Switching registrars is the cheapest insurance against lock-in — but one wrong step can take your site offline for days. Here's the operator's playbook for a zero-downtime domain transfer.

Your domain name is the one asset you can't afford to lose. Registrars get bought, renewals get jacked up, support gets worse — and suddenly "move my domain" lands on your to-do list. The good news: a registrar transfer is one of the safest operations in the infrastructure world, if you respect the order of operations. Get it wrong and your site, your email, and your DNS can go dark for days.

Here's the playbook.

Before You Touch Anything

Check the calendar. ICANN's transfer policy blocks transfers within 60 days of registration or a previous transfer. If you just bought or moved the domain, wait. Equally important: don't start a transfer within about two weeks of expiry. Transfers extend your registration by a year, but a failed transfer on an expiring domain is a special kind of pain — renew first, transfer later.

Unlock the domain. Registrars apply a transfer lock (often called "registrar lock" or "clientTransferProhibited") by default. Turn it off in your control panel. While you're in there, disable any WHOIS privacy shield temporarily if the new registrar needs to verify ownership details — you can re-enable it after.

Get the authorization code. The EPP/auth code is the password for your domain. Generate it at your current registrar. Treat it like a credential: it expires, and at most registrars it's single-use.

Verify your contact email. Transfer approval emails go to the domain's registrant/admin contact. If that address is an old inbox you never check, fix it first and wait for the change to propagate. A transfer stuck waiting on an email nobody reads is the most common failure mode there is.

The Part People Get Wrong: DNS

Here's the critical thing to understand: a registrar transfer moves your registration, not your DNS. Your nameservers stay exactly as they are unless you change them separately.

That means the safe move is to do nothing to DNS during the transfer. Keep your existing nameservers — whether they're your registrar's free DNS, Cloudflare, or your own authoritative servers — and change registrars underneath them. Visitors keep resolving your domain exactly as before.

If you also want to change DNS providers, make it a separate operation: migrate DNS first, wait 48 hours, then transfer the registrar. Or transfer first, wait a week, then move DNS. Two changes, two windows, one variable at a time.

One more trick from the operator's shelf: if a DNS cutover is planned, lower your TTLs to 300 seconds a day or two beforehand so stale records expire quickly.

Running the Transfer

Initiate the transfer at the new registrar and hand over the auth code. The new registrar sends a confirmation to your contact email, and the old registrar typically sends a "do you approve?" message too. Approve promptly — some registrars let you explicitly approve to finish in hours instead of waiting out the full five-day window.

Then: don't touch anything. DNS, email records, redirect rules — leave them alone until the transfer completes. "Pending" is normal; most transfers finish within five days.

After the Move: Verify Everything

  • Nameservers unchanged. Confirm your authoritative nameservers are exactly what they were before.
  • Expiry extended. A successful transfer adds one year to your registration. Check the new expiry date.
  • Re-lock the domain. Turn the transfer lock back on.
  • Auto-renew and payment. Set up auto-renew at the new registrar with a working payment method, and confirm the contact email is current.
  • Smoke-test. Visit the site, send a test email, and check your dig/WHOIS output for the domain.

Common Failure Modes

  • New registrar rejects the code — the auth code expired or was regenerated. Get a fresh one.
  • Approval email never arrives — stale contact email or an aggressive spam filter.
  • "Domain is locked" error — the transfer lock is still on at the old registrar.
  • Transfer stuck for days — the old registrar is silently holding it. Open a support ticket.
  • Site went down mid-transfer — someone changed nameservers during the move. Revert and wait.

Registrars occasionally drag their feet on outgoing transfers, since every departing domain is lost revenue. That's legal only within limits — if a transfer is wrongly denied, you can escalate under ICANN's policy. In practice, most go through cleanly once the checklist above is done.

The Takeaway

Moving a domain is cheap, routine, and entirely safe when DNS is left alone and the paperwork is done first. The five-day window feels long, but your site never notices — because the internet doesn't care who bills you for the name, only that the nameservers answer.

Do the prep, change one thing at a time, and verify after. That's the whole playbook.

Sources: ICANN, "Inter-Registrar Transfer Information" — https://www.icann.org/en/contracted-parties/accredited-registrars/resources/domain-name-transfers/inter-registrar-transfer-information