Why Can't I Transfer My Domain? Common Transfer Blocks Explained

You found a better registrar, entered your domain, pasted the auth code, and got a vague "transfer failed" or "domain not eligible" message. Domain transfers are tightly controlled on purpose, because a transfer is exactly what a domain thief would want to do. The trade-off is that legitimate transfers get blocked for reasons that are not always explained. The good news is that almost every block shows up in public registration data or your registrar dashboard, and each has a specific fix. This article explains the common reasons a transfer fails, how to diagnose which one you are hitting, and what to do about it. For the full step-by-step process once you are unblocked, see how to transfer a domain to another registrar without downtime.

Start With a Quick Diagnosis

Before reading through every cause, look at the domain's status codes and key dates. RDAP returns both:

curl -sL https://rdap.org/domain/example.com \
  | jq '{status, events: [.events[] | {(.eventAction): .eventDate}] | add}'

Or with WHOIS:

whois example.com | grep -iE "domain status|creation date|expir|updated date"

Compare what you see with this table, then jump to the matching section below.

What you see	Likely block
clientTransferProhibited	Registrar lock is on
serverTransferProhibited	Registry lock, dispute, or legal hold
Creation date within the last 60 days	New-registration transfer restriction
Recent transfer or registrant change	60-day transfer lock
pendingTransfer	A transfer is already in progress
redemptionPeriod or pendingDelete	Domain expired and was deleted
clientHold or serverHold	Domain suspended
pendingUpdate, pendingDelete, pendingRestore	Another operation is in progress
Only ok or active, but transfer still fails	Auth code, account, or registrar-specific issue

1. Registrar Lock Is Still On

This is the most common cause by far. Registrars lock domains by default to prevent hijacking, which sets the EPP status clientTransferProhibited. The registry rejects transfer requests while it is set, even with a correct auth code.

Fix: In your current registrar's dashboard, find the setting called domain lock, transfer lock, registrar lock, or theft protection and turn it off. Wait a few minutes and confirm the status is gone, then retry. Remember to re-enable the lock at the new registrar. For the details of each status code, see what registrar lock is and why to enable it.

2. The Domain Is Too New or Was Recently Transferred

Under ICANN's Transfer Policy, registrars may deny a transfer within 60 days of the initial registration and within 60 days of a previous inter-registrar transfer. Many registrars apply these restrictions automatically, and the new registrar will usually refuse to start the transfer at all.

Fix: Wait until the 60 days have passed. Your registrar cannot always override this, and the gaining registrar will refuse requests anyway. Note that some registrars apply the post-registration restriction more strictly than others. ICANN has also approved revisions to the Transfer Policy that change some of these periods, so check the current rules. The 60-day domain transfer lock article explains how the timers are calculated.

3. You Recently Changed the Registrant Details

A change of registrant (a material change to the registrant's name, organization, or, in some cases, email) triggers a 60-day lock on inter-registrar transfers under the current policy. The lock is meant to stop a hijacker from changing ownership and moving the domain in quick succession.

Many registrars offer an opt-out checkbox when you update contact details. If you ticked it, no lock is applied. If you did not, the lock usually cannot be removed early.

Fix: Wait for the lock to expire, or ask the registrar whether it was applied correctly. Next time, if you plan to transfer, do the transfer first and update contact details afterwards, or use the opt-out when it is offered.

4. The Auth Code Is Wrong or Expired

If the registry receives a transfer request with an authorization code that does not match, it rejects it. Common causes:

• A trailing space or line break copied from an email
• A code that was regenerated after you requested it
• A code that has expired under the registrar's or registry's rules
• Ambiguous characters typed by hand, such as 0 and O

Fix: Request a fresh code and paste it rather than typing it. If the gaining registrar's form strips special characters, ask the losing registrar for a new code or contact the gaining registrar's support. See what an EPP authorization code is and where to find it.

