Domain Transfer Process: EPP Code, Unlock & Confirm

Transferring a domain name from one registrar to another may look daunting the first time, but the process follows a well-defined sequence governed by ICANN standards. Every step — from obtaining your EPP Code to waiting for the confirmation email — is predictable once you understand the flow. This guide walks through each stage in detail so you can complete your domain transfer with confidence and minimal downtime risk.

Overview of the Domain Transfer Process

A domain transfer involves three parties working in concert: you (the domain owner), the Losing Registrar (your current provider), and the Gaining Registrar (the new provider you are moving to). The Registry — the authoritative body managing the TLD, such as Verisign for .com — mediates the actual change of record.

Here is the full sequence at a glance:

1. Pre-transfer checks — Verify domain age, WHOIS contact email, and privacy settings
2. Unlock the domain — Disable the Registrar Lock (Transfer Lock) at your current registrar
3. Obtain the EPP Code — Request the Auth Code from your current registrar
4. Initiate the transfer — Submit the domain name and EPP Code at the gaining registrar
5. Approve the FOA email — Confirm the transfer via the Form of Authorization email
6. Wait for completion — Allow 1 to 7 business days for the registry to process
7. Verify and update DNS — Confirm ownership in the new account and adjust nameservers if needed

Step 1 — Pre-Transfer Checks

Skipping this stage is the most common reason transfers get rejected or delayed. Before initiating anything, verify all three conditions below.

Check the 60-Day Lock Period

ICANN policy mandates a 60-day lock on any domain that was recently registered or recently transferred to a new registrar. During this period the domain cannot be transferred again. You can check the relevant dates via WHOIS:

whois yourdomain.com | grep -i "creation date"
whois yourdomain.com | grep -i "updated date"

If the Updated Date is less than 60 days ago, you must wait until the lock period expires before proceeding. Attempting a transfer during this window will result in an automatic rejection from the registry.

Verify Your WHOIS Contact Email

The Form of Authorization (FOA) confirmation email is sent to the registrant email address stored in WHOIS. If that address is no longer active — such as an old company email or a cancelled inbox — you will never receive the approval link and the transfer will eventually time out. Update the contact email at your current registrar before starting the transfer.

Check WHOIS Privacy Status

Many registrars replace your real email in WHOIS with a privacy proxy address when WHOIS Privacy is enabled. Make sure the proxy service is configured to forward emails to your actual inbox, or temporarily disable WHOIS Privacy for the duration of the transfer.

Step 2 — Unlock Your Domain

The Registrar Lock (also called Transfer Lock or clientTransferProhibited) prevents unauthorized outbound transfers. It is a security feature, not a restriction — but you must disable it before a transfer request can go through. Log in to your current registrar's control panel and look for a setting similar to "Domain Lock", "Transfer Lock", or "Registrar Lock".

Common Control Panel Locations

• GoDaddy: My Domains → select domain → Settings → Domain Lock → Off
• Namecheap: Domain List → Manage → Domain → Transfer Lock → Off
• Network Solutions: Account Manager → My Domain Names → Edit DNS → Lock Status
• Other registrars: Look under "Domain Management", "Security Settings", or contact support

After disabling the lock, wait 10 to 15 minutes for the registry to update the EPP status flag. You can verify the lock has been removed by checking the WHOIS output:

whois yourdomain.com | grep -i "status"

# Locked domain will show:
# Status: clientTransferProhibited

# Unlocked domain will NOT show clientTransferProhibited

Do not proceed to the next step until clientTransferProhibited has disappeared from the WHOIS output.

Step 3 — Obtain Your EPP Code (Auth Code)

The EPP Code — also known as the Authorization Code, Auth Code, or Transfer Secret — is a randomly generated alphanumeric string issued by your current registrar. It acts as a one-time password proving that the person initiating the transfer is the authorised domain owner. Without a valid EPP Code, the gaining registrar cannot submit a transfer request to the registry.

How to Get Your EPP Code

• Control Panel self-service: Most registrars provide a "Get Auth Code" or "Reveal Transfer Key" button in the domain settings page. The code is displayed on screen or emailed immediately.
• Automatic email delivery: Some registrars send the EPP Code directly to the WHOIS registrant email when you click an "Initiate Transfer" or "Request Auth Code" button.
• Support ticket: If neither option is available in the panel, open a support ticket with your current registrar. Provide your domain name and be prepared to verify your identity.

Important Notes About EPP Codes

• EPP Codes are case-sensitive — copy and paste them exactly rather than typing manually to avoid errors
• Codes typically expire after 7 to 30 days; request a new one if yours has expired
• Never share your EPP Code publicly — treat it like a password
• Some registrars send the code via SMS as an additional security measure; check all channels
• If the transfer is rejected citing an invalid auth code, request a fresh code — the old one may have been rotated

Step 4 — Initiate the Transfer at the New Registrar

With the domain unlocked and EPP Code in hand, navigate to the gaining registrar (such as AsiaGB) and locate the "Transfer Domain" or "Domain Transfer" section. Enter the domain name and your EPP Code, then proceed through checkout.

What the New Registrar Does Next

Once payment is confirmed, the gaining registrar submits a transfer request to the appropriate registry. The registry validates the EPP Code against its records and checks that no lock or restriction is in place. If all checks pass, the registry places the domain in a "Pending Transfer" status and triggers the FOA email to the WHOIS registrant address.

# Transfer lifecycle at the registry level:
# 1. Gaining registrar sends EPP <transfer op="request"> command
# 2. Registry validates EPP Code and checks for locks
# 3. Registry sets domain status to "pendingTransfer"
# 4. Registry sends FOA notification to registrant email
# 5. Registrant approves (or auto-approval fires after 5 days)
# 6. Registry sets domain to new sponsoring registrar
# 7. Transfer complete — registrant notified by both registrars

Transfer Pricing

Domain transfers are almost always bundled with a one-year renewal. You pay one year's renewal fee; in return, your domain's expiration date extends by one year and ownership moves to the new registrar. There is no separate "transfer fee" charged on top.

