Transfer Policy (IRTP)

Inter-Registrar Transfer Policy — updated Feb 2024, effective Aug 2025

The ICANN Inter-Registrar Transfer Policy (IRTP) governs how gTLD domains are transferred between registrars. The policy was updated on 21 February 2024 and becomes fully effective 21 August 2025.

Transfer Process (Step by Step)

Registrant initiates. Requests auth code from current (losing) registrar. Registrar must provide within 5 calendar days. Cannot withhold for payment disputes.
Gaining registrar validates. Obtains Form of Authorization (FOA) from registrant/admin contact confirming intent. Auth code submitted.
Losing registrar notified. Has 5 calendar days to approve or deny. Auto-approves if no response within 5 days.
Transfer completes. Domain moves to gaining registrar. 1 year added to expiry (not to exceed 10-year max).
60-day lock applied. Post-transfer lock (clientTransferProhibited) prevents immediate re-transfer.

Transfer Lock Periods

Post-registration: 60 days. Transfer prohibited in first 60 days after new registration.
Post-transfer: 60 days. Transfer prohibited in first 60 days after a previous registrar transfer.
Post-COR: 60 days. Applied after Change of Registrant. Registrant may opt out before initiating COR.
Server-side locks: serverTransferProhibited can only be removed by registry, not registrar. Requires registry intervention.

Auth Code Rules

Also called AuthInfo Code, EPP Code, Transfer Authorization Code (TAC), or Transfer Key. Unique per domain per ICANN policy.

Entropy: Minimum 128 bits recommended (RFC 9154).
Delivery obligation: Registrar must provide within 5 calendar days of registrant request.
Payment disputes: Cannot be withheld due to unpaid fees. ICANN policy violation.
Expiry: Invalid after transfer or on expiry (varies by registrar).
No additional hurdles: Losing registrar must not impose requirements beyond those for other domain modifications.

⚠ TEAC (Transfer Emergency Action Contact): Gaining registrar must respond within 4 hours to TEAC requests for urgent hijack disputes.

AutoDNS API

## Transfer In
POST https://api.autodns.com/v1/domain/_transfer

{
  "name": "example.com",
  "auth": "(AUTH_CODE)",
  "ownerc": { "id": 23142212 },
  "adminc": { "id": 23142212 },
  "techc":  { "id": 23142212 },
  "nameServers": [
    { "name": "ns1.example.com" },
    { "name": "ns2.example.com" }
  ]
}

## Create AuthInfo1
POST https://api.autodns.com/v1/domain/example.com/_authinfo1

## Delete AuthInfo1
DELETE https://api.autodns.com/v1/domain/example.com/_authinfo1

## Request AuthInfo2 (certified mail)
POST https://api.autodns.com/v1/domain/example.com/_authinfo2