Is it possible to require more than one person to change a domain owner?

Question

I accidentally changed the owner of a .com domain to myself when I switched registrar, apparently because I didn't understand the procedure correctly. I subsequently changed the owner again to the original owner.

I don't believe that in larger companies a single person can change the owner of the domain. So how does it work? Perhaps they use registrars which have different procedures in place than "the registrant or the administrative contact can do it alone" that Namecheap has? Or do they have some kind of alarm that sets off when the email that says "if you don't do anything within 7 days the domain owner will be changed"? It seems hard to me to make the latter failsafe.

Answer 1

First, a change of registrar is only that: only the registrar should change, at least this is what the registry will record in its database. Normally nothing else changes.

But, when you go to the new registrar to request a transfer, you typically have to enter all data regarding contacts, as:

• it can be difficult from the registrar to know this current data (whois is certainly not of help here, and even through EPP there may be restrictions)
• it may want anyway to have "clean" data (and not go forward with whatever is there now) and hence asks the customer to enter it again.

But remember that, typically (there are exceptions in some TLDs), but at least exactly for .com domain names, to transfer the transfer you need to know the authInfo, also called the authcode or domain password, etc.

Typically, only the current registrant of a domain knows it (or can make the current registrar give it to him). Which has then the following consequence: anyone knowing the current authInfo value may probably gain complete control on the domain.

So your issue is separate from an "owner change", which can happen at any time during the life of a domain name, irrespective to it being transferred between registrars.

How an owner change happens depends on both the registry (TLD) and the registrar own procedures, but the following can be said that should reply to all the questions in your last paragraph:

• in gTLDs, owner changes are now basically handled like transfers regarding authorizations. See https://www.icann.org/resources/pages/transferring-your-domain-name-2017-10-10-en for a starter and the associated FAQ: https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en
• a registrar can have a procedure to make changes difficult to exactly address your fears: for example the change may need to happen out of band, with proofs from current registrant (ex: on company letterhead, for what it's worth); this is typical for "company" domains when handled by specialized registrars
• of course notifications can also happen after the fact
• there can be a registrar lock or registry lock (but not in .COM currently as it is a thin registry and hence does not have contact data at the registry level so that changes there can not be controlled) in place: this means that any change to the domain will need to be authenticated by out-of-band channels like voice calling or SMS prior to any effective change
• some registrars may have systems with multi-level kind of permissions: various users have various rights on a given object (here a domain), so some can do changes, some can not, and some can do changes that will need to be approved by another user before going through.