5. The Domain Has Expired, or Is in Redemption

Expiration creates several different situations:

Phase	Typical status	Can you transfer?
Shortly before expiration	ok or locked	Usually yes, but some registrars block the last few days
Auto-renew grace period after expiry	autoRenewPeriod	Often possible, depends on the registrar
Redemption period	redemptionPeriod	No, must be restored at the current registrar first
Pending delete	pendingDelete	No, the domain will be released

Some registrars also put expired domains on clientHold, which takes them offline and may block transfers until you renew.

Fix: Renew or restore the domain at the current registrar, then transfer. If you are close to expiry, it is often simpler to renew first. Read what a domain grace period and redemption period are to understand where you are in the timeline.

6. A Server-Level Status Is Set

If you see serverTransferProhibited, the block is at the registry level. Your registrar cannot simply toggle it. Common reasons:

• Registry lock, a security service you (or your organization) signed up for. Removing it requires the registrar's out-of-band verification process. See registry lock vs. registrar lock.
• A UDRP or URS proceeding. Once a dispute is filed, the domain is locked against transfer and registrant changes until the case ends.
• A court order or other legal action.
• Registry policy, for example for certain restricted or premium names.

Fix: Ask your registrar why the status is set. If it is a registry lock you control, follow the unlock process. If it is a dispute or court order, the transfer must wait until it is resolved.

7. A Transfer or Other Operation Is Already Pending

A status of pendingTransfer means a transfer request is already in progress, possibly one you started earlier at another registrar. pendingUpdate, pendingRenew, or pendingDelete mean another operation has not finished.

Fix: Cancel the earlier transfer at the gaining registrar where you started it, or ask the losing registrar to reject it, then start again. For other pending operations, wait for them to complete.

8. The Domain Is Suspended (Hold Status)

clientHold or serverHold remove the domain from the TLD zone. Typical causes are an unpaid invoice, unverified registrant email, or an abuse complaint. Some registrars block transfers while the hold is in place.

Fix: Resolve the underlying issue with your registrar: pay, verify the contact email, or respond to the abuse report. Once the hold is lifted, retry the transfer.

9. The Losing Registrar Rejected It

ICANN's Transfer Policy lets the losing registrar deny a transfer for limited reasons, including:

• Evidence of fraud
• A reasonable dispute about the identity of the person requesting the transfer
• Non-payment for a previous registration period
• An express written objection from the registrant
• The domain being within 60 days of its initial registration or last transfer
• The registrant having previously asked for transfer protection (registrar lock), if the registrar provides a way to remove it

It must deny transfers in certain cases, such as an active UDRP proceeding or a court order. Reasons outside the policy are not valid grounds for a gTLD.

Fix: Ask the losing registrar for the reason in writing. If it does not match an allowed reason, request that it be corrected, and if that fails, file a transfer complaint with ICANN Contractual Compliance.

10. You Do Not Control the Account or Are Not the Registrant

If someone else (a developer, a former employee, an agency) controls the registrar account, you cannot unlock the domain or get the auth code yourself. If the registrant name is not yours, a registrar may refuse to act on your instructions even if you paid for the domain.

Fix: Ask the account holder to unlock the domain and send you the code, or to move the domain into your account at the same registrar first (an internal "push"). If they will not cooperate, gather evidence that you are the rightful owner.

11. The New Registrar Does Not Support the TLD or Name

Not every registrar sells every TLD. Some also cannot accept transfers of premium-priced names or names with special eligibility rules (for example, ccTLDs that require local presence).

Fix: Check the gaining registrar's list of supported TLDs and any eligibility requirements before you start.

12. Country-Code TLD Rules Differ

ccTLDs are not bound by ICANN's Transfer Policy. They often have different procedures:

• .uk transfers use an IPS tag change rather than an auth code.
• Some ccTLDs require the registrant to confirm the transfer through the registry.
• Some impose different lock periods or eligibility checks.

Fix: Follow the transfer instructions for your specific ccTLD from the gaining registrar or the registry's website.

