I know this is a touchy subject which has been discussed a lot on this list. However, feedback from my customers has led me to think that away transfers should not go through if the admin contact does not respond to the verification instructions.
Someone tried to transfer one of my customers domains on Christmas day. I assume they timed it hoping the real owner would miss the verification because of the holiday. Even when he did read the e-mail he wasn't sure if it was real or not, and didn't deny the transfer until I told him to. Had he not denied the transfer, he would have lost the domain, from what I understand. Here is what he had to say about it: <snip> PLEASE, tell me this is bogus! If you, in fact, do allow for a domain name transfer without EXPLICIT APPROVAL from the registrant, I will be transferring all my domains to a more secure registrar immediately. </snip> It might also be a good idea for OpenSRS to review all transfers that were not acknowledged by the admin contact during this holiday break. It just seems to easy to steal a domain if you know an office will be closed for a week. ST
