How a Domain Transfer Actually Works: Auth Codes, Escrow and the 60-Day Rule

The part everybody skips until it is happening

People spend weeks on finding the name and negotiating the price, then reach agreement and discover they have no idea what happens next. That is when the nerves arrive, because this is the point where money moves and the asset does not, yet.

The good news is that the mechanics are boring and well-defined. Every piece below exists because somebody was once defrauded and the system got patched. Understand the sequence and there is very little left to be anxious about.

The authorization code, explained properly

Every domain has an authorization code, also called an auth code, transfer code, or EPP code depending on who is talking. It is a string of characters generated by the registrar where the name currently lives, and it functions as proof that whoever holds it controls the domain.

That is the whole concept. It is a key. Whoever has the key can move the name, which is exactly why you should never post one publicly, email it to somebody you have not transacted with, or leave it sitting in a shared document.

Where it comes from

The current owner logs into their registrar, finds the domain, and requests the code. At most registrars it is two or three clicks. At some it triggers an email to the registrant address on file, which is where things stall if that address has not been valid since 2019.

The registrar lock

Separately, almost every domain sits behind a transfer lock, switched on by default. It is a safety feature that prevents anybody — including the legitimate owner, accidentally — from moving the name without deliberately unlocking it first. The seller has to turn it off before the transfer will go anywhere.

These two steps, the code and the lock, are the most common source of delay in an otherwise agreed deal. Not bad faith. Just a seller who has not logged into that account in three years and cannot remember which email it was under.

The 60-day rule that catches everyone

A domain generally cannot be transferred between registrars within 60 days of being newly registered, or within 60 days of a previous transfer. This is an ICANN-level rule, not a registrar preference, and no amount of urgency will move it.

Where it bites: you agree a purchase, and then discover the seller moved the name to a new registrar six weeks ago for unrelated reasons. You are now waiting a fortnight before anything can happen.

There is also a related trap. Changing the registrant contact details on a domain can trigger a 60-day transfer lock at many registrars. So a seller who helpfully updates their information to match the paperwork can accidentally freeze the name they just agreed to sell you. Ask before anybody edits anything.

Check this before you agree a closing date. One question — when was this name last transferred or registered? — saves a great deal of confusion later.

Escrow, and why you should insist on it

Escrow solves the oldest problem in any private sale: neither side wants to go first.

The buyer will not send money to a stranger who then controls whether the asset arrives. The seller will not release control of an asset to a stranger who then controls whether the money arrives. Escrow breaks the standoff by putting a neutral third party in the middle.

How it runs

1. Both parties agree terms and open an escrow transaction.
2. The buyer sends funds to the escrow service, not to the seller. The service confirms receipt to both sides.
3. The seller, now confident the money exists, unlocks the domain and releases the auth code.
4. The buyer initiates the transfer and confirms when the name lands in their account.
5. Escrow releases the funds to the seller.

Fees are modest and usually a small percentage of the transaction. Who pays is negotiable and should be agreed in advance, because arguing about a small fee at the closing table sours a deal that was otherwise done.

The red flag worth naming

A seller who refuses escrow on a meaningful purchase has told you something. Legitimate sellers welcome it, because it protects them exactly as much as it protects you. Be equally wary of a seller who insists on a specific escrow service you have never heard of and cannot find independently — fake escrow sites are a real and long-running category of fraud.

The actual transfer, step by step

1. Seller unlocks and supplies the code

Covered above. Nothing moves before this.

2. Buyer initiates at their own registrar

You go to the registrar where you want the name to live, choose transfer, enter the domain and the auth code, and pay the transfer fee. That fee usually includes a year of renewal added to the existing expiry, so it is not purely a cost.

3. Confirmation emails go out

Both registrars email the addresses on file. The gaining registrar asks the buyer to confirm. The losing registrar notifies the seller and, at many registrars, offers them an explicit approve button.

4. The waiting period

By default there is a five-day window during which the seller can cancel. If the seller clicks approve at their end, it typically completes far faster — sometimes within hours. It is always worth asking the seller to approve actively rather than letting the clock run.

5. It lands

The name appears in your registrar account. Check the expiry date and the contact details are yours before you tell escrow to release.

What to do in the first ten minutes after it lands

This is the part people celebrate through and then regret.

• Turn the registrar lock back on. It is off from the transfer. Leaving it off is leaving the door unlocked.
• Enable auto-renew and check the payment card. The most common way valuable names are lost is an expired card on an account nobody opens.
• Turn on privacy protection so your home address is not in a public database.
• Use a contact email that is not at the domain itself. If your registrar contact is at the name in question and DNS breaks, you have locked yourself out of the tools you need to fix it.
• Put the renewal date in a calendar you actually read. Not the registrar’s reminder. Yours.
• Point it somewhere. Even one page beats nothing. Hosting is covered here.

Buying from a registrar marketplace instead

Some names sell through a marketplace attached to a registrar. When both parties already hold the name at the same registrar, the transfer can be an internal account push rather than a full registrar-to-registrar transfer — which is faster and skips the auth code entirely.

The trade is that you pay a marketplace commission baked into the price, and you are negotiating through a platform rather than with a person. For a name with a published buy-now price and no negotiation needed, that convenience is often worth it.

For anything where the price is a conversation, going direct tends to serve you better. That is one reason every name in our portfolio is sold owner-direct with no auction layer and no platform commission sitting on top of the number.