A Script to Diagnose Transfer Blocks

This Python script uses only the standard library. It fetches the domain's RDAP record, flags blocking statuses, and checks the registration and expiration dates against common rules. Not all registries publish a transfer event, so it reports that only when available.

import json
import sys
import urllib.request
from datetime import datetime, timezone

BLOCKING = {
    "client transfer prohibited": "Registrar lock is on: unlock it at your registrar",
    "server transfer prohibited": "Registry-level block: ask your registrar why",
    "pending transfer": "A transfer is already in progress",
    "redemption period": "Domain is in redemption: restore it first",
    "pending delete": "Domain is being deleted: it cannot be transferred",
    "client hold": "Domain is suspended by the registrar",
    "server hold": "Domain is suspended by the registry",
    "pending update": "An update is still being processed",
}


def parse(ts):
    return datetime.fromisoformat(ts.replace("Z", "+00:00"))


def main(domain):
    req = urllib.request.Request(
        f"https://rdap.org/domain/{domain}",
        headers={"Accept": "application/rdap+json"},
    )
    with urllib.request.urlopen(req, timeout=20) as resp:
        data = json.load(resp)

    now = datetime.now(timezone.utc)
    problems = []

    for status in data.get("status", []):
        if status.lower() in BLOCKING:
            problems.append(f"[{status}] {BLOCKING[status.lower()]}")

    events = {e["eventAction"]: parse(e["eventDate"]) for e in data.get("events", [])}

    if "registration" in events:
        age = (now - events["registration"]).days
        if age < 60:
            problems.append(f"Registered {age} days ago: transfers usually wait 60 days")

    if "transfer" in events:
        since = (now - events["transfer"]).days
        if since < 60:
            problems.append(f"Last transferred {since} days ago: 60-day lock likely")

    if "expiration" in events:
        left = (events["expiration"] - now).days
        if left < 0:
            problems.append(f"Expired {abs(left)} days ago: renew or restore first")
        elif left < 14:
            problems.append(f"Expires in {left} days: renew first or transfer quickly")

    print(f"Statuses: {', '.join(data.get('status', [])) or 'none'}")
    if problems:
        print("Possible transfer blocks:")
        for p in problems:
            print(f"  - {p}")
    else:
        print("No public blocks found. Check the auth code, account access, and TLD support.")


if __name__ == "__main__":
    main(sys.argv[1] if len(sys.argv) > 1 else "example.com")

Run it with python3 transfer_check.py yourdomain.com. A registrant-change lock is not visible in public data, so if the script finds nothing and the transfer still fails, ask your registrar directly.

Prevention Checklist for Future Transfers

• Keep your registrant email current and verified.
• Avoid changing registrant details shortly before a planned transfer, or use the opt-out.
• Start transfers at least two weeks before expiration.
• Keep the domain in an account you control, protected with two-factor authentication.
• Unlock only when ready, and re-lock as soon as the transfer completes.

---

Domain Transfer Blocks FAQ

Conclusion

When a domain transfer fails, the cause is almost always one of a handful of well-defined blocks: registrar lock still on, a 60-day restriction after registration, transfer, or registrant change, an expired or redeemed domain, a server-level hold, a wrong auth code, or an account you do not fully control. Most of these leave visible traces in the status codes and dates that RDAP and WHOIS return, so a one-minute lookup usually tells you what is going on.

Fix the underlying issue rather than retrying blindly. Unlock and get a fresh code, wait out a 60-day lock, renew or restore an expired domain, or resolve a dispute first. If your registrar refuses without a valid reason, ICANN's Transfer Policy is on your side for gTLD domains, and Contractual Compliance is the escalation path.

Here are some useful references for going deeper on domain transfer blocks:

1. ICANN: Transfer Policy — the allowed and required reasons for denying a transfer, and the change-of-registrant rules.
2. ICANN: EPP Status Codes: What Do They Mean, and Why Should I Know? — what each status means and what to do about it.
3. RFC Editor: RFC 3915: Domain Registry Grace Period Mapping for EPP — the redemption and grace period statuses.
4. RFC Editor: RFC 8056: EPP and RDAP Status Mapping — how EPP statuses appear in RDAP output.