← Registrar / registrar

Troubleshoot failed domain transfers

After you start the transfer process to Cloudflare Registrar, your previous registrar has five days to release the domain after a successful transfer request. If your transfer has not been completed within that time frame, something has likely gone wrong.

Most issues with a stalled transfer can be solved by checking the following details and restarting the transfer.

If clientTransferProhibited appears in your domain WHOIS or RDAP output, the domain is still locked. Unlock it at your current registrar. If you reapplied the registrar lock after requesting the transfer, you will need to remove it again to restart the transfer process.

If you already unlocked the domain but WHOIS still shows it as locked, allow up to 5 hours for the change to propagate. Some registrars may take up to 24 hours. Some registrars have multiple lock types (domain lock, transfer lock, privacy lock) that must each be disabled separately. If your registrar dashboard shows unlocked but WHOIS disagrees, contact your current registrar directly.

Active DNSSEC at your current registrar will block the transfer. Disable DNSSEC and wait for the DS record TTL to expire (usually 24 hours) before retrying. Refer to Disable DNSSEC for detailed steps.

Authorization codes are usually only valid for a limited period. If your code is rejected, request a fresh one from your current registrar. Check for trailing spaces or line breaks when copy-pasting the code.

Unlike some registrars, Cloudflare does not allow you to submit an authorization code upfront. Cloudflare requires your domain to be active on its network first so that your site benefits from Cloudflare performance and security features from the moment the transfer begins. You must first add your domain to Cloudflare, update your nameservers, and wait for the zone to show Active status in the Cloudflare dashboard. Only then will the Transfer Domains ↗ page allow you to enter your code.

If your zone is still Pending, verify that you updated nameservers correctly at your current registrar and wait up to 24 hours. If you already have an authorization code, keep in mind that most codes are only valid for a limited period. If your code expires while you wait for the zone to activate, request a new one from your current registrar before proceeding.

Your transfer has been rejected by your previous registrar. There are several reasons for this to happen:

• You actively rejected the transfer request in the email you received from your registrar or on your registrar interface.
• Your registrar determined the domain is not eligible for transfer.
• Some registrars allow customers to enable a setting to reject all transfer requests.
• If you are transferring from GoDaddy, make sure Domain Privacy and Domain Protection are fully disabled. GoDaddy may reject the transfer if either is still active.
• In some instances, registrars may reject the transfer if they suspect malicious behavior.

You will need to restart the transfer and approve the request or contact your current registrar to resolve this issue.

Domain registries enforce maximum registration periods. Because every transfer adds one year to your registration, a transfer can be rejected if the extra year would exceed the limit.

Maximum registration periods:

• Most TLDs (such as .com, .net, .org) allow up to 10 years of registration.
• .co domains have a maximum of 5 years.

Common reasons for rejection:

• Your domain already has 9 or more years of registration remaining. Adding one year would exceed the 10-year limit (or 5-year limit for .co).
• Your domain was renewed after expiring and then transferred within 45 days of the original expiration date. In this case, the registry may not add the extra year. For example, if example.com expires on December 10, you renew it on December 20 (extending it to December 20 of the following year), and then transfer to Cloudflare on December 30 — the transfer is within 45 days of the original expiration, so the registry may not add an additional year. Your expiration date would remain December 20 of the following year, meaning you effectively paid twice for the same year. If this happens, you are entitled to request a refund from your previous registrar under ICANN rules.
• Your domain does not meet a TLD-specific minimum. For example, .ai domains require a minimum 2-year registration for transfers.
• .uk domains do not receive an additional year when transferred.

What you can do:

• If your domain has too many years remaining, wait until the total registration period (current time remaining plus the one year added by the transfer) would not exceed the maximum — 10 years for most TLDs, or 5 years for .co. For example, a .com domain with 9 years and 6 months remaining cannot be transferred until at least 6 months have passed.
• If your domain is close to expiration, renew it at your current registrar first. Once the renewal is confirmed, initiate the transfer.
• If your domain is a TLD with special requirements (such as .ai), verify that you meet the minimum registration period before transferring.

