Back to blog

Transferring a Domain Between Registrars Without Downtime

The 60-day locks, the auth code, and the one ordering mistake that takes sites offline mid-transfer — a step-by-step migration runbook.

By Ops8/3/20265 min read
transferregistrardnsops

Registrar transfers are routine, reversible, and — done in the wrong order — capable of taking a production site offline for hours. The transfer itself is rarely the problem. The problem is that people treat "moving the registration" and "moving the DNS" as one step when they are two independent things.

1. Registration and DNS Are Separate

This is the whole post in one table:

Thing being movedWhat controls itDoes it affect uptime?
RegistrationThe registrar of recordNo
DNS hostingThe nameserversYes, immediately

Transferring registration from Registrar A to Registrar B changes who bills you and who holds the record. If the nameservers stay the same throughout, visitors notice nothing. Zero downtime is the default outcome, not something you have to engineer.

Downtime happens when the transfer silently resets nameservers to the new registrar's defaults — which have none of your records.

2. Preconditions That Will Block You

ICANN rules and registry policy impose hard locks. Check all four before scheduling anything:

LockDurationTrigger
New registration lock60 daysDomain first registered
Post-transfer lock60 daysPrevious transfer completed
Registrant change lock60 daysOwner contact details changed
Registrar lock (clientTransferProhibited)Until removedDefault on most registrars

The first three cannot be waived — you wait them out. The fourth you turn off yourself in the registrar's control panel.

Check your current status without logging in anywhere:

https://rdap.org/domain/example.com

Look at the status array. clientTransferProhibited means locked.

3. The Runbook

Before you start (day −1)

  1. Export every DNS record. Screenshot or export the full zone: A, AAAA, CNAME, MX, TXT, SRV, CAA. This is your rollback.
  2. Confirm registrant email is reachable. The approval email goes there. If it points at a dead mailbox, fix that first — and note that changing it may start a fresh 60-day lock.
  3. Verify the domain isn't expiring within 10 days. Renew first if it is; transfers near expiry frequently fail.

At the source registrar (day 0)

  1. Disable WHOIS privacy — many registrars block transfers while it's active.
  2. Remove the registrar lock.
  3. Request the auth code (also called EPP code or transfer secret). It's case-sensitive; copy, don't retype.

At the destination registrar

  1. Start the transfer and paste the auth code.
  2. Pay. A transfer includes one year of renewal added to your existing expiry — you don't lose remaining time.
  3. Set the nameservers to your current ones during setup, before the transfer completes. This is the step that prevents downtime.

Approval

  1. Approve the confirmation email. Do not ignore it — silence means the transfer completes on the ICANN clock (up to 5 days) instead of immediately.
  2. Optionally accelerate by approving the release at the source registrar too.

After

  1. Verify nameservers are unchanged: dig example.com NS +short
  2. Spot-check MX and TXT records survived.
  3. Re-enable WHOIS privacy.
  4. Re-enable the registrar lock.
  5. Confirm auto-renew is on — it does not carry over.

4. The Ordering Mistake

The failure is almost always this sequence:

transfer completes  ->  new registrar applies ITS default nameservers
                    ->  zone is empty at the new provider
                    ->  site and email go dark
                    ->  owner rebuilds records under pressure

Step 9 above is the fix: set correct nameservers at the destination before the transfer lands, so there is no window where the domain points at an empty zone.

If you also intend to move DNS hosting, do it as a separate change, at least a week apart, with TTLs lowered in advance. One variable at a time.

5. Cases Where You Should Not Transfer

  • Within 10 days of expiry — renew, wait, then transfer.
  • Mid-campaign or mid-launch — no upside, real downside.
  • .uk, .de, .au and similar ccTLDs — many use a different mechanism entirely (registrar tags, .uk's IPS tag) rather than auth codes. Read that registry's specific procedure.
  • When you only want cheaper renewal — check whether the transfer price plus effort actually beats staying put.

6. Rollback

Transfers can be reversed within 60 days by mutual agreement of both registrars, but it's slow and manual. Your real rollback is the zone export from step 1: if records get wiped, re-entering them takes minutes and propagates within your TTL.

That's why step 1 is step 1.

Summary

A registrar transfer is a billing change, not a network change. Keep the nameservers constant across it, set them at the destination before it completes, and hold your zone export in reserve. Done that way, the transfer is invisible to everyone but your accountant.

Comparing registrars first? The search page shows current pricing across several at once.