The Freename Forum

The Internet administration ICANN is planning a small revolution: on the recommendation of the Generic Names Supporting Organization (GNSO), the 60-day transfer lock is to be abolished. This would considerably speed up the possibility of transferring domain names with generic domain endings.

Anyone who has ever registered a .com domain and wanted to transfer it to another domain registrar immediately afterwards will certainly already be familiar with the “60-day change of registrant lock”. It is regulated in ICANN's “Transfer Policy”. Since December 1, 2016, every domain registrar must impose a transfer lock that prevents a domain from being transferred to another domain registrar if the domain holder data has been changed within the last 60 days. In practice, this problem often arises after a domain purchase if the buyer wishes to transfer the domain to his regular registrar after the successful transfer. The main purpose of the transfer lock is to prevent misuse of a domain and, for example, to move a stolen domain from one registrar to another within a very short time without the true owner being able to transfer it back. However, the transfer policy itself leaves open the possibility for domain registrars to shorten the 60-day period at the request of the domain holder. However, because this regulation is not applied uniformly, it repeatedly causes trouble.

The GNSO wants to prevent this in the future and has therefore proposed in its “Final Report on the Transfer Policy Review Policy Development Process” of February 4, 2025, after a long and intensive discussion, to delete the regulation without replacement. It came to the conclusion “that the 60-day lock following a Change of Registrant appears to be a greater source of registrant frustration than proven registrant security.” In addition, the reports of domain hijacking were not nearly as numerous as expected. Of 205 complaints received between September 2020 and October 2023 with the reference “Unauthorized Changes of Registrant”, 169 turned out to be “invalid”. Of a further 780 complaints alleging “Unauthorized Inter-Registrar Transfers”, 679 were “invalid”. The GNSO therefore considers the number of complaints to be relatively low, especially when set in relation to the number of domain names, the daily changes to domain holder data and the transfer of domain names from one registrar to another. The result is therefore clear: “Based on available data, it is not clear that the 60-day lock demonstrably reduces instances of domain hijacking.” Above all, however, the transfer lock does not prevent the domain holder's customer account from being hacked and the transfer being initiated from there; other methods such as multifactor authentication are more useful here.

The GNSO's recommendations will now be submitted to ICANN's Board of Directors for a final decision. It remains to be seen when a decision will be made there. Even if the recommendations are followed, ICANN is likely to plan a transition period of at least one year before the proposed changes come into force.

The “Final Report on the Transfer Policy Review Policy Development Process” can be found at:
https://gnso.icann.org/sites/default/fi ... pdf-en.pdf