> Are you saying that (if a domain is not locked) all a competing > registrar has to do to get a domain transferred away from our profile > is "initiate" a transfer and it goes through regardless of the > confirmation or denial??
Yes, effectively. Authentication is the responsibility of the receiving registrar, not the losing registrar (Except in NetSol's world, of course) -- The nice thing about standards, there is enough for everyone to have their own.
