Engineering Glossary · Domains
EPP code — The Auth Code Is One Step in a Transfer Runbook, Not the Whole Thing
You are moving a domain between registrars and you would rather the website and the mail did not notice.
The short answer
An EPP or auth code is a per-domain transfer credential: the string that proves a transfer request comes from whoever actually controls the name. You unlock the domain, request the code from the losing registrar, and hand it to the gaining one.
What it does not do is move your DNS. A registrar transfer changes who administers the registration; the zone is a separate thing entirely, and if it lives at the losing registrar it may be deleted once the name has gone. That ordering mistake is how a routine transfer becomes an outage.
By the HostingFast team · Reviewed 24 August 2026
100+
Terms defined properly
2 min
Read time, end to end
Plain
English, no hand-waving
24/7
Engineers on shift
The code works alongside the rest of the transfer machinery: the 60-day lock after registration or a previous transfer, the confirmation message sent to the registrant address, and the extra registration year most transfers add on.
Treat the code as a live credential with a short useful life. Each one authorises a move, a fresh one can always be generated, and it deserves the same handling as any other secret until the transfer has landed.
The order that keeps the site up
Move DNS first, transfer second. If the zone currently lives at the registrar you are leaving, recreate it at its new home, delegate to the new nameservers, verify the site and mail are being served from there, and only then start the transfer.
Do it the other way round and there is a window where the losing registrar has deleted a zone that the delegation still points at. The name resolves to nothing, mail bounces, and no amount of chasing the transfer will bring it back before the caches expire.
The pre-flight checks
Four things stop a transfer: the domain is locked, the registrant email address is stale so nobody can approve it, the name is inside a 60-day window, or the code has been mistyped. Confirm all four before you start rather than after the first rejection.
The registrant address is the one that catches people. If it points at a mailbox on the domain being moved, and the move goes wrong, the approval message arrives somewhere you can no longer read. Use an address on a different domain for anything to do with domain administration.
What the code says about a supplier
The code is your right to leave expressed as a string you can copy. A registrar that produces it immediately is acknowledging the name is yours; friction around it is the signature of a company that treats domains as leverage.
Accredited registrars are obliged to supply it within defined timeframes under the policies covering generic endings, and obstruction can be escalated to the registry or the oversight body. A registrar making the exit difficult has just made the case for using the exit.
Transfers into this platform
Unlock the name, request the code, and start the transfer from your client area. Remaining registration time carries over, and provided the zone is already in place here the site keeps resolving throughout.
NVMe storage and server-level LiteSpeed caching are on every tier, so the destination is not just a different registrar record — it is a different set of numbers when you next measure the site.
Runbooks, not reassurance
Where a task has an order that matters, the entry gives you the order. That is the difference between a reference you read once and one you keep open during the change.
Mailboxes on your own domain are included with every hosting plan, so email is part of what you bought rather than an upsell at checkout.
- 100+ entries, sequences included
- Pre-flight checks before the irreversible step
- Wired into Registrar, WHOIS and DNS
- Written by the engineers who run transfers
Why HostingFast
Standard on every plan
Order stated first
DNS before registration, every time, and the specific outage that follows from reversing it.
Auth Code, in context
One credential inside a sequence, rather than the whole transfer story.
Four pre-flight checks
Lock, registrant address, 60-day window and typos — the things that actually reject a transfer.
Administrative email warning
Why your registrant address should never live on the domain you are moving.
Supplier behaviour decoded
How quickly a code arrives tells you most of what you need to know about a registrar.
Continues into its neighbours
Domain Registrar, WHOIS and DNS carry on from here.
Quick Start
From order to online
- 1
Rehome the zone before anything else
Recreate the zone at its destination, delegate to it, and confirm the site and mail are served from there. Only then think about the registration.
- 2
Clear the four blockers
Unlock the domain, check the registrant address is a mailbox you can read, confirm you are outside any 60-day window, and copy the code exactly.
- 3
Request a fresh code per attempt
Codes are single-use in practice. Generate a new one for each transfer rather than reusing a string from a previous attempt.
- 4
Verify after it lands
Once the transfer completes, re-check the delegation and the mail records. Some registrars reset nameservers to their own defaults on arrival.
Built In
Loaded onto every plan
- Transfers started from the client area, code pasted once
- Remaining registration time carried across on transfer
- Zone editing available before the transfer completes
- NVMe SSD storage on every tier
- LiteSpeed caching built into the server
- Free SSL issued and renewed automatically
- Money-back cover: 30 days on hosting plans, 7 on reseller
- No setup charges on any plan
Frequently Asked
What people ask us most often
Will transferring my domain take the website down?
Only if you do it in the wrong order. The transfer moves the registration, not the zone — and if the zone lives at the registrar you are leaving, it can disappear when the name does. Rehome the DNS first, verify the site and mail resolve from their new home, then start the transfer and nothing notices.
What is the risk if the auth code leaks?
It is a live credential: paired with an unlocked domain it authorises a move. Each code covers one transfer and a fresh one can always be generated, so pull a new string for every attempt and treat it like a password until the transfer has landed.
Which email address should own my domain registration?
One that is not on the domain being administered. Registrant addresses receive transfer approvals and expiry warnings, and hosting them on the same name creates a circular dependency that only reveals itself on the worst possible day.
Will you migrate my existing site as part of the move?
Yes. Open a ticket with your current host's login details and our engineers bring everything across — files, databases, mailboxes and configuration — free of charge. You review the copy before DNS moves, and the old site keeps taking traffic until the new one is serving it.
Keep reading
DNS (Domain Name System)
The resolution chain that has to keep working while the registration moves.
WHOIS
The record that shows your lock state, registrar and expiry in one query.
Best LiteSpeed Hosting
A shortlist with the reasoning shown, and the trap most buyers walk into.
cPanel Reseller Hosting
The industry-standard panel scaled for resellers, with WHM included.
Domain Names
Find, register and transfer domains — first year free with annual hosting.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Move it without an outage.
Free SSL, free migration, renewals at the original rate and engineers who answer. That is the entire pitch.
View cPanel Reseller Hosting plans