Why is your domain transfer stuck or failing?

A domain transfer usually gets stuck or fails for one of a few reasons: the domain is still locked at the current registrar, the auth code is wrong or expired, the domain was registered or transferred too recently, it has expired or entered redemption, a confirmation email went unanswered, or the registry or losing registrar has placed a hold on it. A transfer that is simply "pending" for up to five days is normal, because the registry waits that long for the losing registrar to respond before approving it automatically. The fastest way to find the cause is to look up the domain's EPP status codes and read the rejection message from the gaining registrar.

This guide walks through how to diagnose a stuck transfer from the command line, explains each common cause with its fix, lists the reasons a losing registrar is allowed to deny a transfer, and covers problems that appear after the transfer completes, such as DNS or DNSSEC failures.

First, Is It Actually Stuck?

A gTLD transfer moves through a few stages:

1. You request the transfer at the gaining registrar.
2. The gaining registrar submits it to the registry with the auth code.
3. The registry sets the domain to pendingTransfer.
4. The losing registrar approves, denies, or does nothing.
5. After five days without a response, the registry approves it automatically.

So a transfer that's been pending for two or three days isn't necessarily stuck. It's waiting. You can usually speed it up by approving the transfer from the losing registrar's notification email or dashboard. If you never got as far as stage 3, the transfer was rejected before it started, and the cause is almost always in the request itself.

For the full normal process, see how to transfer a domain to another registrar.

Diagnosing the Problem

Check the Domain's Status Codes

The domain's EPP status codes tell you most of what you need to know. RDAP, the protocol that has replaced port-43 WHOIS for gTLDs, returns them as readable strings:

curl -sL https://rdap.org/domain/example.com | jq -r '.status[]'

client transfer prohibited
client update prohibited

Traditional WHOIS shows the same information in camel case:

whois example.com | grep -i "domain status"

Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

Check the Key Dates

RDAP also returns events such as registration, last transfer and expiry. These tell you whether a time-based restriction applies:

curl -sL https://rdap.org/domain/example.com \
  | jq -r '.events[] | "\(.eventAction): \(.eventDate)"'

registration: 2026-09-14T10:22:31Z
expiration: 2027-09-14T10:22:31Z
last changed: 2026-10-20T08:05:12Z
last update of RDAP database: 2026-10-26T09:41:07Z

In this example, the domain was registered about six weeks ago, which is very likely why the transfer is being refused. If a transfer event appears, that's the date of the last registrar transfer.

Status Codes and What They Mean for Transfers

EPP status (WHOIS)	RDAP string	Effect on a transfer
ok	active	No restrictions
clientTransferProhibited	client transfer prohibited	Registrar lock is on. You can remove it
serverTransferProhibited	server transfer prohibited	Registry lock or registry hold. Needs registrar or registry
pendingTransfer	pending transfer	A transfer is in progress
autoRenewPeriod	auto renew period	Recently auto-renewed. Transfer usually still allowed
redemptionPeriod	redemption period	Expired and deleted. Must be restored first
pendingDelete	pending delete	About to be released. Can't be transferred or restored
clientHold / serverHold	client hold / server hold	Removed from DNS. Often unpaid, disputed or suspended

Common Causes and How to Fix Them

1. The Domain Is Still Locked

clientTransferProhibited means your current registrar's transfer lock is on, and the registry rejects any transfer request automatically.

Fix: Log in to the current registrar and switch off Domain Lock or Transfer Lock. Wait a few minutes for the change to reach the registry, confirm with the status check above, then restart the transfer. See what domain registrar lock is for more on this setting.

If you see serverTransferProhibited instead, the lock is set at the registry. That can be a paid registry lock service, a lock applied during a dispute, or a registry-specific restriction. Your current registrar has to arrange its removal.

2. The Auth Code Is Wrong or Expired

The gaining registrar reports an invalid or incorrect authorization code.

Fix: Request a new code from the current registrar and copy it with the copy button, avoiding leading or trailing spaces. Some registrars reset the code after a failed attempt, and under ICANN's updated Transfer Policy, codes expire after a limited period. What a domain auth code is covers where to find it and common copying mistakes.

3. The Domain Was Registered or Transferred Recently

Registrars can refuse transfers for a period after a domain is registered or after it was last transferred. Traditionally this is 60 days, and ICANN's updated Transfer Policy shortens it to 30 days. Some registrars also apply a lock after a change to the registrant's name or organisation.

