Latest revision as of 21:00, 6 March 2023

The Inter-Registrar Transfer Policy (IRTP) governs domain name transfers between ICANN registrars. The new provisions in the IRTP now specifically include changes to domain ownership (changes to the registrant). This means that any time a material change to a domain name registrant's first name, last name, or email address occurs, a sequence of authorizations, approvals, and possibly confirmation email notices are now required for registrant information to be modified. Please keep in mind that now even small changes to a domain name registrant's first name, last name, organization, and email address may trigger the validation process. This new policy takes effect on December 1, 2016.

[edit] How does the New IRTP Work?

Whenever a material change to a domain name's registrant first name, last name, or email address, as well as, in some cases, administrative contact email (if there is no registrant email) is made, three important new steps occur to successfully complete a change of registrant.

[edit] Authorization is Required

Authorization must be provided by both the old registrant entity and the new registrant entity or a designated agent for the respective old or new registrant. Failure to provide authorization from either party will cancel the change of registrant and all registrant information will not be changed.

a. The old registrant or its respective designated agent authorizes through a checkbox at the point of registrant change.

b. The new registrant or its respective designated agent authorizes through a checkbox at the point of registrant change.

c. Old or new registrant or their respective designated agent can explicitly authorize through an authorization email within fourteen (14) days sent by the registrar of record.

[edit] Sixty (60) Day Transfer Lock and Opting-Out

A successful change of registrant will immediately enable a sixty (60) registrar transfer lock on a domain name. The Old registrant or the respective designated agent must explicitly agree to remove (opt-out) the lock at the time of submission or through the authorization email.

a. The old registrant or its respective designated agent authorizes through a checkbox at the point of registrant change.

b. The new registrant or its respective designated agent can request opting out of the sixty day transfer lock through a checkbox at the point of registrant change triggering an authorization email to the old registrant, who then must accept opting out of the transfer lock a secured link.

c. Old registrant or its respective designated agent must explicitly accept opting out through an authorization email within fourteen (14) days sent by the registrar of record.

[edit] Notification and Confirmation by Email

After a successful change of registrant is processed, both the Old and New registrants are individually notified by a change of registrant confirmation email to their respective email addresses.

a. The old registrant can immediately contact their registrar if a change of registrant was not authorized.

b. Protection against domain theft.

[edit] What is a Designated Agent (DA) and Who Can Become One?

Registrants (old or new) can explicitly authorize an individual or entity to approve a change of registrant on their behalf. Though anyone or any entity can be a DA, explicit and verifiable authorization must be given. In practical terms, here are examples of a DA:

a. The registrar of record can be a DA (may be requested at submission or generally via updated Registrant Agreement) for either the old and/or new registrant.

b. A reseller can be a DA (may be requested at submission or generally via updated Registrant Agreement) for either the old and/or new registrant.

c. The new registrant can also be a DA for the old registrant (typically obtained from old registrant before a transfer of a domain to new registrant's registrar).

[edit] How Does this Policy Affect Me?

[edit] I am a Direct Customer (not a Reseller)

Starting December 1, 2016, it will no longer be possible to change the registrant of a domain name with a simple domain modification request. When making a material change to the registrant of a domain name, the following will occur:

1. Change of registrant is made through the Control Panel or via an API TradeDomain command
2. You or your designated agent can authorize a change of registrant
3. If you receive a Authorization for Change of Registrant email and you do not respond to this email within fourteen (14) days, the change of registrant request will expire and be cancelled.
4. Unless opt-ed out by the old registrant only, a change of registrant will result in a sixty (60) day transfer lock when completed.
5. A material change of registrant for a domain contact handle involving one or more gTLD domain names will be reflected on the Control Panel only, but will not be submitted to the registry (WHOIS data will not change).
6. If you receive a change of registrant confirmation email that you object to or were not expecting, please contact our support team immediately.

