EPP Code and Domain Transfer Lock: A Practical Guide

You've sold a domain or want to move it from one registrar to another. You enter the domain in the new registrar's panel, click "Transfer," and a few minutes later you see this message: Transfer failed: Domain is locked or Invalid EPP code. Nothing happens, and support says "unlock it from your current registrar." The problem isn't in the new panel, and it isn't payment. The problem is two things: the transfer lock and the EPP code.

What exactly is an EPP code and where does it come from

An EPP code is a 6- to 32-character string that the domain's current registrar generates and acts like the domain's password. Without it, the new registrar isn't allowed to take the domain from the registry. For .com and .net domains, this code is issued by the Verisign registry; for .ir there's a similar mechanism at IRNIC, but its name and path are different, and often manual approval is required instead of a code.

You'll find the EPP code in the current registrar's panel, usually under Domain Settings or Security. Its label may be Auth Code, Authorization Code, or Transfer Secret. This code is sensitive: anyone who has it and also has access to the domain admin email can move the domain. Don't send it in support chat.

Why the lock is on by default

The transfer lock (Transfer Lock or ClientTransferProhibited) is enabled by default on all new domains. This is a deliberate decision, not an extra setting someone forgot about. Without this lock, anyone who gains access to the domain admin email could take the domain from you with a single transfer request. The registry also applies a second lock at its own level called ServerTransferProhibited, which you can't open from the panel.

So to transfer, you have to get past two layers: the registrar lock, which you open yourself, and the registry lock, which is only removed under special circumstances (e.g., a legal dispute). In 90% of cases, only the first layer is the issue.

The correct order of operations: why doing it out of order fails

The order matters, and most errors come from not following it:

1. In the current registrar's panel, unlock the transfer lock. The change takes effect immediately, but it may show up in WHOIS with a delay of a few minutes to a few hours.
2. Get the EPP code from the same panel and store it somewhere safe. Some registrars only show the code once.
3. Make sure the domain admin email (Registrant Contact) is accessible to you. The transfer confirmation goes to that email, not to the account email.
4. In the new registrar's panel, submit the transfer request and enter the EPP code.
5. Open the confirmation email and click the confirmation link. If you don't, the request expires after five days.

If you skip step 1 and go straight to step 4, the new registrar sends the request, the registry rejects it, and you just see a generic error. If you don't take step 3 seriously, the transfer stays in a pending state and is silently canceled after five days. Here's where people make a mistake: they think the confirmation goes to the account email. After five days, they find the domain is still with the old registrar and they never got a clear error either.

The 60-day window nobody tells you about

There are two time restrictions that are shown faintly in panels. First, a newly registered domain can't be transferred for 60 days. Second, a domain that has just been transferred can't be transferred again for 60 days after the previous transfer. If you registered the domain this month and want to move it, there's no shortcut; you have to wait.

A third restriction that's less well known: if you've just renewed the domain, some registries keep the transfer locked for up to 45 days. If you plan to sell the domain, do the transfer before renewing, not after.

What a transfer carries with it and what it doesn't

Don't underestimate this part. A domain transfer only moves the registration ownership. DNS records in most cases don't come with the domain, because DNS is usually hosted on the previous registrar's name servers. If you haven't changed the name servers to the new servers before the transfer, the site goes offline after the transfer.

The safe order is: first build and test the DNS records on the new infrastructure, then change the name servers, and finally do the transfer. If you want to do this without downtime, use ServerNet's enterprise solutions for DNS hosting and the destination infrastructure so the records are ready before you change the name server.

Don't forget MX and TXT records. If you have business email on Google Workspace or Microsoft 365 and you don't migrate the MX record, emails are silently lost after the domain transfer. This error is very common because the site comes up and nobody notices the email issue until days later.

A note about TTL

Before changing the name server, lower the TTL of important records to 300 seconds. If the TTL is set to 86400 seconds (one day), your change stays in resolver caches for up to 24 hours, and during that time some users see the old site and some see the new one. This situation is messy and hard to diagnose. Lower the TTL a day before the transfer, and raise it again once everything is stable.

When the transfer gets stuck: what to check

If the transfer request was rejected, instead of repeatedly contacting support, check these four things yourself:

• Check the domain's WHOIS status with whois example.com. If you see Status: clientTransferProhibited, the lock hasn't been opened yet.
• Make sure you didn't copy the EPP code with extra spaces. This is a silly but common mistake.
• Check the domain admin email in WHOIS. If it's an old or wrong address, fix it first.
• Check the registration date and the last transfer. If it's less than 60 days, wait.

For .ir domains, the path is different and often requires written approval and identity documents. If you have an Iranian domain, read the registrar's documentation before doing anything; the documentation and knowledge base usually has the exact steps for each extension.

Which approach should I choose

If your domain is with a registrar that has a usable panel and gives the EPP code in two clicks, do the transfer yourself. It's not hard and it's done in 5 to 7 days. If the domain is critical and several services ride on it (email, API, customer subdomains), or if the current registrar doesn't have a proper panel and its support doesn't respond, take the time and do the whole migration with a written checklist. In that case, it costs a few hours of work, but it reduces the risk of service downtime to almost zero.

One warning: never move the server at the same time as transferring the domain. If you do both at once and the site goes down, you won't know whether the problem is DNS, the new server, or a half-finished transfer. Separate these two tasks by at least a week.

If you're planning to launch a new site and haven't registered a domain yet, choose a name from the start that you won't need to transfer later. The guide on choosing a suitable brand domain name covers this initial decision and saves you trouble later. To register a domain, you can also start with domain registration.

Frequently asked questions

Where do I get the EPP code?

From the panel of the registrar the domain is currently with, usually under domain settings or security. Its label may be Auth Code or Transfer Secret. If you can't find it, open a ticket and ask for it; the registrar is obligated to send it to the domain admin email.

Why can't my domain be transferred?

There are three common reasons: the transfer lock hasn't been opened yet, less than 60 days have passed since registration or the previous transfer, or the domain is in an expired state. Use the whois command to see the exact status.

How long does a domain transfer take?

Normally between 5 and 7 days. If you click the email confirmation quickly, it may finish sooner. If you don't confirm, the request is automatically canceled after five days.

Will my site go down when I transfer the domain?

The transfer itself doesn't cause downtime. Downtime happens when you change the name server and the DNS records aren't ready on the new server. First build and test the DNS, then change the name server.