diff --git a/app/models/contact.rb b/app/models/contact.rb
index 8f83eb805..e9c64d15d 100644
--- a/app/models/contact.rb
+++ b/app/models/contact.rb
@@ -351,4 +351,34 @@ class Contact < ActiveRecord::Base
   def set_ok
     statuses << OK if statuses.detect { |s| s == OK }.blank?
   end
+
+  def linked?
+    statuses.include?(LINKED)
+  end
+
+  def update_prohibited?
+    (statuses & [
+      CLIENT_UPDATE_PROHIBITED,
+      SERVER_UPDATE_PROHIBITED,
+      CLIENT_TRANSFER_PROHIBITED,
+      SERVER_TRANSFER_PROHIBITED,
+      PENDING_CREATE,
+      PENDING_TRANSFER,
+      PENDING_UPDATE,
+      PENDING_DELETE
+    ]).present?
+  end
+
+  def delete_prohibited?
+    (statuses & [
+      CLIENT_DELETE_PROHIBITED,
+      SERVER_DELETE_PROHIBITED,
+      CLIENT_TRANSFER_PROHIBITED,
+      SERVER_TRANSFER_PROHIBITED,
+      PENDING_CREATE,
+      PENDING_TRANSFER,
+      PENDING_UPDATE,
+      PENDING_DELETE
+    ]).present?
+  end
 end
diff --git a/app/models/epp/contact.rb b/app/models/epp/contact.rb
index e82e6b884..4231faf9e 100644
--- a/app/models/epp/contact.rb
+++ b/app/models/epp/contact.rb
@@ -4,6 +4,13 @@ class Epp::Contact < Contact
   # disable STI, there is type column present
   self.inheritance_column = :sti_disabled
 
+  before_validation :manage_permissions
+  def manage_permissions
+    return unless update_prohibited? || delete_prohibited?
+    add_epp_error('2304', nil, nil, I18n.t(:object_status_prohibits_operation))
+    false
+  end
+
   class << self
     # support legacy search
     def find_by_epp_code(code)
diff --git a/app/models/epp/domain.rb b/app/models/epp/domain.rb
index bb03da524..37cbbfa75 100644
--- a/app/models/epp/domain.rb
+++ b/app/models/epp/domain.rb
@@ -9,6 +9,21 @@ class Epp::Domain < Domain
     false
   end
 
+  before_validation :validate_contacts
+  def validate_contacts
+    return if contacts.map {|c| c.valid? }.all?
+    add_epp_error('2304', nil, nil, I18n.t(:object_status_prohibits_operation))
+    false
+  end
+
+  before_save :update_contact_status
+  def update_contact_status
+    contacts.each do |c|
+      next if c.linked?
+      c.save(validate: false)
+    end
+  end
+
   class << self
     def new_from_epp(frame, current_user)
       domain = Epp::Domain.new
diff --git a/spec/models/contact_spec.rb b/spec/models/contact_spec.rb
index 7c4bf3406..721039f14 100644
--- a/spec/models/contact_spec.rb
+++ b/spec/models/contact_spec.rb
@@ -179,17 +179,17 @@ describe Contact do
 
     it 'should have linked status when domain' do
       contact = Fabricate(:contact)
-      tech_domain_contact = Fabricate(:tech_domain_contact, contact_id: @contact.id)
+      tech_domain_contact = Fabricate(:tech_domain_contact, contact_id: contact.id)
       contact.statuses.should == %w(ok)
-      # domain = Fabricate(:domain, tech_domain_contacts: [@tech_domain_contact])
+      domain = Fabricate(:domain, tech_domain_contacts: [tech_domain_contact])
 
+      contact = domain.contacts.first
       contact.save
-      contact.reload.statuses.should == %w(linked ok)
-      
-      # contact = @domain.contacts.first
-      # contact.save
+      contact.statuses.sort.should == %w(linked ok)
 
-      # contact.statuses.sort.should == %w(linked ok)
+      contact = domain.contacts.second
+      contact.save
+      contact.statuses.sort.should == %w(linked ok)
     end
 
     it 'should not have linked status when no domain' do