ICANN|ARCHIVES

Internet Corporation for Assigned Names and Numbers

Discussion Paper on Transfer of Sponsorship of Registrations Between Registrars

By Bruce Tonkin, Melbourne IT
27 August 2001

---

Discussion Paper on
Transfer of Sponsorship of Registrations Between Registrars

1. Existing Policy

The existing process is documented in Exhibit B (Policy on Transfer of Sponsorship of Registrations Between Registrars) of the ICANN Registry/Registrar License and Agreement (http://www.icann.org/nsi/nsi-rla-04nov99.htm).

The key elements of this process are as follows:

For each instance where a domain name holder wants to change its Registrar for an existing domain name (i.e., a domain name that appears in a particular top-level domain zone file), the gaining Registrar shall:

Obtain express authorization from an individual who has the apparent authority to legally bind the SLD holder (as reflected in the database of the losing Registrar).

a) The form of the authorization is at the discretion of each gaining Registrar.
b) The gaining Registrar shall retain a record of reliable evidence of the authorization.

Request, by the transmission of a "transfer" command as specified in the Registry Registrar Protocol, that the Registry database be changed to reflect the new Registrar.

a) Transmission of a "transfer" command constitutes a representation on the part of the gaining Registrar that:

(1) the requisite authorization has been obtained from the domain name holder listed in the database of the losing Registrar, and
(2) the losing Registrar will be provided with a copy of the authorization if and when requested.

In those instances when the Registrar of record denies the requested change of Registrar, the Registrar of record shall notify the prospective gaining Registrar that the request was denied and the reason for the denial.
Instances when the requested change of sponsoring Registrar may be denied include, but are not limited to:

1) Situations described in the Domain Name Dispute Resolution Policy
2) A pending bankruptcy of the domain name Holder
3) Dispute over the identity of the domain name Holder
4) Request to transfer sponsorship occurs within the first 60 days after the initial registration with the Registrar

In all cases, the losing Registrar shall respond to the e-mail notice regarding the "transfer" request within five (5) days. Failure to respond will result in a default "approval" of the "transfer."

Upon receipt of the "transfer" command from the gaining Registrar, the Registry will transmit an e-mail notification to both Registrars.
The Registry shall complete the "transfer" if either:

1) the losing Registrar expressly "approves" the request, or
2) the Registry does not receive a response from the losing Registrar within five (5) days.

When the Registry's database has been updated to reflect the change to the gaining Registrar, the Registry will transmit an email notification to both Registrars.

2. Problem

Two registrars have recently initiated changes to procedures that are restricting the ability of a gaining registrar to transfer a domain.

Following the email from the registry to a losing registrar seeking confirmation of a domain name transfer initiated by the gaining registrar, the losing registrars are contacting the domain name holder directly to seek confirmation within the 5 day window set by the registry. If the domain name holder DOES NOT RESPOND the losing registrar is denying the transfer on the grounds that there is a dispute over the identity of the domain name holder. This is a deviation from the spirit of the existing policy (note the registry assumes approval if the losing registrar does not respond within 5 days, and so it would be reasonable if the losing registrar assumed approval if the domain name holder does not respond within 5 days).

The emails sent by the registrars are generally confusing to the domain name holder (and in some cases in the wrong language), and it is typical for the domain name holder not to respond. The domain name holders assume that the transfer will go ahead as they approved through the gaining registrar, or the domain name holder has simply not had time to read and respond to the email.

The actions of the two registrars are causing serious customer service problems for the gaining registrars, and leading to dissatisfaction from the domain name holders.

The two registrars have initiated these procedures on the belief that many requests for transfer have not be properly authorized, or that domain name holders have not be properly informed of their own product offerings.

3. Discussion

The problem of transfers has recently reached a crisis point as many domain names registered at the time competition was introduced into ".com". ".net"., ".org" are coming up for renewal. Many registrars and resellers are pitching marketing campaigns at this large installed base of domain name holders. When a domain name holder chooses to renew a domain name with a different reseller or registrar, this usually results in the corresponding gaining registrar initiating a transfer of sponsorship of the domain name in the registry database.

