Netcraft started a bit of a panic with an ill-considered writing about a new ICANN ruling that if a registrar or domain owner doesn’t respond within five days to a request, the site can be transferred automatically. I noticed that Dorothea just wrote on it, as have others including Kottke. But as Kottke found out the ruling doesn’t make your domain as vulnerable as it would first seem.
How it would work: I’m right in the middle now of transferring four domains from Dotster to GoDaddy. I’ve initiated the appropriate requests and punched in the appropriate codes. The transfer hasn’t completed yet. Why? Because Dotster is known to be a problem when it comes to you moving your domains away from the company. They don’t seem to want to let them go.
In the past, any registrar could make it extremely difficult for you to transfer, until you finally give up and continue to pay them to maintain the domain registration–what amounts to legal and technical extortion.
However, now, registrars can’t drag their corporate feet. Unless a dispute occurs, the registrar must respond to a legitimate request from another registrar in five days, or the transfer automatically proceeds regardless. Not another person, a registrar. A registrar that is responsible for making sure that all the of the appropriate authorizations are in place to prevent someone from hijacking your site.
Now remember, a registrar has certain obligations they have to meet to continue being a registrar, including getting the appropriate authorizations in place to ensure that someone can’t steal your domains. Registrars that don’t quickly lose their registrar status, and whatever dubious transfer is initiated is terminated. If you want to move a domain, they have to contact the domain owner and inform them of the request, and ask the owner to respond either confirming or declining the move.
(I also had to provide a code to move a .info domain.)
Much of the hand waving on the part of registrars in this is let people know about this change, which is significant. It also highlights the reason the contact information for the domain has to be up to date (though you can use third-party companies now to hide your information from casual WHOIS users).
However, a great deal of the hand waving is marketing and registrar intimidation. By all means, lock your domains–extra precautions should help (but check out the policy for unlocking the domains, first, before you push that button). It’s more important, though, to ensure that your contact information for your domain contains an up to date email that will ultimately resolve to you, so you can dispute a domain request if one comes up unexpectedly. And to ensure that you’re given a timely reminder when your domain is about to expire.
Now, we’ll see if Dotster complies with this new ruling, because it’s fast approaching the time when it has to allow the transfer.