Domain Transfer Security Checklist: 16-Item Guide to Safe Transfers

TL;DR

Before transferring your domain, backup all DNS records, lower TTL values, enable transfer lock until you are ready, and verify you have access to your admin email. 4 critical items prevent domain hijacking, 8 important items ensure smooth transfer, and 4 recommended items provide extra security. After transfer, re-verify all DNS settings and enable domain lock at the new registrar.

Quick Checklist (5 Critical Items)

Export and backup all DNS recordsScreenshot or export your DNS zone file before any changes

Verify admin email accessTransfer confirmations go to the admin contact email

Enable domain lock at new registrarTurn on registrar lock immediately after transfer completes

Enable two-factor authenticationSet up 2FA on your new registrar account

Verify DNS records at new registrarCheck all records transferred correctly and fix discrepancies

Pre-Transfer Preparation 4

Verify domain ownership and admin accessConfirm you can log into the current registrar and have authorization to initiate the transfer. How to verify domain ownership

Export and backup all DNS recordsScreenshot or export your DNS zone file. Document A records, CNAME, MX, TXT, and any other records. How to backup DNS records

Lower DNS TTL valuesReduce TTL to 300 seconds (5 minutes) at least 24 hours before transfer. This helps changes propagate faster. How to configure DNS TTL

Verify admin email accessTransfer confirmation emails go to the admin contact. Make sure you can receive emails at that address. How to update domain contacts

Security Before Transfer 4

Disable WHOIS privacy temporarily (if required)Some registrars require visible WHOIS data for transfers. Re-enable privacy after transfer completes. How to manage WHOIS privacy

Unlock the domain for transferRemove the registrar lock (also called transfer lock or domain lock) to allow the transfer to proceed. How to unlock domain for transfer

Obtain the authorization code (EPP code)Request the transfer auth code from your current registrar. Keep it secure and do not share publicly. How to get EPP code

Document current nameserver settingsNote your current nameservers. Decide whether to keep them or switch to the new registrar's nameservers. How to check nameservers

During Transfer 4

Initiate transfer at the new registrarEnter your domain and authorization code at the gaining registrar to start the process. How to initiate domain transfer

Confirm transfer via emailApprove the transfer request sent to your admin email. Check spam folders if you do not see it. How to confirm domain transfer

Monitor your site and email during transferWatch for any downtime or email issues. The transfer process should not cause outages if DNS is unchanged. How to monitor domain transfer

Do not make DNS changes during transferAvoid editing DNS records while the transfer is in progress. Wait until it completes. How to handle DNS during transfer

Post-Transfer Security 4

Verify DNS records at new registrarCheck that all DNS records transferred correctly. Compare against your backup and fix any discrepancies. How to verify DNS records

Enable domain lock at new registrarTurn on registrar lock to prevent unauthorized transfers. This is your first line of defense against hijacking. How to enable domain lock

Enable two-factor authenticationSet up 2FA on your new registrar account. Use an authenticator app rather than SMS if possible. How to set up registrar 2FA

Re-enable WHOIS privacyIf you disabled WHOIS privacy for the transfer, turn it back on to protect your contact information. How to enable WHOIS privacy

Why Domain Security Matters

Your domain is your identity on the internet. If someone gains control of your domain, they can redirect your traffic, intercept your email, and impersonate your business. Domain hijacking can destroy customer trust and take weeks to recover from.

According to ICANN, domain disputes and hijacking cases increased by 22% between 2023 and 2025. Most successful attacks exploit weak account security or social engineering against registrar support.

How long does a domain transfer take?

Most domain transfers complete in 5 to 7 days. Some registrars offer expedited transfers that complete within hours if both parties confirm quickly. The ICANN-mandated waiting period can be waived if the losing registrar approves.

Can someone steal my domain during a transfer?

Domain hijacking is possible if attackers gain access to your email or registrar account. Enable two-factor authentication on both your email and registrar accounts, and use domain lock features to prevent unauthorized transfers.

Will my website go down during the transfer?

Not if you do it correctly. As long as you keep the same nameservers and DNS records, your site should stay up throughout the transfer. The change is administrative only until you modify DNS settings.

TL;DR

Quick Checklist (5 Critical Items)

Pre-Transfer Preparation 4

Security Before Transfer 4

During Transfer 4

Post-Transfer Security 4

Why Domain Security Matters

How long does a domain transfer take?

Can someone steal my domain during a transfer?

Will my website go down during the transfer?

Related Articles

Production Launch Checklist

Pre-Deployment Security Checklist

How to Add SSL to Custom Domains

Scan Your Site After the Transfer

Domain Transfer Security Checklist: 16-Item Guide to Safe Transfers