The problem with the current policy is that process for authorization is left too open. When a domain name holder requests a transfer there is no specified method for authenticating the request. (ie "the form of authorization is at the discretion of the gaining registrar"). Some losing registrars believe that transfers are occurring without appropriate authorization, and want to ensure that the domain name holder has approved. The problem has been compounded by the view of losing registrars that the domain name holder was not appropriately informed of their choices at the time they made the decision. Thus some losing registrars are using the authorisation process as a last ditch opportunity to get domain name holders to change their minds.

The following sections will describe the perspectives of each of the parties involved.

3.1 Domain name holder perspective

The domain name holder is generally not concerned about the identity of the registrar provided that their domain name is renewed. For the domain name holder the issues of transfer of registrar is of far lower importance to transfer of ownership of a domain name. Thus the procedures required for transfer of registrar should be less onerous than transfer of ownership.

Often domain name holders purchase a bundle of services from a reseller or registrar of which the domain name is a small component of the service offering.

Given the availability of information about domain name holders in the WHOIS databases, domain name holders are often bombarded with material about domain name renewals when their name is close to the expiry date. Problems can occur when a person in an organisation that is not listed as either the administration or the technical contact, initiates a domain name renewal on the belief that the name will expire if they don't act quickly. Often this person is unaware of the full offering from their current supplier of domain names. In fact they may end up paying for the domain name renewal twice (once with their existing registrar as part of a service contract for a website etc, and once with the organisation offering a renewal service). In Australian a consumer alert was issued for this type of problem, where consumers were advised to check the conditions from their current supplier before accepting a new offer (http://www.auda.org.au/alert_resellers.html). ICANN may chose to create a similar consumer alert, and registrars and resellers should make their existing customers aware of this. IN a mature industry consumers will generally check with their existing supplier for a better deal, before accepting an offer from a new supplier. A gaining registrar should confirm the request for transfer with the current administration contact (with a copy to the technical contact), to ensure there is a single point of contact for domain name related issues. In many cases this will result in no response if the WHOIS contact information is out of date. In such cases the domain name holder would be requested to update their contact details in the WHOIS of their existing registrar, before the transfer process is initiated.

3.2 Reseller perspective

Resellers are often large organisations that provide a range of services to domain name holders. They choose to work through a registrar rather than create their own technical interfaces to the registry. Registrars compete to win business from resellers. When a reseller decides to transfer their business to another registrar, they will often continue to use their previous registrar for maintenance of existing domain names, and use the new registrar for registering new domain names and renewals of domain names. When a reseller processes a renewal on behalf of a domain name holder, the domain name holder may not be aware that this entails a change in registrar. The reseller should be responsible for informing the domain name holder of what is happening in this process, and be informed of the terms and conditions from the gaining registrar. Problems in this area may result in confusion from the domain name holder when contacted by the losing registrar to confirm the transaction. Thus the gaining registrar should ensure that the reseller has properly informed the domain name holder of the renewal and transfer process, and seek confirmation from the domain name holder (could be via the reseller in the appropriate language) before initiating the transfer.

3.3 Gaining registrar perspective

The gaining registrar seeks to have a process that is as automated as possible to reduce customer service costs. The process of authorization is left open in the policy (Obtain express authorization from an individual who has the apparent authority to legally bind the SLD holder (as reflected in the database of the losing Registrar). An appropriate process would be for the gaining registrar to seek authorization from the administration contact contained in the database of the losing registrar. The gaining registrar needs a process for authenticating that the request came from the domain name holder. A common approach used (for example to confirm that a person wishes to join a mailing list), is to send an email to the administration contact seeking confirmation. This would seem adequate for a transfer of registrar request. In future a more secure method would be available as part of developments in the IETF's provreg registry/registrar protocol working group where a registry key would be used to authenticate the domain name holder. A key issue here is that the contact information in a losing registrars database is often out-of-date. Thus where the information has changed (which could result in email bouncing or no response), the gaining registrar should ensure that the domain name holder updates the WHOIS information at the losing registrar before initiating the transfer. Problems occur when the gaining registrar obtains authorization from a person not listed in the losing registrars database. This often results in the losing registrar rightly disputing the identity of the domain name holder.

