My issues with GoDaddy's 60-day contact policy

So in August I updated my contact information because I changed my primary email address from rohan@rohan.ws to rohan@rohansheth.com

When I wanted to confirm the update I had to click a little box in order to continue.  However, the little box invoked the following ICANN policy:

Express written objection to the transfer from the Transfer Contact.
(e.g. - email, fax, paper document or other processes by which the
Transfer Contact has expressly and voluntarily objected through opt-in
means).

Source: http://www.icann.org/transfers/policy-12jul04.htm

So when I went to transfer my domains in September, I was interested to see that GoDaddy kept rejecting the transfer.

I sent the following email to Godaddy's Support:

Hello,

GoDaddy Customer Number: XXXXXXX

I recently (August 29th) changed my domain’s contact information and at
that point I was required to check a box stating that I would not be
able to transfer my domain for a further 60-days after that period.

This 60-day GoDaddy hold is based on ICANN’s transfer policy below:

Express written objection to the transfer from the Transfer Contact.
(e.g. - email, fax, paper document or other processes by which the
Transfer Contact has expressly and voluntarily objected through opt-in
means).

Source: http://www.icann.org/transfers/policy-12jul04.htm

As the check box as not voluntary I had no choice but to agree with your
60-day hold, even though it is not adhering to ICANN’s policies.

I hereby revoke any such “voluntary opt-in” and request that my domains
be released from their 60-day hold as soon as possible.

Thanks,
Rohan Sheth

I got the following reply:

    Dear Rohan Sheth,

    Thank you for taking the time to email us.

    According to GoDaddy policy the domain cannot be transferred until 60 days has past since the last registrant contact change. This is stated in our legal agreements. You will find the relevant part of this agreement quoted below.

    —–

    Rejections may include, but are not limited to: The current Registrar rejected the transfer. The original registration took place less than sixty (60) days prior to the transfer request. The domain name has been placed in a locked status by either the Registry or by the losing registrar. The domain was transferred to Go Daddy less than sixty (60) days prior to the transfer request. The domain name expired but was not renewed. The domain name expired and was renewed during the forty-five (45) day grace period, and the forty-five (45) day grace period has not yet passed. The Domain Name Registrant was changed less than sixty (60) days prior to the transfer request. Any pending bankruptcy of the current domain name holder. Any dispute over the identity of the domain name holder. Any situation described in the Dispute Policy. Transfer orders over thirty (30) days old.

    We apologize for any inconveniences this may cause. Please let us know if we may be of further assistance.

    Regards,
    Josh P.
    Customer Care Specialist

I found this limitation ridiculous and was forced to wait out the time period before transfering away.

I now hold all of my domains at moniker.com.  They have decent rates and do a pretty good job of keeping me happy.  Their technical support is no where near as fast (usually 1 business day turnaround on an email) but otherwise I am satisfied.

Hi Rohan,

This "60 day" policy is not one that is allowed under ICANN rules.  I've seen this happen before with GoDaddy.  When domain owners contact them and can quote to rules, this restriction goes away.

You'll find the rules governing transfers at the following URL (section 3).  You'll note, under the reasons a registrar can deny a transfer, having made a contact change within 60 days does not appear.

http://www.icann.org/transfers/policy-12jul04.htm

Whenever you have an issue where a registrar is not playing by the rules, it's a good idea to file a complaint with ICANN.  This can be done at:

http://www.internic.net/cgi/registrars/problem-report.cgi

Cheers,

Doug.

Thanks Doug, I'll be sure to remember that if this sort of thing ever happens again.  I'm sure that many people would benefit from knowing that GoDaddy is not the end of the road when it comes to rules...and that they have other options or audiences they can go to for help.

You're most welcome Rohan!

Whenever dealing with a registrar that's being difficult, once they know you know your rights they will generally stop being difficult and release your domain.  Posting the complaint with ICANN usually helps as well.

Having been an account holder and reseller for years with GoDaddy, I assumed that this was standard practice.

Several months ago during a sale, I pointed this out to the potential buyer as being unable to transfer due to the 60 day issue. He said it was hogwash, was a former GoDaddy account holder, and explained how to get around it.

It worked.

So why do the adopt such a policy?

You can only speculate, but every domain that doesn't get transfered out potentially gets renewed & sold other services down the road....  Domains that do get transfered out likely won't get transfered back.

He said it was hogwash, was a former GoDaddy account holder, and explained how to get around it.It worked.

