Corg How Domain Transfers Work Technically: EPP Codes, Auth Codes, and Locks
How Domain Transfers Work Technically: EPP Codes, Auth Codes, and Locks
Every domain sale ends with a transfer — moving the domain from the seller’s registrar account to the buyer’s. The transfer process involves EPP authorization codes, registrar and registry locks, ICANN-mandated waiting periods, and email confirmations that must all align correctly. Understanding this process prevents costly delays that can derail deals and helps you troubleshoot problems when they arise.
EPP Authorization Codes
The EPP (Extensible Provisioning Protocol) authorization code — also called auth code, auth-info code, or transfer code — functions as the domain’s password. Each domain has a unique EPP code assigned by its current registrar. Without this code, a transfer cannot be initiated at the receiving registrar.
To obtain the EPP code, log into your current registrar’s control panel and navigate to the domain management section. Each registrar places the option differently: Namecheap puts it under Domain List > domain name > Sharing & Transfer. Dynadot shows it under My Domains > domain name > Auth Code. Porkbun displays it under Domain Management > Authorization Code. GoDaddy requires navigating to Domain Settings > Transfer domain away from GoDaddy.
Some registrars display the EPP code directly. Others generate a new code each time you request it and send it to your email. A few require you to explicitly request a transfer and generate the code as part of that process.
EPP codes are case-sensitive strings typically 8-32 characters long, containing letters, numbers, and special characters. Treat them as passwords — do not share them until you are ready to initiate the transfer, and only share them through the secure channel established by your escrow service (Escrow.com or Dan.com).
Registrar Lock and Unlock
Before initiating a transfer, the registrar lock (ClientTransferProhibited status) must be removed from the domain. This lock prevents unauthorized transfers and is enabled by default on most registrars.
Unlocking the domain is a separate action from obtaining the EPP code. On Namecheap, the lock toggle is on the domain management page. On Cloudflare, navigate to the domain’s Configuration tab. On Porkbun, the lock status appears on the main domain management page.
After unlocking, there may be a brief delay (minutes to hours) before the unlock propagates to the registry. Verify the unlock by performing an RDAP lookup (lookup.icann.org) and confirming that ClientTransferProhibited no longer appears in the status codes.
The Transfer Process Step by Step
Step 1 — Seller unlocks domain: Remove ClientTransferProhibited at the current registrar.
Step 2 — Seller obtains EPP code: Generate or retrieve the authorization code from the current registrar.
Step 3 — Buyer initiates transfer: Enter the domain name and EPP code at the receiving registrar’s transfer page. The receiving registrar sends a transfer request to the registry (Verisign for .com).
Step 4 — Email confirmations: Both the current registrar and the administrative contact on the domain receive transfer authorization emails. The administrative contact must approve (or at least not reject) the transfer. Most registrars auto-approve after 5 days if no action is taken.
Step 5 — Transfer completes: After approval (or the 5-day auto-approval period), the domain moves to the new registrar. A one-year registration extension is usually added, and a new ICANN 60-day transfer lock begins.
Total timeline: 5-7 days for standard inter-registrar transfers. Push transfers (between accounts at the same registrar) complete in minutes to hours.
Push Transfers vs. Standard Transfers
When buyer and seller use the same registrar, a push transfer (also called an account-to-account transfer) is faster and simpler. The seller pushes the domain directly to the buyer’s account at the same registrar. No EPP code is needed. No ICANN waiting period applies. Transfer completes in minutes to hours.
This is why many domain investors prefer to concentrate their portfolios at popular registrars like Dynadot, Namecheap, or GoDaddy — the ability to push domains quickly facilitates faster deal completion, which matters in competitive acquisition scenarios.
Dan.com’s integration with several registrars (including GoDaddy and Dynadot) enables automated push transfers when both buyer and seller are on supported registrars, further streamlining the process.
ICANN Transfer Restrictions
ICANN enforces a 60-day lock period after a new registration, a registrar-to-registrar transfer, or a registrant (owner) change. During these 60 days, the domain cannot be transferred to a different registrar.
This restriction affects domain flipping timelines. If you acquire a domain through an inter-registrar transfer and want to resell it, the buyer must wait 60 days before they can transfer it to their own registrar (unless you sell via push transfer at the same registrar, which is exempt from the inter-registrar transfer lock).
Common Transfer Problems
Expired EPP code: Some registrars expire EPP codes after 7-14 days. If the buyer does not initiate the transfer promptly, the seller must generate a new code.
Wrong administrative email: Transfer confirmation emails go to the administrative contact in the WHOIS/RDAP record. If that email address is outdated or inaccessible, the transfer stalls. Update administrative contact information before initiating any transfer.
Domain status issues: Domains in redemption period, pending delete, or with ServerTransferProhibited status cannot be transferred. Resolve the status issue before attempting the transfer.
For more on protecting domains during the transfer process, see domain registrar security guide. To understand the lock mechanisms in detail, read domain locking strategies.