Fix: Check the registration and transfer dates with RDAP, then wait until the period ends. There's usually no way around this. If the lock came from a registrant change, ask the current registrar whether you opted out of it at the time, because some registrars offered that option.

4. The Domain Has Expired

Transfers of expired domains behave differently depending on how far past expiry they are:

• Auto-renew grace period (autoRenewPeriod): Many registrars still allow the transfer, and the registry reverses the automatic renewal so you aren't charged twice. Some registrars block transfers once the domain has expired, or require you to renew it first.
• Redemption period (redemptionPeriod): The domain must be restored at the current registrar, which usually involves a restore fee. Only then can it be transferred.
• Pending delete (pendingDelete): Nothing can be done. The domain will be released and becomes available to register.

Fix: Renew or restore at the current registrar, then transfer. Expect the post-transfer lock to apply if you renew in a way that counts as a new transaction at your registrar. See what happens when a domain name expires and the domain redemption and grace periods.

5. A Confirmation Email Was Missed

Some gaining registrars require you to confirm the request by email, and the losing registrar usually sends a notice where you can approve or reject it. If the gaining registrar's confirmation is never clicked, the transfer may never be submitted.

Fix: Check the registrant email address on the domain and the account emails at both registrars. Look in spam folders. If the registrant email is out of date, update it at the current registrar first, but be aware that changing the registrant's name or organisation can trigger a transfer lock at some registrars. See how to change the registrant contact details.

6. The Losing Registrar Denied the Transfer

Under ICANN's Transfer Policy, the losing registrar may deny a transfer only for specific reasons, including:

• Evidence of fraud.
• A reasonable dispute over the identity of the person requesting the transfer.
• No payment for a previous registration period, including when the domain is past its expiry date.
• Express written objection from the registrant.
• The domain is locked and the registrant had a way to remove the lock.
• The domain is within the post-registration or post-transfer period.

It must deny a transfer in certain cases, such as a pending UDRP dispute, a court order, or a registry-level legal hold.

Fix: Ask the losing registrar for the specific reason in writing. If it's one you can resolve, such as an unpaid invoice or an objection lodged by mistake, resolve it and restart the transfer. If you believe the denial is unjustified, ask the gaining registrar for help first. For gTLDs, unresolved disputes can be raised with ICANN Contractual Compliance.

7. The Gaining Registrar Rejected the Request

Sometimes the problem is at the new registrar:

• Unsupported TLD: The registrar doesn't sell that extension.
• Premium pricing: The registry treats the domain as premium, and the transfer price doesn't match what you paid.
• Payment failure: The card was declined, so the request was never sent.
• Account verification: New accounts may be held for identity checks.

Fix: Check your order status and any email from the gaining registrar. Its support team can see the exact EPP response from the registry, which is far more useful than a generic error message.

8. The Domain Is a ccTLD With Different Rules

Many country-code domains don't follow ICANN's process at all:

• .uk domains move by changing the IPS tag at the current registrar, with no auth code.
• Some ccTLDs require the registrant to approve the transfer at the registry rather than the registrar.
• Some have local presence requirements that the new registrar must verify.

Fix: Read the new registrar's help page for that specific TLD, and follow the registry's own instructions where provided.

9. The Domain Is Held by a Reseller or Someone Else

If the domain was bought through a web designer, agency or hosting company, it may be registered in their account, sometimes with their details as the registrant. You may not be able to get the code yourself.

Fix: Ask the account holder to update the registrant to you and provide the auth code. If they won't cooperate and you are the registrant, the registrar must still provide you with the code. If you aren't listed as the registrant, you may need to prove your right to the domain, which can be slow.

Problems After the Transfer Completes

Sometimes the transfer succeeds but something breaks afterwards. These aren't transfer failures, but they're often blamed on the transfer.

The Website or Email Stopped Working

If your DNS was hosted at the old registrar, it may have deleted your zone when the domain left. Check which nameservers the domain uses and whether they still answer:

dig +short example.com NS
dig @$(dig +short example.com NS | head -n1) example.com A

If the nameservers return REFUSED or no answer, recreate your records at a working DNS provider and change the nameservers. Next time, move DNS first using how to move DNS hosting without downtime.