[edit] Change of Registrant Scenarios

[edit] I am a Reseller

Starting December 1, 2016, it will no longer be possible for your customers to change the registrant of a domain name with a simple domain modification request. Depending on your reseller platform and how you are connected to us, you must implement the following:

1. Resellers must update their terms of service and registrant agreement to reflect the new IRTP before or on December 1, 2016.
2. Resellers must add additional terms to their registrant agreement allowing them to act as Designated Agents on behalf of their customers.
3. Resellers submitting a material change of registrant requests as DA, upon request, shall provide verifiable documentation that they have obtained DA status from the respective registrant for a domain name.
4. Additonal effects on different types of resellers:

i. Control Panel Resellers with Sub-user Customers. Whenever your customer evokes a material change of registrant, an additional authorization notice will be presented to the sub-user at submission in the Control Panel, as described above in the "I am a Direct Customer and not a Reseller, how does this Policy affect me?" section.

ii. Control Panel Resellers Only. You have obtained verifiable DA status from them to act on behalf of the registrant of a domain name. This will allow the Reseller to submit a change of registrant request for their customer in the Control Panel.

iii.Module Resellers (WHMCS, AWBS, Plesk). You have obtained verifiable DA status to act on behalf of the new registrant of a domain name. Since the various module platforms have not updated in response to the IRTP, you are required to do the following:

• Login to the Control Panel and navigate to Reseller Controls > Product Settings > Domain Settings. Under the "gTLD Inter-Registrar Transfer Policy" section first read the terms, implement the legal changes, and finally verify your Designated Agent status and your wish to alter the ModifyDomain command for IRTP compliance.
• Whenever your customer evokes a material change of registrant, the Reseller must submit the change as the DA for the new registrant.
• The prior (old) registrant will always be sent an authorization email, and they will have fourteen (14) days to confirm the change.
• The opt-out of the sixty (60) transfer lock is enabled for module Resellers by default. However, if a Reseller wishes to opt-IN (disable the automatic opt-out) to the registrar transfer lock so that they can immediately process Change of Registrant requests with added security (for Change of Registrant when email addresses are not working), resellers can simply enable the checkbox stating "Disable the automatic opt-out. Registrant changes are processed in realtime, but domains will also get transfer-locked for 60 days. Dependant on fallback being enabled."

iv.API Resellers. You have obtained verifiable DA status to act on behalf of the new registrant of a domain name. The registrant or the DA must have obtained prior approval to act on behalf of the new registrant, therefore, the Reseller can then submit a TradeDomain command with the following three x-flag options:

• X-CONFIRM-DA-NEW-REGISTRANT = 1
• X-CONFIRM-DA-OLD-REGISTRANT = 0 or 1
• X-REQUEST-OPT-OUT-TRANSFERLOCK = 0 or 1

1. Your customers may receive a change of registrant authorization email in which they will have fourteen (14) days to approve and complete the change of registrant. Failure to confirm a change of registrant within this time will invalidate the transaction.
2. A material change of registrant for a domain contact handle involving one or more gTLD domain names will be reflected on the Control Panel only, but will not be submitted to the registry (whois data will not change).
3. If your customers receive a change of registrant confirmation email that they were not expecting or have were not aware of, please contact our support team immediately.

[edit] I am a Registrar Operations Center Client (RegistrarOC)

Starting December 1, 2016, it will no longer be possible for your customers to change the registrant of a domain name with a simple domain modification request. As a Registrar Operations Center client, please be aware of the following changes to the platform:

1. Registrars may want to update their terms of service and registrant agreement to reflect the new IRTP before or on December 1, 2016.
2. Registrars may want to add additional terms to their registrant agreement allowing them to act as Designated Agents on behalf of their customers.
3. Whenever your customer makes a material change of registrant to a domain name, first they must have obtained prior approval to act on behalf of the new registrant. Then a TradeDomain command can be submitted with the following three x-flags and options:
   • X-CONFIRM-DA-NEW-REGISTRANT = 1
   • X-CONFIRM-DA-OLD-REGISTRANT = 0 or 1
   • X-REQUEST-OPT-OUT-TRANSFERLOCK = 0 or 1
4. Your customers may receive a change of registrant authorization email in which they will have fourteen (14) days to approve and complete the change of registrant. Failure to confirm a change of registrant within this time will invalidate the transaction.
5. A material change of registrant for a domain contact handle involving one or more gTLD domain names will be reflected on the Control Panel only, but will not be submitted to the registry (whois).
6. If your customers receive a change of registrant confirmation email that they were not expecting or were unaware of, please contact us immediately.

[edit] API Documentation

A change of registrant must now be processed with a TradeDomain command for gTLDs starting December 1, 2016. The older ModifyDomain no longer works for registrant updates or changes.