Would you describe "how to get around it"?  I have more than an academic interest in this, as I tried to transfer six domains today, and GoDaddy rejected 2 of the transfers, claiming that I had "voluntarily objected through opt-in means" to the transfer.  It is not voluntary if they force me to check the box in order to change the registrant to the legal owner.  If you can describe step by step what you did, that may help everybody with tis problem.

To get around this, do the following.

1. Go to http://www.internic.net/cgi/registrars/problem-report.cgi and file a complaint with ICANN.  This will get forwarded 1. within a day to GoDaddy.

2. Review this thread http://forums.nodaddy.com/index.php/topic,8.msg16.html on this forum so you have a good understanding of the rules adopted by ICANN in 2004.

3. Call GoDaddy's support, and tell them that they are breaking ICANN rules by denying your transfer, and demand that they release the locks on your domains and provide you with the EPP auth codes.

4. Contact the compliance dept. of the registrar you're transferring to and have them put some pressure on GoDaddy to behave.  Once you've confirmed that your domains have been unlocked, the registrar you're transfering to will need to resubmit the transfer requests.

5. Watch your email for the admin address your domains are pointing to, and confirm the transfers as soon as you receive the request email.

In my experience, when we've done this with a client, the transfer has come through on the next resubmission.

Good luck & let us know how you make out!

Doug.

I went through all this a little over a year ago.  I don't recall being forced to "voluntarily" provide written notification, so I'm guessing that this was their attempt to continue with the 60-day policy after being called on it a few times.

In my case I tried to transfer three domains to another registrar.  One went through.  The other two were rejected due to completely made up reasons.  One was rejected because "The domain was recently transferred to GoDaddy.com. For security purposes, it may not be transferred again for 60 days.".  The other was rejected because "Express written objection to the transfer from the Transfer Contact. (e.g. - email, fax, paper document or other processes by which the Transfer Contact has expressly and voluntarily objected through opt-in means)."  Again, neither was true.  It's as though they chose two of the valid reasons ICANN policy allows for at random.

Just out of curiosity, if their software was intentionally designed to send out a false reason, would that be fraud?  Are there any lawyers who could answer that?

I had to call the office of the president and threaten to contact ICANN.  After way too much time on the phone they ultimately relented.

But GoDaddy has demonstrated that they are dishonest.  I wish ICANN would give them a warning and pull their license if they don't start complying with the ICANN agreement to the letter.  But ICANN doesn't seem to be willing to provide the muscle to keep the registrars in line.  Their repeated knuckling under to Verisign is evidence of that.

Why does the domain name business seem to attract the scum at the bottom of the barrel?

Why does the domain name business seem to attract the scum at the bottom of the barrel?

Being one that works in this business, I'll take issue with add to that last comment.  I think this business is not far different from any other industry that's highly competitive and price sensitive.  Some companies will stoop to trickery (how many of you have received solicitations by email that look like invoices but aren't) to get or keep your business.  And, some won't. 

Well, speaking from experience, I don't think the 60 day no transfer policy is that big of a deal or that bad of an idea.  Here's what happened to me about 2 years ago:  I dissolved a business partnership and had rights to the companies domain name.  My ex-partner however, (who was listed as the admin contact at the time), transferred the domain to another registrar before I could act.  Once done, he was listed as the new owner.  I called my registrar GKG.NET and with their help was able to get the domain transferred back to them and in my name, but it took about 22 days during which time the website and email was down.  This made my customers very nervous, as they thought I was out of business. 

GKG recently started implementing a 60 day no transfer policy, that should help.  I can now see that what happened to me can't really happen again.  If the contact info is changed in any way, then the domain can't be transferred, and it gives me time to call GKG.NET back up and get it back in my name before any transfer takes place.  It's much easier and should only take a day rather than several this way.   While what GoDaddy did to SecLists.org is absurd, the 60 day no transfer policy can help deter a lot of fraud or theft of domain names.  I see nothing wrong with waiting 60 days unless of course you are really upset with the registrar.

Puppet Master

Well, speaking from experience, I don't think the 60 day no transfer policy is that big of a deal or that bad of an idea.  Here's what happened to me about 2 years ago:  I dissolved a business partnership and had rights to the companies domain name.  My ex-partner however, (who was listed as the admin contact at the time), transferred the domain to another registrar before I could act.  Once done, he was listed as the new owner.  I called my registrar GKG.NET and with their help was able to get the domain transferred back to them and in my name, but it took about 22 days during which time the website and email was down.  This made my customers very nervous, as they thought I was out of business. 

