ICANN IRTP Update: New Changes to Domain Transfers

On December 1, 2016, changes to ICANN’s Inter-Registrar Transfer Policy (IRTP) will go into effect.

Changes to ICANN’s Inter-Registrar Transfer Policy (IRTP), the policy governing how domains are transferred between registrars and registrants, will go into effect on December 1, 2016.

The ICANN IRTP, the policy governing how domains are transferred between registrars and registrants, will be updated on December 1, 2016. The main goal of the change is to enhance the security of domain name ownership by preventing domains from being transferred immediately after an ownership information update.

Under the current iteration of the IRTP, domains can be easily transferred, with no restrictions in place.

1. A domain owner’s account with his/her domain registrar is compromised by online criminals.
2. Online criminals update the domain name’s ownership information such as updating the administrative email address.
3. Once the domain’s ownership details have been altered, a third-party is then able to transfer the domain to another registrar, thus putting out of reach of the original owner and registrar to easily recover.

The changes to the IRTP now requires two-way verification for changes in the registrant to prevents unauthorized changes. Additionally, a 60-day domain transfer lock immediately goes into effect to prevent unauthorized transfers from taking place.

While the new rules helps mitigate the likelihood of domain ownership theft, it also presents several new challenges such as:

1. Registrant/ownership information updates require two-way consent
2. Domain names are immediately locked for 60-days after registrant information is updated.

While it’s perfectly reasonable to gain consent from both the gaining and losing registrants, it becomes problematic when there is no distinction between significant and minor updates. In ICANN’s eyes, assigning a new owner or updating an email address are all considered as material changes.

For example, ICANN considers updating an email address and an actual ownership change to be the same. In the case of the former, it can make obtaining consent from “both” parties practically impossible.

What this means for Webnames.ca Customers

For our customers, we’ve updated our systems to make the process as easy as possible. As your domain registrar, we already follow domain security best practices so very little of the process has changed. The only notable new step is the 60-day transfer lock period that applies once registrant information is updated.

Transferring Domain Names

As mentioned earlier, transferring domain names between owners remains relatively the same. Before initiating a transfer, make sure that your domain name’s admin contact details are up-to-date and accurate via a WHOIS lookup.

1. The gaining registrant initiates a transfer request at Webnames.ca
2. A confirmation request will be sent to the gaining registrant’s email address.
3. A confirmation request will then be sent to the losing registrant’s email address.
4. NEW: the losing registrant may opt out of the 60-day lock period.
5. Once transfer approval from both parties has been received, the request is sent to the respective registry. The transfer will then be completed in minutes.

Note: If the losing registrant does not opt out of the 60-day transfer lock period, the gaining registrant will be unable to transfer the domain to another registrar for 60 days.

Updating Contact Information of a Registrant

ICANN has created a labyrinth of compounding rules regarding what are considered as material changes in contact and ownership information. To simplify the whole process, Webnames.ca will treat all contact information updates as “material changes.”

In addition to simplifying the process, ICANN has also allowed the use of designated agents to verify registrant updates. As a domain registrar, Webnames.ca offers our customers the option to use us as  your designated agent.

Doing so allows us to approve and verify registrant changes on your behalf. This becomes necessary when old registrants contact information is no longer viable – such as changing street addresses or changing an email.

In addition to approving updates, Webnames.ca can also:

• Grant approval of contact information updates
• Enter any necessary agreements on behalf of the new registrant
• Opt out of any domain locks which prevent transferring domain names to another registrar for a period of 60 days.

Updates to Webnames.ca Terms and Conditions:

Here’s what we’ve added to our Terms, and what is also presented when updating the contact information of a Registrant:

Terms

(a) Pursuant to the ICANN Transfer Policy, which considers certain changes to registrant contact details as “Changes of Registrant”, you explicitly authorize Webnames.ca as your temporary Designated Agent for facilitating and approving any Changes of Registrant that you request, and opting out of any inter-registrar transfer locks on your behalf. This does not provide expressed or implied authorization for Webnames.ca Inc to act as your Designated Agent in any other future capacity.

On page when updating Registrant Contact Information

^* By clicking this button you agree to name Webnames as your temporary Designated Agent for this update of Registrant Contact Information and for opting out of any inter-registrar lock, as governed by ICANN’s Transfer Policy and Webnames’s Supplementary Agreement for ICANN Top-Level Domain Names. This agreement ends after the contact update and does not apply in the future.

To save these changes to your Registrant info, we require consent from the parties represented by both the old and the new contact information. In some cases, the old and the new information represents the same person, and in some other cases consent via the old information is no longer possible. To get around all of this, Webnames is asking for you (the Registrant) for your prior consent to act as your Designated Agent so that we may provide the required consent on your behalf.

Webnames WHOIS Privacy

Because the enabling (or disabling) of WHOIS Privacy Services results in the changing of Registrant contact information, as is it displayed publicly in a WHOIS lookup), this enabling or disabling is also considered under ICANN’s IRTP-C to be a ‘material change’, and requiring the same consent from both ‘old’ and ‘new’ parties before taking effect.

For the same reasons as with performing an update to Registrant information, Webnames will utilize the previously consented role of Designated Agent to approve the changes that are the result of enabling or disabling Registrant WHOIS Privacy.

Here’s what we’ve added to our Privacy Terms, and what is also presented when enabling or disabling Privacy:

1. j) Enabling and Disabling of Privacy Service: Webnames.ca Inc., the Registrar for your domain name, is governed by the ICANN Transfer Policy, which considers certain changes to Registrant Contact Information, including those changes which occur when enabling or disabling the Privacy Service offered by WSI, to be “Changes of Registrant”. Therefore, in order to enable and/or disable the Privacy Service:
2. You explicitly authorize Webnames.ca Inc. to act as Your Designated Agent for facilitating and approving on Your behalf any Change of Registrant required, and
3. You explicitly authorize Webnames.ca Inc. to act as Your Designated Agent for opting out of any inter-registrar domain transfer locks on Your behalf.

The authorization granted to Webnames.ca Inc.to act as Your Designated Agent is limited strictly to the enabling and/or disabling of the WSI Privacy Service, and does not provide expressed or implied authorization for WSI to act as a Designated Agent for any other purpose or in any other capacity.