[edit] New Parameters

Following new parameters are created for Change of Registrant:

• Designated Agent (DA) of the new registrant: X-CONFIRM-DA-NEW-REGISTRANT = 1
• Designated Agent (DA) of the old registrant: X-CONFIRM-DA-OLD-REGISTRANT = 0 | 1
• Opt-out of sixty (60) day transferlock: X-REQUEST-OPT-OUT-TRANSFERLOCK = 0 | 1

[edit] Command Option

Resellers have the option to change the behavior of the ModifyDomain command to make it work like TradeDomain in compliance with the new change of registrant policies. Reconfiguration of ModifyDomain for a reseller account may reduce the need to refactor or modify existing code.

To reconfigure ModifyDomain, login to the Control Panel and navigate to Manage Account > My Settings > Domain Settings. Under the "gTLD Inter-Registrar Transfer Policy" section first read the terms, implement the legal changes, and finally verify your Designated Agent status and your wish to alter the ModifyDomain command for IRTP compliance.

[edit] TRADEDOMAIN

Information

[COMMAND]

COMMAND = TradeDomain
DOMAIN = <DOMAIN>

REQUIRED

OWNERCONTACT0 = <CONTACT>
X-CONFIRM-DA-NEW-REGISTRANT = 1
X-CONFIRM-DA-OLD-REGISTRANT = 1

[RESPONSE]

DESCRIPTION = Command completed successfully; realtime domain trade succeeded
CODE = 200

[edit] STATUSDOMAIN

[COMMAND]

COMMAND = StatusDomain
DOMAIN = <DOMAIN>

[RESPONSE]

CODE = 200
DESCRIPTION = Command completed successfully
PROPERTY[STATUS][0] = ACTIVE
PROPERTY[STATUS][1] = clientTransferProhibited
...
PROPERTY[CURRENT-REGISTRANT-NAME][0] = ...
PROPERTY[CURRENT-REGISTRANT-ORGANIZATION][0] = ...
PROPERTY[CURRENT-REGISTRANT-EMAIL][0] = ...
...
PROPERTY[TRANSFERLOCK][0] = 1
PROPERTY[TRANSFERLOCK-EXPIRATIONDATE][0] = YYYY-MM-DD HH:MM:SS
PROPERTY[TRADE-TRANSFERLOCK-EXPIRATIONDATE][0] = YYYY-MM-DD HH:MM:SS
...

[edit] MODIFYDOMAIN

A removal of the transferlock via a ModifyDomain command is not possible for sixty (60) days after a successful change of registrant without the OPT-OUT option.

[COMMAND]

COMMAND = ModifyDomain
DOMAIN = <DOMAIN>
...

OPTIONAL

TRANSFERLOCK = 0

[RESPONSE]

CODE = 552
DESCRIPTION = Object status does not allow for operation; Change of Registrant TRANSFERLOCK in place until YYYY-MM-DD HH:MM:SS

[edit] TRADEDOMAIN with OPT-OUT

To avoid the sixty (60) day transferlock, you have the option to request the TradeDomain command with the additional parameter X-REQUEST-OPT-OUT-TRANSFERLOCK = 1. The activation of this parameter triggers an email. The old registrant will receive an email requesting the authorization of the change of registrant. This email have to be approved within fourteen (14) days to complete the TRADE request and avoid the sixty (60) days transferlock.

[COMMAND]

COMMAND = TradeDomain
DOMAIN = <DOMAIN>

REQUIRED

OWNERCONTACT0 = P-ABC123
X-CONFIRM-DA-NEW-REGISTRANT = 1
X-REQUEST-OPT-OUT-TRANSFERLOCK = 1

OPTIONAL

X-CONFIRM-DA-OLD-REGISTRANT = 0 | 1

[RESPONSE]

DESCRIPTION = Command completed successfully; trade pending - non-real-time
CODE = 200
PENDING = 1

[edit] Frequently Asked Questions - General

[edit] What is a "Material Change of Registrant" and will even a small change, like correcting a typo, trigger the new authorization and confirmation process?

The new ICANN transfer policy requires authorization if there are any changes to the registrant:

• first name
• last name
• organization name
• email address
• administrative contact email address, only if there is no registrant email address

Any change, even small changes, may require the authorization process to take effect. Keep in mind that small changes likely mean that the old registrant and the new registrant are the same individual (entity), therefore, authorization can be provided directly at the point of submission, as well as opting out of the sixty (60) day lock.

[edit] Who can initiate a change of registrant?