The lack of standards for WHOIS information amongst registrars also hampers the task of automating the transfer procedure, and the admin contact data is often stored in different formats.

3.4 Losing registrar perspective

The losing registrar is concerned that the domain name holder has authorized the transfer (to avoid domain name hijacking etc), and also that the domain name holder is making an informed choice. A losing registrar may also wish to know why a domain name holder has chosen to use a different supplier. The losing registrar has a 5 day window to respond to the registry. In this window of time it is often difficult to contact the domain name holder. Thus some losing registrars are seeking to deny a transfer request if they have not had time to contact a domain name holder. This makes the whole process unworkable. There is also a problem when a losing registrar tries to combine the authorization process with an attempt to win back the customer. Problems also occur when a gaining registrar or reseller contacts the domain name holder well in advance of the time when the losing registrar normally contacts a domain name holder to initiate a domain name renewal. When the domain name holder requests a transfer, the losing registrar feels that there was not an opportunity to inform the domain name holder of their choices.

An appropriate course of action is for the losing registrar to maintain regular contact with the domain name holder to keep the WHOIS records up-to-date, and keep the customer informed of domain name renewal offers. The losing registrar should separate the authorization process from the sales and marketing process. During the 5 day window to respond to the registry over a transfer, it would be appropriate for the registrar to attempt to contact the domain name holder (basically by way of notifying the domain name holder of the process). If no contact is established the losing registrar should approve the transfer. Following the transfer the losing registrar can continue to seek confirmation from the registrant and/or seek documentation from the gaining registrar. A full investigation should be the exception rather than the rule, and it would be appropriate to select some cases at random to audit. If process anomalies are identified the gaining registrar should have the opportunity to remedy the processes and/or reverse the transfer as appropriate. If agreement between registrars cannot be established, a dispute resolution process should be used to resolve the dispute. The registrars and ICANN should work to establish this dispute resolution process, and ensure that the outcome of the process is implemented by the registry operator.

4. Recommendations

• Losing registrars approve a transfer if no contact is received from the domain name holder within 5 days, while refinement of the authorization process is undertaken

• ICANN issue a consumer alert recommending that domain name holders fully consider any offers for domain name renewal and compare with their current arrangements (see http://www.auda.org.au/alert_resellers.html for an example)

• Gaining registrar to confirm authorization for transfer from the admin contact listed on the losing registrars WHOIS database with a copy of message provided to the technical contact. Gaining registrar to independently seek contact from administration contact as an authentication step (rather than rely on an email originating from the domain name holder - analogous to authenticating subscription to a mailing list)

• Domain name holder responsible for updating Admin WHOIS information in losing registrar WHOIS database if necessary before gaining registrar can initiate transfer

• Reseller responsible for informing domain name holder of change of registrar associated with a domain name renewal, and confirm acceptance of domain name holder of the gaining registrars terms and conditions

• Losing registrar to separate authorization process initiated by the gaining registrar from sales/marketing process

• Losing registrar entitled (but not required) to seek confirmation from the admin contact in the 5 days allowed by the registry. If no response is received, the losing registrar must approve the transfer (just as the registry must approve the transfer if no response from the losing registrar).

• Losing registrar entitled to continue to seek confirmation from a domain name holder and request copy of authorization from gaining registrar after the transfer is finalised. If the gaining registrar uses appropriate processes this should be the exception rather than the rule, otherwise the losing registrar could significantly impact the customer service costs of the gaining registrar. If anomalies found, gaining registrar responsible for correcting processes and/or reversing the transfer.

• ICANN to work with registrars to define a dispute resolution process between registrars for transfers. The registry required to implement the outcomes of such a process.

If the above recommendations are accepted by the registrar constituency, the next step is to seek support from the DNSO to alter the registrar license agreement to be more explicit about the authorization process, and establish a dispute resolution process for transfers. In this way a normal transfer can be conducted as intended by the current policy, which will encourage competition whilst ensuring consumer protection.