Locking all domains in prep for GDPR — Hexonet is

Firm takes precautions to reduce chances of domain theft following GDPR.

Domain name registrar Hexonet is taking two security precautions in preparation for GDPR, and I expect other registrars will implement similar changes.

First, it is turning on transfer lock for all domain names that aren’t ccTLDs. Clients can still unlock the domains to start a transfer. Any domain that is unlocked by a client will automatically relock following 30 days.

Second, it is issuing fresh and stronger transfer authorization codes for domain names at the registrar.

The security is necessary since the transfer process for domain names is going to change once Whois records are obscured to comply with GDPR. Technically, transfers will not be able to proceed for thin-Whois domains like .com under the right now-approved ICANN rules if the gaining registrar can’t access the current owner’s email address. So some domain registrars are taking it into their own hands and are skipping a key step of the transfer process in which the gaining registrar gets approval from the current domain registrant. (Learn more regarding this here.)

This means it will be easier for someone who gains access to authentication codes to transfer domain names.