Web Hosting Talk : Web Hosting Main Forums : Domain Names : New ICANN Transfer Policy EFF. Nov 12

[kohashi]

Lock your domain names, now.


ICANN is implementing a policy where domains will automatically be transferred if the registrant fails to negate the transfer and the gaining registrar authorizes it. Basically this makes it easier to hijack domain names if you are not paying very close attention.

http://www.icann.org/transfers/policy-12jul04.htm

All answers from webpage above.

Who can authorize?

The Administrative Contact and the Registered Name Holder, as listed in the Losing Registrar's or applicable Registry's (where available) publicly accessible WHOIS service are the only parties that have the authority to approve or deny a transfer request to the Gaining Registrar. In the event of a dispute, the Registered Name Holder's authority supersedes that of the Administrative Contact.

Registrars may use Whois data from either the Registrar of Record or the relevant Registry for the purpose of verifying the authenticity of a transfer request; or from another data source as determined by a consensus policy.




How can they transfer my domain away?
Failure by the Registrar of Record to respond within five (5) calendar days to a notification from the Registry regarding a transfer request will result in a default "approval" of the transfer.






This is a very scary policy and it hsa been highly recommended by many resellers and registrars that you lock ALL your domain names unless you are transferring them.

[4solutions]

Great Post, Kevin.

This is important information... can you make this into a sticky for the next month or so?

[internext]

Very scary new policy. I hope it gets changed to something more logical. I mean... even if you lock all your domains, as advised, what if you unlock a domain to transfer it, isnt there a slim window of opportunity presented to someone who may be monitoring your domain?

[kohashi]

i moved ALL of my domains to one registrar and locked them, so hopefully this will prevent the need for transfers. And hopefully any domain names I buy in the future are all there as well

[eSology]

Originally posted by kohashi
i moved ALL of my domains to one registrar and locked them, so hopefully this will prevent the need for transfers. And hopefully any domain names I buy in the future are all there as well

ditto! I have been doing this over the past 3 months myself.

[internext]

Its pretty bad when we have to keep all of our eggs into one basket to feel safe...

[kohashi]

Originally posted by ericv8
Its pretty bad when we have to keep all of our eggs into one basket to feel safe...

Indeed, but make the best of a bad situation. Choose the registrar who you think will treat you best and do their best to protect you. And do it QUICK. I only managed to finish transferring all my domains a couple days ago.

[Dave Zan]

Originally posted by ericv8
Very scary new policy. I hope it gets changed to something more logical. I mean... even if you lock all your domains, as advised, what if you unlock a domain to transfer it, isnt there a slim window of opportunity presented to someone who may be monitoring your domain?

Especially if someone devised a script to first continually check if
the name is unlocked, then strike!

[internext]

Seriously, there has GOT to be a better way. Amazing that ICANN cannot see these possibilities. Let's hope this works better in practice than it sounds like it could.

[mdadnan]

I have a question sometimes transferring domain to eNom fails to collect whois information from Uwhois and don't send out verification email. Similarly Directi sometimes has issue in picking up whois admin email address and continuously tries to pick up whois contact information every few hours, as reported by the system.

If I issue a transfer request and authorize it from gaining registrar and Directi fails to retrieve whois email address and ultimately fails to send authorization email to the registrant email , the domain would still transfer after November 12th ?

[akashik]

We just locked down our own domains, among a few other personal ones.

Thankfully Dotster offers this free of charge and it's a simple procedure through their control panel. (I've always been a bit fan of their system, especially right now).

As far as ICANN goes I've exhausted my 'potty mouth' to my wife who alerted me of this. But in the end, all I can say is, "What the f*ck is ICANN thinking?"

We have customers who I know don't check their e-mail for a week or more at a time, and they're put a five day limit on their response to a domain transfer??

Stupidity of the highest order...

[Gen-T]

Situations like this sure make me thankful for the global/bulk edit feature. For those of us who have a lot of names, having to do each name individually would be a real pain. I agree that this seems to be a step backwards in security, and find it very unsettling.

[hostito]

I can't help but think this decicion will not last long

[mewcat]

Are you guys sure that if Admin doesn't respond then also it'll be transferred away?

Seems Directi have updated their Transfer procedure based on the new ICANN rulings http://www.logicboxes.com/sample/mai...th-12jul04.htm

but it clearly mentions:

(Note: If you do not respond by <date>, <domain name> will not be transferred to us)

[mewcat]

oops that was for Transfer-In to Directi case.

for Transfer-Out from Directi :
http://www.logicboxes.com/sample/mai...nf-12jul04.htm

its mentions-

If we do not hear from you by <insert date>, the transfer will proceed.