DNSSEC Validation Fails

If the DS record at the registry no longer matches the key that signs your zone, validating resolvers return SERVFAIL. Compare the two:

dig +short example.com DS
dig +short example.com DNSKEY
dig @1.1.1.1 example.com A +dnssec | grep -E "status|flags"

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48211

Fix: Remove the stale DS record at the new registrar, or replace it with the DS record from your current DNS provider. See what DNSSEC is for how the DS and DNSKEY relate.

The Expiry Date Didn't Change

Most gTLD transfers add one year. If the date didn't change, the transfer may have happened during the auto-renew grace period, where the registry handles the year differently, or the domain may be at the ten-year maximum. Some ccTLDs don't add a year at all. Check with the new registrar before assuming you've been overcharged.

A Quick Diagnostic Script

This Python script prints the information that explains most transfer problems: status codes, registrar, and key dates. It uses only the standard library and RDAP via rdap.org, which redirects to the right registry.

import json
import sys
import urllib.request
from datetime import datetime, timezone


def rdap(domain: str) -> dict:
    req = urllib.request.Request(
        f"https://rdap.org/domain/{domain}",
        headers={"Accept": "application/rdap+json", "User-Agent": "domain-check/1.0"},
    )
    with urllib.request.urlopen(req, timeout=15) as resp:
        return json.load(resp)


def main(domain: str) -> None:
    data = rdap(domain)
    now = datetime.now(timezone.utc)

    registrar = next(
        (
            item[3]
            for ent in data.get("entities", [])
            if "registrar" in ent.get("roles", [])
            for item in ent.get("vcardArray", [None, []])[1]
            if item[0] == "fn"
        ),
        "unknown",
    )
    print(f"Domain:    {domain}")
    print(f"Registrar: {registrar}")
    print(f"Status:    {', '.join(data.get('status', []))}")

    for event in data.get("events", []):
        when = datetime.fromisoformat(event["eventDate"].replace("Z", "+00:00"))
        days = (now - when).days
        rel = f"{days} days ago" if days >= 0 else f"in {-days} days"
        print(f"{event['eventAction']:<32} {when:%Y-%m-%d}  ({rel})")

    warnings = []
    statuses = set(data.get("status", []))
    if "client transfer prohibited" in statuses:
        warnings.append("Registrar lock is on: unlock it at the current registrar.")
    if "server transfer prohibited" in statuses:
        warnings.append("Registry-level lock: contact the current registrar.")
    if statuses & {"redemption period", "pending delete"}:
        warnings.append("Domain is expired and deleted: restore before transferring.")
    for event in data.get("events", []):
        if event["eventAction"] in ("registration", "transfer"):
            when = datetime.fromisoformat(event["eventDate"].replace("Z", "+00:00"))
            if (now - when).days < 60:
                warnings.append(
                    f"{event['eventAction'].title()} was under 60 days ago: "
                    "a post-registration or post-transfer lock may apply."
                )

    for w in warnings:
        print(f"WARNING: {w}")


if __name__ == "__main__":
    main(sys.argv[1])

python3 transfer_check.py example.com

Domain:    example.com
Registrar: Example Registrar, LLC
Status:    client transfer prohibited
registration                     2026-09-14  (42 days ago)
expiration                       2027-09-14  (in 323 days)
last changed                     2026-10-20  (6 days ago)
last update of RDAP database     2026-10-26  (0 days ago)
WARNING: Registrar lock is on: unlock it at the current registrar.
WARNING: Registration was under 60 days ago: a post-registration or post-transfer lock may apply.

The 60-day check is deliberately cautious. Where your registrar uses the newer 30-day window, the transfer may be allowed sooner.

---

FAQ: Stuck and Failed Domain Transfers

---

Conclusion

Most stuck or failed transfers come down to a handful of causes: the transfer lock is still on, the auth code is wrong or stale, the domain is too new or recently transferred, it has expired into redemption, or someone missed a confirmation email. A pending transfer of up to five days is normal, and approving it at the losing registrar usually finishes it straight away.

Start every investigation by checking the domain's status codes and key dates with RDAP or WHOIS, because they point to the cause far more reliably than a generic error message. Fix what you can at the current registrar, ask either registrar for the exact EPP response when the reason isn't clear, and make sure DNS and DNSSEC don't depend on the registrar you're leaving so the domain keeps working once it arrives.