Introducing a technological-administrative layer of security in the process of transferring .IL Domain Names between Registrars
As of September 3, 2018, the Israeli Domain Name system will include a technological-administrative method known as Transfer Authorization Code, already available in Registries worldwide.
Background
Transferring an .IL Domain Name from one Israel Internet Association Accredited Registrar to another requires initiating a Transfer request. According to the Domain Names Registration Rules, only the Domain Name Holder has the right to transfer it. Currently, an application to transfer a Domain Name from one Accredited Registrar to another is submitted to the Registry (managed by the Israel Internet Association) by the Gaining Registrar (the Registrar to whom the Holder requests to transfer the management). The Israel Internet Association Accreditation Agreement requires the Gaining Registrar to verify that the applicant is the Domain Name Holder. Once the applicant has been verified, the Registrar can submit the transfer application to the Registry and the Losing Registrar.
Key Changes
Following a review of the existing process and its possible failures, it has been decided to introduce a technological-administrative method of generating a random, single-use Transfer Authorization Code for transfer requests. The Transfer Authorization Code is generated by the Losing Registrar per the request of the Domain Name Holder and is submitted to the Holder and the Registry only upon a successful identification process, as required by the Registrar’s Accreditation Agreement. Once the Holder obtained the Transfer Authorization Code issued by the Losing Registrar, it can be submitted to the Gaining Registrar. After identifying the applicant as the Domain Name Holder, as required by the Accreditation Agreement, the Gaining Registrar submits the transfer request and the Transfer Authorization Code to the Registry. The Registry system verifies that the Code assigned by the Losing Registrar is identical to the Code submitted by the Gaining Registrar and grants the submission of the transfer request to the Registry. The Losing Registrar can deny the transfer request within five days, in order to prevent abuse (if the Registrar suspects the request wasn’t filed by the Holder) or allow the Holder to cancel it. The Losing Registrar is not required to wait five days and can authorize the transfer at any time within this period. If the Losing Registrar takes no action, the Domain Name will be transferred to the Gaining Registrar after five days.
The Losing Registrar may deliver the Transfer Authorization Code to the Holder via the Domain Name administration interface or via email, in a method specified in the Accreditation Agreement. (In order to prevent potential abuse of the Transfer Authorization Code and for security reasons, the Transfer Authorization Code is delivered using an identity verification method implemented in an email message.)
Transferring a Domain Name managed by the Israel Internet Association as Registrar will also require a Transfer Authorization Code, as required by other Registrars.
The system provides a technological-administrative layer of security protecting the Holder’s rights during the process of transferring Domain Names between Registrars. The Israel Internet Association considers this service to be a milestone in the cyber defense of Domain Names.
As of said date, all Accredited Registrars are required to implement the change and provide a Transfer Authorization Code to Holders seeking to transfer Domain Names.