GKG recently started implementing a 60 day no transfer policy, that should help.  I can now see that what happened to me can't really happen again.  If the contact info is changed in any way, then the domain can't be transferred, and it gives me time to call GKG.NET back up and get it back in my name before any transfer takes place.  It's much easier and should only take a day rather than several this way.   While what GoDaddy did to SecLists.org is absurd, the 60 day no transfer policy can help deter a lot of fraud or theft of domain names.  I see nothing wrong with waiting 60 days unless of course you are really upset with the registrar.

Puppet Master

Puppet Master brings up a valid point.  I suppose GoDaddy might use this for security reasons but it should not be so remarkably difficult to override this "security" feature when necessary.

Puppet Master brings up a valid point.  I suppose GoDaddy might use this for security reasons but it should not be so remarkably difficult to override this "security" feature when necessary.

I do see something wrong with this, from a registrar abuse point of view.  Most transfers as I'm sure you know get confirmed via an email sent to the admin contact listed in the whois record.  Couple of scenarios I can think of:

• Many registrars won't allow you to transfer a domain if it has a whois privacy service enabled, either because they by policy won't allow it or the privacy service prevents you from getting email sent to the viewalbe whois admin contact.  When you turn this off, they then consider this as a change in contact information & lock down the domain against transfer for 60 days.
• You order a transfer with a new registrar, and they let you know your admin email address is not valid on your current whois record (this happens all the time).   So, you make the correction, and then can't transfer out for 60 days.

Cheers,

Doug.

If either of these happens close to the domain's expiry date (which is usually when domains get transfered), you're then locked into another year's renewal with the current registrar.

Puppet Master does bring up a valid point, but I think a better way of tackling this kind of security issue is with an active account monitoring service.  If you get a notice of login by email or text message, and know you've not accessed your account, then you'll know right away something is wrong and can deal with it immediately.

Puppet Master brings up a valid point.  I suppose GoDaddy might use this for security reasons but it should not be so remarkably difficult to override this "security" feature when necessary.

I do see something wrong with this, from a registrar abuse point of view.  Most transfers as I'm sure you know get confirmed via an email sent to the admin contact listed in the whois record.  Couple of scenarios I can think of:

• Many registrars won't allow you to transfer a domain if it has a whois privacy service enabled, either because they by policy won't allow it or the privacy service prevents you from getting email sent to the viewalbe whois admin contact.  When you turn this off, they then consider this as a change in contact information & lock down the domain against transfer for 60 days.
• You order a transfer with a new registrar, and they let you know your admin email address is not valid on your current whois record (this happens all the time).   So, you make the correction, and then can't transfer out for 60 days.

Cheers,

Doug.

If either of these happens close to the domain's expiry date (which is usually when domains get transfered), you're then locked into another year's renewal with the current registrar.

Puppet Master does bring up a valid point, but I think a better way of tackling this kind of security issue is with an active account monitoring service.  If you get a notice of login by email or text message, and know you've not accessed your account, then you'll know right away something is wrong and can deal with it immediately.

True enough, if you see an email notice in time.  In my case, the entire transfer happened within 4 hours, all while I was out of town on business. 
My ex-business partner was able to get in to my account, transfer the registrant contact to himself, and start the transfer, and was able to respond to all emails in a matter of hours.  He knew exactly what he was doing.  Now, to my knowledge (and I'll check into this tomorrow), GKG does not lock the domain for 60 days unless you change the registrant itself, (IE: transferring to another username like if you have sold the domain name).  If you just change the email address, the 60 day no transfer policy doesn't take effect.  Of course that than means I could still lose my domain, but it will be easier to prove that my email address was the only information changed, rather than the entire contact. 

Puppet Master

Wow, that was fast!  That means he also then had control within the current registrar account to confirm the transfer away from them as well, so he certainly did know what he was doing.

For notifications, this can also be done via SMS text message to your phone, so unless you're in an airliner for an extended period of time, you'd normally have time to react.

True enough, if you see an email notice in time.  In my case, the entire transfer happened within 4 hours, all while I was out of town on business. 
My ex-business partner was able to get in to my account, transfer the registrant contact to himself, and start the transfer, and was able to respond to all emails in a matter of hours.  He knew exactly what he was doing.  Now, to my knowledge (and I'll check into this tomorrow), GKG does not lock the domain for 60 days unless you change the registrant itself, (IE: transferring to another username like if you have sold the domain name).  If you just change the email address, the 60 day no transfer policy doesn't take effect.  Of course that than means I could still lose my domain, but it will be easier to prove that my email address was the only information changed, rather than the entire contact. 

Puppet Master