Abuse Handling Manual, based on evidence, context, severity, current risk, and proportional mitigation.
During review, NiceNIC may consider:
  • whether the abuse report includes actionable evidence;
  • whether the reported URL or activity is still active;
  • whether the issue affects the full domain or only a specific URL, subdomain, file, redirect, or email function;
  • whether the domain appears maliciously registered or legitimately registered but compromised;
  • whether the domain owner or reseller received and responded to notices;
  • whether remediation evidence has been provided;
  • whether third-party security listings remain active;
  • whether users are currently at risk;
  • whether a less disruptive action may be sufficient;
  • whether the status was applied by NiceNIC or by the registry.
This distinction is important. A maliciously registered domain may be created mainly for phishing, malware, botnet activity, pharming, or other harmful use. A compromised legitimate domain may belong to a real business but was abused through hacked hosting, vulnerable CMS plugins, stolen credentials, unauthorized DNS changes, or infected email systems. NiceNIC does not need to treat these situations as identical. But both require a serious response if DNS Abuse is active.


What Domain Owners or Resellers Should Do Immediately
If you see clientHold, serverHold, or another concerning domain status, take these steps.
1. Check your official NiceNIC account
Log in to your NiceNIC account and review the domain status. Use How to Check Your Domain Abuse Status in NiceNIC to understand whether the domain is under review, on hold, awaiting customer action, or affected by another issue.
If available, review How to View the Abuse Complaint Summary for Your Domain to understand the reported issue.

2. Confirm the exact status code
Do not only rely on a third-party WHOIS page or forum post. Confirm the status in your NiceNIC account or through the official support channel.
If you see clientHold, the restriction may be registrar-side. If you see serverHold, the restriction may be registry-side. This affects what action is possible and who controls the status removal.

3. Review the reported issue
Check the exact URL, subdomain, file path, redirect, email issue, malware report, phishing report, or third-party listing involved.
Do not check only the homepage. Many abuse cases involve hidden files, injected pages, old scripts, compromised folders, or subdomains.

4. Secure your domain environment
Review hosting files, CMS users, plugins, themes, DNS records, nameserver settings, MX records, email logs, redirects, third-party services, and account access.
Reset passwords. Remove unknown users. Update software. Disable suspicious plugins. Remove harmful files. Ask your hosting provider to scan and clean the account if needed.

5. Respond through the official channel
Reply through the official NiceNIC ticket, support, or abuse channel. Keep the response factual. Attach evidence.
If you are a reseller, contact the end customer immediately and request technical proof, not only a general denial.


What Evidence or Remediation Materials Are Useful
Useful evidence may include:
  • screenshots showing the reported URL is removed or clean;
  • malware scan results;
  • hosting provider cleanup confirmation;
  • server logs showing the issue is no longer active;
  • DNS before-and-after screenshots;
  • email log review;
  • SMTP password reset confirmation;
  • proof that suspicious redirects were removed;
  • CMS cleanup records;
  • third-party delisting requests or confirmations;
  • a short remediation timeline;
  • reseller notes with technical proof from the end customer.
For false positives, explain why the report is incorrect or outdated. For example, the reported URL may no longer exist, the screenshot may be old, the security listing may have been corrected, or the report may have confused your domain with another domain.
If the case involves security listings, review Why Your Domain Is Flagged by VirusTotal, Spamhaus, Norton, and URLScan.io and What To Do.
If you are not sure whether the complaint is DNS Abuse, review What Is DNS Abuse? A Clear Guide to ICANN DNS Abuse vs Non-DNS Abuse.


What NiceNIC May Do Depending on the Situation
Depending on the evidence, status type, registry rules, and current risk, NiceNIC may:
  • ask the reporter for more specific evidence;
  • ask the domain owner or reseller for clarification;
  • request cleanup or remediation proof;
  • review submitted evidence;
  • monitor the domain after cleanup;
  • take no further domain-level action if the report is not actionable or cannot be verified;
  • apply or maintain clientHold where necessary to stop confirmed DNS Abuse;
  • remove clientHold if the issue is resolved and removal is appropriate;
  • coordinate with the registry if serverHold or registry-level action is involved;
  • keep records for compliance and audit purposes.
NiceNIC cannot guarantee that every restricted domain can be restored. The outcome depends on the evidence, current risk, registry rules, case history, and whether the issue has been fully resolved.
For more status guidance, review Why Domains Get Suspended and How to Avoid clientHold and NiceNIC Abuse Handling Manual.


FAQ
What does clientHold mean?
clientHold is generally a registrar-side status that may stop the domain from resolving normally. In abuse cases, it may be used when verified or unresolved issues require domain-level mitigation.

What does serverHold mean?
serverHold is generally a registry-side status that may stop the domain from resolving normally. If serverHold is applied, the registry may control whether and when the status can be removed.

Does clientHold or serverHold mean my domain is permanently lost?
Not necessarily. These statuses are serious, but they do not automatically mean the domain is permanently lost. The next steps depend on the reason for the status, the evidence, registry rules, and whether the issue can be resolved.

Does a hold status mean I intentionally committed abuse?
No. A hold status does not automatically prove intent. Some legitimate domains are compromised through hacked hosting, stolen credentials, vulnerable plugins, unauthorized DNS changes, or infected email systems.

Can NiceNIC remove serverHold?
Not always. serverHold is generally registry-side. NiceNIC may help review the case, collect evidence, explain next steps, and coordinate where appropriate, but the registry may control the status.

What should I submit to request review?
Submit the domain name, exact reported issue, cleanup proof, screenshots, scan results, hosting confirmation, logs, third-party delisting proof, and a concise explanation of what was checked or fixed.


Conclusion
If your domain shows clientHold, serverHold, or another concerning status, do not wait.
Log in to your NiceNIC account, check How to Check Your Domain Abuse Status in NiceNIC, review How to View the Abuse Complaint Summary for Your Domain if available, inspect the exact reported issue, and submit evidence through the official ticket or abuse channel.
For new domain planning, use Domain Name Search carefully. For portfolio movement, review Domain Transfer before moving domains with active status issues. For partners managing customer domains, Domain Reseller and Reseller API can help create clearer workflows for notice handling, evidence collection, and customer communication.
NiceNIC's goal is to help legitimate domain owners and resellers understand domain status codes, respond quickly, protect their operations, and address verified DNS Abuse responsibly.

Авторське право © 2006-2026 NICENIC INTERNATIONAL GROUP CO., LIMITED Всі права захищені