Step 5 — Approve the FOA Confirmation Email

Shortly after the transfer is submitted, you will receive a Form of Authorization (FOA) email at the address registered in WHOIS. This email contains a link to approve or reject the transfer. Clicking Approve accelerates the process significantly.

Three Possible Outcomes

• You click Approve: The transfer typically completes within 24 to 48 hours — often faster depending on how quickly the registry processes the approval.
• You take no action: After 5 days of inactivity, ICANN policy allows the registry to auto-approve the transfer. The domain moves to the new registrar without requiring explicit confirmation. Total time: up to 7 business days.
• You click Reject: The transfer is cancelled immediately. The domain stays at the current registrar. You would need to start the process over to try again.

Check your spam folder if the FOA email does not appear in your inbox within 30 minutes of initiating the transfer. Automated registry emails are occasionally filtered by spam systems.

Step 6 — Wait for the Transfer to Complete

After approval, the registry updates its authoritative records to reflect the new sponsoring registrar. Processing times vary by TLD and registry infrastructure:

• .com / .net / .org (Verisign): Usually completes within 24 to 48 hours of approval; maximum 7 business days per ICANN policy
• .co.th / .in.th (THNIC): 3 to 5 business days; subject to Thai registry business hours
• New gTLDs (.tech, .store, .io, etc.): 1 to 5 business days depending on the registry operator
• .uk / .de / other ccTLDs: Varies widely; check the specific national registry's published timelines

During this waiting period your website and email remain fully operational. The existing DNS records propagated by your current nameservers continue to resolve normally — domain ownership in the registry database is a separate concept from DNS. Only after the transfer completes and you choose to change nameservers will DNS behavior be affected.

Step 7 — Verify Success and Update DNS

Once the transfer completes, both registrars will send confirmation emails. Verify the transfer independently before making any DNS changes.

Verify via WHOIS

# Check which registrar currently sponsors the domain
whois yourdomain.com | grep -i "registrar"

# You should see the new registrar's name, e.g.:
# Registrar: AsiaGB
# Registrar IANA ID: <their IANA ID>

Verify via DNS Lookup

# Check current nameservers
dig NS yourdomain.com +short

# Or use AsiaGB's free tool:
# https://asiagb.com/dns-lookup.html

Updating Nameservers (If Required)

If you want to manage DNS at your new registrar, log in to the control panel and update the nameserver fields. If you are using a third-party DNS provider such as Cloudflare, you do not need to change nameservers — simply ensure the domain still points to those same external nameservers after the transfer, which it will by default unless you explicitly change them.

# Example: pointing to Cloudflare nameservers
# NS1: kyra.ns.cloudflare.com
# NS2: miles.ns.cloudflare.com
#
# These should remain unchanged through the transfer —
# only update them if you want to switch DNS providers simultaneously

Common Transfer Problems and Solutions

Most transfer failures trace back to one of a handful of known issues. Work through this checklist before contacting support:

• Rejected — Invalid Auth Code: Confirm you copied the EPP Code exactly (case-sensitive). If you are certain it is correct but still rejected, request a fresh code — the original may have expired or been rotated by the losing registrar.
• Rejected — Transfer Prohibited: The domain still shows clientTransferProhibited in WHOIS. Contact your current registrar to confirm the lock has been fully removed at the registry level, not just toggled in their UI.
• Rejected — 60-Day Lock: The domain was registered or transferred within the last 60 days. Calculate the exact unlock date from the WHOIS Updated Date and retry after that point.
• No FOA Email Received: Check spam and junk folders. Confirm the WHOIS registrant email is active and correctly configured. If the address is wrong, update it at the current registrar, wait for WHOIS to propagate, then restart the process.
• Transfer Stuck Beyond 7 Days: Contact the gaining registrar and ask them to check the EPP transfer status directly with the registry. They can escalate or re-submit the transfer request if necessary.
• Domain Expired During Transfer: Some registrars block outbound transfers for expired domains. Renew the domain at the current registrar first, then initiate the transfer once the domain is back in active status.

Frequently Asked Questions (FAQ)

What is an EPP Code and where do I get it?

An EPP Code (Extensible Provisioning Protocol Authorization Code), also called Auth Code or Transfer Key, is a secret password issued by your current registrar that proves you are the legitimate domain owner. You can obtain it from the Control Panel of your existing registrar, or by contacting their support team directly. EPP Codes typically expire after 7 to 30 days depending on the registrar's policy.

Why does a domain need to be unlocked before a transfer?

The Registrar Lock (Transfer Lock) is a security feature mandated by ICANN that prevents unauthorized domain transfers. Most registrars enable it by default when a domain is registered. If the lock is active, the gaining registrar cannot submit a transfer request and will receive a rejection error. You must disable the lock in your current registrar's control panel before initiating the transfer.

How long does the domain transfer process take?

For generic TLDs such as .com, .net, and .org, ICANN requires the transfer process to complete within 5 to 7 business days from the moment the gaining registrar submits a successful request. If you approve the FOA email promptly, the transfer can complete in as little as 24 to 48 hours. Country-code TLDs such as .co.th may follow different timelines governed by the respective national registry.

Will my website and email go down during a domain transfer?

No, your website and email will continue to function normally throughout the transfer process. The existing DNS records remain active until you change them after the transfer completes. The risk of downtime arises only after a successful transfer, if you have not yet configured DNS with the new registrar. Plan your DNS migration in advance to ensure a smooth cutover.