ICANN rules prohibit transfers within 60 days of registration or a previous transfer. Check the domain creation date and last transfer date in WHOIS.

Domains with certain WHOIS statuses cannot be transferred:

• clientHold or serverHold — the domain is suspended, usually due to non-payment, failed verification, or a dispute. Contact your current registrar to find out why the hold was applied and how to remove it.
• redemptionPeriod — the domain has expired and passed the grace period. You must restore and renew it at your current registrar before it can be transferred.
• pendingDelete — the domain is scheduled for deletion by the registry and cannot be transferred or recovered. After deletion, the domain becomes available for anyone to register.

Other common WHOIS or RDAP statuses include:

• clientTransferProhibited — the domain is locked at the registrar.
• serverTransferProhibited — the registry has applied a transfer restriction.
• addPeriod — the domain is within the post-registration lock window.
• pendingTransfer — the domain is already in an active transfer.
• clientDeleteProhibited or serverDeleteProhibited — deletion is restricted.

Most domains can be transferred with WHOIS privacy enabled. However, some registrars may prohibit transfer requests if you have WHOIS privacy services enabled. If your transfer is failing, check with your current registrar to confirm WHOIS privacy is not blocking it.

If your payment method was declined after submitting the authorization code, the transfer may be in a partially started state. Update your payment method in your Cloudflare billing settings and check the Transfer Domains ↗ page for the current status.

Domain transfers typically take 3-5 business days. Some TLDs (such as .mx) can take up to 10 days. You can speed up the process by approving the transfer at your current registrar when you receive the confirmation email. If the transfer has been stuck beyond these timeframes with no identifiable issue, contact your current registrar to confirm there are no holds or restrictions on their end.

Your domain may not appear on the Transfer Domains ↗ page if:

• You have not added your domain to your Cloudflare account, or it is still in Pending status. Your domain must be Active before you can transfer it.
• The domain was registered or previously transferred in the last 60 days (ICANN requirement).
• Cloudflare does not support the TLD.
• The domain has a status that blocks transfers (such as serverHold or pendingDelete). Refer to Domain is in a restricted status for details.

Some commerce and site-building platforms (such as Shopify, Block, and Wix) do not allow you to change nameservers while the domain is registered with them. Because Cloudflare requires your nameservers to point to Cloudflare before a transfer can begin, a direct transfer from these platforms is not possible. For the recommended workaround, refer to Transfer from Shopify, Block, or Wix.

Cloudflare may send a verification email to your registrant contact email address when you register or transfer a domain, or when you update your registrant email. Per ICANN requirements, if the registrant email is not verified within 15 days, a hold is placed on the domain and nameservers are replaced with a parking server until verification is complete. After successful verification, nameservers are automatically restored.

Verification is triggered when your registrant contact email differs from your verified Cloudflare account email.

Some TLDs — including .mx, .nz, and .ca — may send verification through a third-party service. In these cases, the verification email will come from noreply@emailverification.info rather than Cloudflare. Check your spam folder if you do not receive it.

For these TLDs, if verification is not completed in time, the registry may temporarily replace your nameservers with ns1.emailverification.info and related hostnames until the registrant email is verified.

.uk, .co.uk, and .org.uk domains do not use the standard auth-code transfer flow.

Instead, the losing registrar changes the domain's IPS tag to the gaining registrar. If you are transferring a .uk family domain to Cloudflare and cannot find an auth-code field, this behavior is expected.

If the transfer does not proceed, contact the current registrar and confirm that they have updated the IPS tag correctly.

1. In the Cloudflare dashboard, go to the Manage Domains page.

   Go to Manage domains ↗

2. Find the correct domain and select Manage.

3. Select Cancel Transfer and Retry. After you initiate the retry, you must re-enter your auth code and confirm your WHOIS information.