Domain Transfer Security Checklist: 16-Item Guide to Safe Transfers

TL;DR

Before transferring your domain, backup all DNS records, lower TTL values, enable transfer lock until you're ready, and verify you have access to your admin email. There are 4 critical items that prevent domain hijacking. 8 more get you through the transfer smoothly, and 4 recommended items add extra security on top. After transfer, re-verify all DNS settings and enable domain lock at the new registrar.

Domain transfers feel routine until something goes sideways and your site is unreachable for days. A botched transfer can also open the door to domain hijacking if you're not careful. Give it an hour with this list and you'll skip the headaches that catch people off guard.

Quick Checklist (5 Critical Items)

Export and backup all DNS recordsScreenshot or export your DNS zone file before any changes

Verify admin email accessTransfer confirmations go to the admin contact email

Enable domain lock at new registrarTurn on registrar lock immediately after transfer completes

Enable two-factor authenticationSet up 2FA on your new registrar account

Verify DNS records at new registrarCheck all records transferred correctly and fix discrepancies

Pre-Transfer Preparation 4

Verify domain ownership and admin accessConfirm you can log into the current registrar and have authorization to initiate the transfer. How to verify domain ownership

Export and backup all DNS recordsScreenshot or export your DNS zone file. Document A records, CNAME, MX, TXT, and any other records. How to backup DNS records

Lower DNS TTL valuesReduce TTL to 300 seconds (5 minutes) at least 24 hours before transfer. This helps changes propagate faster. How to configure DNS TTL

Verify admin email accessTransfer confirmation emails go to the admin contact. Make sure you can receive emails at that address. How to update domain contacts

Security Before Transfer 4

Disable WHOIS privacy temporarily (if required)Some registrars require visible WHOIS data for transfers. Re-enable privacy after transfer completes. How to manage WHOIS privacy

Unlock the domain for transferRemove the registrar lock (also called transfer lock or domain lock) to allow the transfer to proceed. How to unlock domain for transfer

Obtain the authorization code (EPP code)Request the transfer auth code from your current registrar. Keep it secure and do not share publicly. How to get EPP code

Document current nameserver settingsNote your current nameservers. Decide whether to keep them or switch to the new registrar's nameservers. How to check nameservers

During Transfer 4

Initiate transfer at the new registrarEnter your domain and authorization code at the gaining registrar to start the process. How to initiate domain transfer

Confirm transfer via emailApprove the transfer request sent to your admin email. Check spam folders if you do not see it. How to confirm domain transfer

Monitor your site and email during transferWatch for any downtime or email issues. The transfer process should not cause outages if DNS is unchanged. How to monitor domain transfer

Do not make DNS changes during transferAvoid editing DNS records while the transfer is in progress. Wait until it completes. How to handle DNS during transfer

Post-Transfer Security 4

Verify DNS records at new registrarCheck that all DNS records transferred correctly. Compare against your backup and fix any discrepancies. How to verify DNS records

Enable domain lock at new registrarTurn on registrar lock to prevent unauthorized transfers. This is your first line of defense against hijacking. How to enable domain lock

Enable two-factor authenticationSet up 2FA on your new registrar account. Use an authenticator app rather than SMS if possible. How to set up registrar 2FA

Re-enable WHOIS privacyIf you disabled WHOIS privacy for the transfer, turn it back on to protect your contact information. How to enable WHOIS privacy

Why Domain Security Matters

Your domain is your identity on the internet. Lose control of it and someone can redirect your traffic, intercept your email, and pose as your business under your own name. Recovering customer trust after that takes weeks, if it comes back at all.

According to ICANN, domain disputes and hijacking cases increased by 22% between 2023 and 2025, and most of those attacks don't crack any encryption. They exploit weak account security or talk their way past registrar support.

How long does a domain transfer take?

Most domain transfers complete in 5 to 7 days. Some registrars offer expedited transfers that finish within hours if both parties confirm quickly. The ICANN-mandated waiting period can be waived if the losing registrar approves.

Can someone steal my domain during a transfer?

They can, if they get into your email or registrar account. Two-factor authentication on both accounts plus a domain lock closes off that route.

Will my website go down during the transfer?

Not if you do it right. Keep the same nameservers and DNS records and your site stays up the whole time. Nothing changes until you touch DNS settings.

TL;DR

Quick Checklist (5 Critical Items)

Pre-Transfer Preparation 4

Security Before Transfer 4

During Transfer 4

Post-Transfer Security 4

Why Domain Security Matters

How long does a domain transfer take?

Can someone steal my domain during a transfer?

Will my website go down during the transfer?

Related Articles

Production Launch Checklist

Pre-Deployment Security Checklist

How to Add SSL to Custom Domains

Scan Your Site After the Transfer

Domain Transfer Security Checklist: 16-Item Guide to Safe Transfers