Red.es is planning to change the procedure .es for domain name transfers, making use of the AuthCode method that has become industry standard.
According to a post on X by Madrid-based registrar Tecnocrática, the registry announced yesterday that a test environment would be made available on September 26th, followed by the new transfer procedure going live some time in November. [1]
Shortly thereafter, several domain industry leaders took to social media to praise the announcement, largely due to the enhanced security the change will entail.
The AuthCode requirement and the option for the owner to place a “transfer lock” on their domain represent the two main safeguards against unauthorized transfer requests. As neither currently exists for .es, today it is possible for any person to initiate the transfer process for even the most critical .es domains. The only thing preventing an unauthorized transfer from succeeding is the need to click on an approval link, sent to the Admin Contact email.
Gaining access to the Admin Contact email is not the only means available to bad actor wishing to execute a domain transfer. If the bad actor can access the registrar account in which the domain is managed, they can modify the contact email in favor of their own, instantly and with no approval required from the current Admin Contact.
In contrast, the success of an AuthCode transfer generally requires both access to the registrar account AND the email account of a key domain contact. Access to the registrar account is needed to retrieve the AuthCode and access to the authorized email is needed for the approval or rejection of the transfer.
IP Twins regularly works with .es domain name transfers and applauds the initiative of Red.es to implement AuthCode transfers. Our domain team will monitor implementation and be ready to work with the new protocol as soon as it is introduced.
[1] https://x.com/TecnocraticaCPD/status/1836495392520667337
