The 60-day transfer lock trap: why registrars "accidentally" trigger it

What the ICANN policy actually says

ICANN's Transfer Policy (effective December 2016) introduced a "Change of Registrant" provision. The relevant rules:

1. When the registrant name, email, or organization changes, the registrar must send confirmation to both old and new registrants (email).
2. After the change is confirmed, the domain is locked from outbound transfer for 60 days.
3. The registrant can opt out of the lock before the change by checking a box on the change form.
4. The lock does not prevent most other operations (DNS changes, renewal, etc.) — only registrar-to-registrar transfers.

The policy exists for a good reason: preventing hijack attacks where an attacker changes registrant info and immediately transfers the domain out. It is legitimate security policy.

The complaint is not the policy itself — it is how registrars present (or hide) the trigger.

How the lock gets triggered — often accidentally

Documented trigger patterns:

• GoDaddy: updating your account email address updates the WHOIS registrant email, which triggers the lock. No explicit warning.
• Network Solutions: a "required" periodic "verify your contact info" prompt, when completed with any change, triggers the lock. Customers who "click to confirm" are silently locked.
• Squarespace (post-Google Domains migration): the migration itself involved a registrar transfer; changes to the registrant email during migration triggered a 60-day lock on some accounts. HN thread on migration complaints.
• Any registrar: changing the email address on a domain — routine maintenance — triggers the lock unless you have pre-opted-out.

The pattern customers describe: they update contact info, then try to transfer the domain a week later, and are told "you are in a 60-day transfer lock, wait until [date]." The transfer they actually wanted is delayed by 50+ days.

The opt-out you can request

Per ICANN policy, registrars must offer an opt-out checkbox on the change form. "I opt out of the 60-day transfer lock for this change" or similar language.

Finding the opt-out:

• GoDaddy: after clicking Change Contacts, there is a checkbox low on the form labeled "Skip 60-day lock." Easy to miss.
• Namecheap: explicit and labeled in the contact update flow.
• Google Domains (RIP): showed a warning with an explicit opt-out button.
• Cloudflare: opt-out by default on most changes.
• LaunchPad Host: explicit prompt: "This change will trigger a 60-day transfer lock unless you opt out now."

If you missed it or the registrar hid it, see the next section.

What to do if you're already locked

You cannot directly remove a 60-day lock. Options:

1. Wait. The lock is time-limited. Mark the date. 60 days from the triggering change, the lock expires automatically.
2. Request reversal via the registrar. Some registrars, if the lock was triggered "accidentally" (you did not intend the registrant change), will reverse the change and unlock early. Success rate: ~30%, mostly at customer-friendlier registrars.
3. File an ICANN complaint. If the registrar did not give you the opt-out option, file at icann.org/compliance. ICANN will investigate within 21 days. If the registrar was non-compliant, they may be forced to reverse.
4. Ride out the 60 days, then transfer. Plan the destination registrar, prepare auth codes and DNS, execute at day 61. Use the waiting time productively.

Prevention: registrar choice and routine

Four habits to avoid the lock:

1. Never change registrant info at a registrar you plan to leave within 60 days. If you intend to transfer out, do nothing with contact info first. Transfer first, then update at the new registrar.
2. Read every "required" WHOIS verification prompt carefully. Most are fine; some silently trigger the lock. Opt out explicitly.
3. Use a stable registrant email you do not need to change. Rotating contact emails rotates the lock. Use a dedicated domain-holder alias (e.g., domains@yourbusiness.com) that outlives any individual staffer.
4. Pick a registrar that warns you. The distinction between registrars that default to opt-out and those that default to opt-in is the single biggest quality-of-life difference in registrar choice.