InvisibleHosts
← Back to knowledgebase

Prepare a domain transfer: EPP, lock and DNS checklist

A detailed transfer runbook covering eligibility, authorization, DNS continuity, email dependencies and post-transfer security.

Separate registrar, DNS and hosting

The registrar controls registration, DNS tells users where services are located, and hosting stores the website or application. Moving registration does not move files, databases or mailboxes.

Confirm eligibility

Registry rules can restrict transfers shortly after registration, a previous transfer or certain registrant changes. Expired, disputed or redemption-state domains may need a different recovery process.

  • Confirm spelling and extension
  • Verify active registration
  • Resolve registrar charges
  • Check recent-transfer restrictions
  • Confirm there is no dispute or registry lock

Verify registrant access

Approval messages may go to the registrant contact. Confirm that its email works. WHOIS privacy can mask public data without changing the underlying account contact.

Unlock and obtain the EPP code

Disable transfer lock only when ready. Request a fresh EPP or auth code and enter it only in the encrypted portal form. Never place it in a public form or ordinary email.

Inventory DNS

Export every record where possible, including website, API, mail, verification, DKIM, DMARC and subdomain records. A transfer normally preserves nameservers, but missing access or an accidental change can still interrupt service.

Protect email

Document MX, SPF, DKIM and DMARC. Do not cancel the old registrar or DNS service until transfer and DNS checks finish. Mailbox migration is separate.

Submit and monitor

Registry and registrar processing can take several days. A pending state is not automatically an error. Watch for approval or rejection messages.

Common rejection causes

  • Incorrect or expired EPP code
  • Transfer lock enabled
  • Eligibility restriction
  • Inaccessible registrant email
  • Expiry or redemption status
  • Registry, abuse or dispute lock

After completion

Confirm the registrar, renewal date, registrant data, nameservers and DNSSEC. Re-enable registrar lock and remove stale DS records if signing changed.