Transfer Authorization Code Policy
APPENDIX E – Transfer Authorization Code Policy in the ISOC-IL Registry⚓
In order to initiate a request to transfer the domain name management from one Registrar to another, the Transfer EPP request must include the Transfer Auth Code. This is of course after unlocking the domain. This requirement is mandatory for all Registrars working with ISOC-IL.
- Authorized users who can receive the code are: Managing Registrar, Domain's Registrant and Registry.
- The registrar must create a unique code for each domain.
- The code should be treated as a password, known only to those authorized.
- The code can be created by the Registrar himself or alternatively, by the domain's Registrant through a secure management interface.
- The code can be provided via the management interface, or by E-mail. Due to Data security, the code should not be transmitted "as is" in the Email. The Registrar can use a mechanism in which the recipient of the Email clicks on a certain link, and after verification, the code would be exposed to him.
- The Registrant may receive the code from the Registrar at any time he wishes.
- The Registrar will update ISOC-IL registry, about the code, by submitting an Update EPP request at the same time as it is sent to the holder.
- The Registrant may update the code at any time.
- In the Update request, the code is passed as SHA256 HASH that includes exactly 64 characters. On-line tools can be found on the Internet which performs calculation for SHA256, as well as built-in functions in the various programming languages.
- In the Transfer EPP request, the code is passed "as is" (not in SHA256 HASH format).
- The code is for a single use only. This means that if a Transfer request was sent to the registry containing the code, It will no longer be usable even if the request is denied.
- The Transfer Authorization Code length should be 6 - 20 characters, allowed characters are: a-z, A- Z, 0-9, _
- The code will be valid for 5 days following the update in the registry, from the day the request is approved, whether it is used or not.
- The code shall expire under the following circumstances:
- five days after the update of the code in the registry
- after submitting transfer request
- when reassign request is submitted
- deletion of a domain
- new code is received
- The Registry will not be able to provide the code since it does not store it
- In exceptional cases, in which the Registrar is unable to provide the code to the Registrant, the Registry shall issue a code on its own, and transfer a link to the code to the Registrant.
- After receiving the code, the Registrant passes it to the Gaining Registrar. The Gaining Registrar sends the EPP Transfer request with the code to the Registry.
- The Registry accepts the Transfer request with the code, and verifies it. If correct, the request will be accepted. As mentioned, the code is one-time use. If needed, the managing registrar will issue a new code.
- The above does not change anything in the process of the Transfer request handling. The number of days required to allow the losing Registrar to file a rejection or confirmation, stays as was.