The working group is considering big changes to the domain transfer process.
Significant changes could be made to domain name transfers, although it is still early days and a lot could change.
The first recommendations from an ICANN working group reviewing the Inter-Registrar Transfer Policy are due to be released for next week’s ICANN 74 Prep Week. A draft (pdf) of this report, which may well be the final form, offers notable changes.
First, it would eliminate the need for winning or losing registrars to submit a “Form of Authorization” (FOA) for domain transfers. Until the GDPR masked Whois data, the winning registrar would send an FOA to the contact in Whois to verify that they wanted to transfer the domain. GDPR put this requirement on hold because the winning registrar has no idea who owns the domain. So today, here’s how a domain transfer works:
1. Customer obtains an authorization code from their existing registrar and provides it to the winning registrar
2. The winning registrar verifies the transfer request and initiates the transfer
3. The losing registrar sends a pending transfer notice to the customer, giving them up to 5 days to cancel the request
The WG proposes an additional simplification: remove the losing registrar’s pre-transfer notification with the cancellation option.
Instead, the losing registrar is required to message its customer within 10 minutes of receiving a Transfer Authorization Code request and within 24 hours of the end of a outgoing transfer.
This is attractive because a domain transfer can be completed in minutes if there is no five-day hold. It seems that many domain owners only find out about a transfer once it’s complete. The working group will consider the concept of rollback later in the process; it would seem that this should be considered in conjunction with such a critical change in transfer policy.
Speaking of authorization codes, the group recommends requiring registrars to only generate the codes upon customer request rather than keeping them active for all domains at all times. This is related to the requirement to notify customer transfer code requests.
The other major proposed policy change concerns locks. Currently, locks may differ by top-level domain and registrar. For example, when you register a .com domain, the registry asks the registrar to block the transfer for 60 days. Registrars also have the option, but not the obligation, to lock .com domains when transferring them.
The working group recommends requiring registrars to lock all generic top-level domains for 30 days after registration or transfer.
He has two justifications for the initial lockdown. First, the registrar may discover credit card/payment issues. I’m curious how much of a problem that is; if someone registers a domain at Registrar X with the wrong payment method and wants to transfer it to Registrar Y, they will have to make another payment for the transfer. Second, the lock gives businesses the ability to file a UDRP against the new domain before it is transferred. I don’t see many UDRPs filed for domains that quickly, and I don’t know why they couldn’t just file it naming the new registrar if it’s transferred.
The purpose of transfer locks is to prevent multiple transfers after a theft. But demanding rather than allowing registrars to lock domains for 30 (or currently 60) days could make it more difficult for escrow services that take control of domain names to transfer domains.
The Internet Commerce Association hosted a members-only call earlier this month to seek feedback on domain transfers. The call included three working group members representing various stakeholders: intellectual property, registrars, and the business group. ICA General Counsel Zak Muscovitch noted that transfer policy is a challenge in balancing domain name security and portability.
The initial report will be open for public comment, and all members of the domain community should take the time to consider this important issue.
Note that additional transfer issues, including transfer blocks due to incumbent changes, will be on the table in later parts of the process.