General Comment on inter-registrar domain transfer

[R A Lichtensteiger <rali@xxxxxxxxxx>]

The current policies that govern inter-registrar domain transfers are
woefully inadequate, as this weekend's hijacking of the panix.com domain
amply demonstrates.

The problems are manifold:

  o  No entity should be able to cause a transfer to occur outside the
     approved system. THis happened in the panix.com case.  The original
     registrar has said publicly that they had no log entries indicating
     a request to transfer, nor did the registrar approve the transfer.

  o  In the event of a dispute, because of the likelihood of financial
     damage as well as inconvenience, the trnsfer must be able to be put
     on hold and/or rolled back while the dispute procedure is invoked.

  o  Domain holder authentication is clearly lacking.

  o  Registrars must be required to staff an operations desk with a
     response time as short as their advertised domain creation/transfer
     time.  If a registrar can transfer a domain 24/7, then that domain
     transfer must be able to be put on hold and disputes investigated
     on the same basis.

Fix these and your policies will gain credibility amongst end customers
and network operators.

R A Lichtensteiger
Principal
Tifosi Consulting
-- 
R A Lichtensteiger              rali@xxxxxxxxxx