A realistic timeline, end to end

• Day 0. Terms agreed in writing. Escrow opened.
• Day 0–1. Buyer funds escrow. Confirmation to both parties.
• Day 1–3. Seller unlocks and supplies the auth code. This is the step most likely to slip.
• Day 3. Buyer initiates the transfer at their registrar and confirms by email.
• Day 3–8. The transfer window. Faster if the seller approves actively.
• Day 8. Name lands. Buyer verifies, escrow releases, seller is paid.

Roughly a week when everyone is responsive. Add a fortnight if the 60-day rule applies. Add an unknown amount if the seller cannot find their registrar login, which happens more often than you would think.

When we sell you a name from the portfolio, the auth code goes out the same business day funds clear. What happens after that is registrar timing, which nobody controls — and we would rather tell you that up front than have you wondering on day four.

Who actually owns the name during all this

A point of confusion worth clearing up, because it changes how you think about the risk.

Nobody owns a domain outright and forever. What exists is a registration — a right to use the name for a period, renewable indefinitely so long as you keep paying and keep your details current. That is true of every domain on the internet including the ones worth millions.

The registrant of record is whoever the registrar has on file. During a sale, that is the seller right up until the transfer completes, which is precisely why escrow matters. Until the name lands in your account with your details on it, you do not control it, regardless of what has been agreed in writing.

The push, as an alternative

If buyer and seller happen to hold accounts at the same registrar, the name can often move by an internal account push instead of a full transfer. No auth code, no five-day window, frequently done in minutes.

The trade-off is that you now hold the name wherever the seller held it, which may not be where you want it. And the 60-day transfer lock usually applies afterward, so you are committed to that registrar for a while. For a fast, low-drama close it is excellent. If you have strong feelings about your registrar, take the slower route.

Getting the details right on your side

The transfer lands and the name is yours. Now the registration record needs to say so properly, and there are two ways people get this wrong in ways that hurt later.

Register it to the business, not to a person

If the name is a business asset, the registrant should be the business. Names registered under an individual employee’s personal account are a recurring and genuinely painful problem when that person leaves, and untangling it afterward is far harder than getting it right on day one.

Keep the contact details reachable

ICANN requires registrars to maintain accurate registrant data, and a registration with dead contact details can be suspended. More practically, an unreachable registrant address is how people lose control of names during a dispute or a recovery attempt. Use an address a real person monitors.

Consider who else can get in

If one person holds the only login to an account containing valuable names, that is a single point of failure. Multi-user access where the registrar supports it, or at minimum credentials stored somewhere the business can reach them, prevents a problem that is trivial to avoid and expensive to fix.

When a transfer goes wrong

Most do not. Here are the ones that do, and what they actually mean.

“Transfer denied”

Usually the lock is still on, the auth code is wrong or expired, or the 60-day rule applies. Codes can expire at some registrars, so if there has been a delay between the seller generating it and you using it, ask for a fresh one before assuming something worse.

Nothing happens for days

Often a confirmation email sitting unread in a spam folder, at either end. Both registrars send them and both need acting on. Check spam before escalating.

The seller goes quiet mid-transfer

This is exactly the scenario escrow exists for. Your money has not gone to them. Escrow services have dispute processes and timeouts, and funds return to you if the transaction does not complete. Uncomfortable, not catastrophic — provided you used escrow.

The name arrives but something is missing

The site files, the content, the email setup. This traces back to a vague agreement about what was included. Which is why the written terms should list every component explicitly, and why “and everything else” is not a term.

A short pre-close checklist

• Ask when the name was last registered or transferred, so you know whether the 60-day rule bites.
• Confirm in writing exactly what is included beyond the name itself.
• Agree who pays the escrow fee and the transfer fee.
• Verify the escrow service independently — do not follow a link the seller supplied without checking the domain yourself.
• Confirm the seller can actually access the registrar account before you fund anything.
• Agree a deadline and what happens if it passes.
• Have your own registrar account open and ready before you start.
• Check what the name was used for before you buy it. Here is how to check a domain’s history.

Ten minutes of this converts the scariest part of a domain purchase into paperwork. That is the goal — not excitement.

Buying from us: what the sequence looks like

Since this whole article is about mechanics, it is only fair to describe our own so you know exactly what you are walking into.

You call. Every deal starts with a conversation rather than a cart, because the right price depends on what you are building and a checkout page cannot ask that. You say the name and what it is for. We give you a figure and an honest read on whether it is even the right name.

We put the terms in writing. What is included, what it costs, who pays what, and the deadline. Short, specific, and it exists — because “what was included” is where most private domain deals turn sour.

You pay. Card or bank. For larger transactions, escrow, and we will suggest it without being asked. Nothing moves before funds clear, which protects you as much as us.

The auth code goes out the same business day funds clear. That is the one part of the timeline we control, so it is the one part we will commit to. Everything after it is registrar timing.

You initiate and it lands. Typically a few days for a .com. We will tell you if anything about the specific name — a recent transfer, an unusual registrar — is likely to slow that down, before you pay rather than after.

One difference worth naming: when you buy from the portfolio there is no third party in the middle. No auction premium, no marketplace commission sitting on top of the number, and no counterparty who can change their mind at day four. That is a meaningfully simpler transaction than buying from a stranger, and it is most of why people call rather than hunt.

If the name you want is not ours, the mechanics above are the same — but now there is a third party, and that is where our acquisition service comes in. Same transfer process at the end. Considerably more work in the middle.