There are four entities that can submit a change of registrant. Either the old or new registrant can initiate the process through their respective registrars. Additionally, designated agents for either the old or new registrants can also initiate the change of registrant process on behalf of their registrant customer.

[edit] Who can confirm a change of registrant?

Both the old and new registrant must confirm. Designated agents for either the old or new registrants can also confirm on behalf of their respective registrant customer.

[edit] What if I am both the old and the new registrant?

Both the old and new registrant must confirm, therefore, the one registrant can authorize for both. This will bypass the authorization email process and automatically complete the change of registrant. Opting-out of the post sixty (60) day transfer lock at submission is recommended for this scenario, which will trigger an email to the old registrant email.

[edit] What happens if either the old or new registrant does not authorize?

If the old registrant does not authorize the change of registrant within fourteen (14) days, the domain name registrant information (whois data) will remain the same, that of the old registrant. The new registrant (or their DA) must always give authorization, which is obtained by the old registrant or their DA beforehand or automatically provided by the new registrant's DA at submission

[edit] What happens if the old registrant authorization is not received within fourteen (14) days?

The change of registrant request will be denied and a brand new change of registration request will have to be initiated.

[edit] What happens if the new registrant does not have access to their email address?

If the new registrant has a problem with their email, then simply resubmit using a new email address for the new registrant.

[edit] What happens if the old registrant does not have access to their email address?

If the old registrant's email is not working, then the old registrant or a designated agent of the old registrant needs to change the old email address first. As both the old and new registrant (or DA), please confirm for both and most importantly, DO NOT opt-out of the sixty (60) day transfer lock (conversely opting-out would trigger a transfer opt-out email to the old non-working email that can't be confirmed). Again, please note that after this change of registrant to a working email address, the domain name will be locked for sixty (60) days before it can be transferred to a new registrar.

[edit] What happens when a second change of registrant request is made before a prior one is yet to be completed?

The first request is cancelled.

[edit] After a change of registrant is completed, what happens?

Both the old and new registrant are notified by email that the change of the registrant has completed. A sixty (60) day transfer lock is applied unless it is opted-out by the old registrant at the time of submission or confirmed through a separate opt-out email.


[edit] If I purchase a domain through the aftermarket or privately and the prior registrant does not approve the change of registrant what happens?

Contact the aftermarket provider in case of such problems. However, for private domain purchases, you can ask for explicit approval from the old registrant that either you or your registrar be the old registrant's designated agent. This explicit and verifiable assignment as the designated agent of the old registrant will allow you or your registrar to confirm on behalf of the old registrant at the point of change of registrant submission.

[edit] Does this new transfer policy apply to country-code top-level domains (ccTLDs)?

No, it only applies to generic top-level domains (gTLDs) governed by ICANN.

[edit] How does this new policy affect domain names using WhoisTrustee privacy service?

Any domain using WhoisTrustee will only be affected if the underlying escrowed registrant data has a material change. Turning on or off privacy services does not change the registrant and therefore does not constitute a material change.

[edit] What happens if I change a contact handle that is bound to a gTLD domain name?

Any contact handle used by a gTLD domain name can be updated and changed locally. The changes are only on the local system and will not be submitted to the registry for registrant contacts. Domains from now on be individually modified through a change of registrant specifically for a single domain name.

[edit] Frequently Asked Questions - Resellers

[edit] How to Obtain Verifiable Designated Agent Status?

There are alternate ways for obtaining verifiable DA status from your customers. The one universal way we ask of our resellers and registrars is you update your terms of service and registrant agreement to reflect the new IRTP on or before December 1, 2016. The additional terms you are required to add will allow you (reseller or registrar) to act as Designated Agents on behalf of your customers. Also, recorded proof that you sent out notice to your customers of the changes to your registrant agreement is highly recommended.

[edit] What does the Change of Registrant Form on Control Panel Look Like?

[edit] What does the final Change of Registrant Notice to the OLD Registrant look like?

[edit] What does the final Change of Registrant Notice to the New Registrant look like?

[edit] What does the Change of Registrant Authorization Email to the Prior (OLD) Registrant look like?

[edit] Why is there no Authorization Email to the New Registrant?

A reseller MUST ALWAYS act as the designated agent of the new registrant, therefore no change of registrant authorization email is needed for the new registrant. Moreover, in terms of protection and security, the OLD registrant authorization is the single most important factor in completing the change of registrant, not the new one.

[edit] How do these Change of Registrant notice and the ICANN Registrant Verification emails work?