Domain transfers offer no sanctions immunity for businesses in Iran

Offers to transfer Iranian businesses’ domains to Asian registrars with promises of sanctions immunity cannot guarantee continued access: moving a .com domain leaves its U.S. registry unchanged.

The distinction matters for businesses weighing transfer fees after domain outages prompted several Iranian websites to introduce alternative addresses. Disruptions began Nov. 7 and affected services including sports website Varzesh3, cryptocurrency exchange Tetherland and AI platform Hoosha.

GoDaddy, a U.S. domain registrar, has been named in reporting about the affected services. That does not establish the precise reason for each restriction. Neither the registrar’s identity nor a website becoming inaccessible is enough to determine its legal basis.

A transfer may address a particular provider’s service policies. Before paying for one, businesses need to establish which risks it can reduce and which remain outside the new provider’s control.

What a domain transfer changes

A registrar handles domain registration, renewal and transfers for customers. A registry operates the domain suffix itself, such as .com. GoDaddy is a registrar; IANA lists U.S.-based Verisign as the .com registry operator.

Transferring a .com domain from a U.S. registrar to one in Asia or Europe changes the company serving the customer. It does not change the registry behind that address. If a restriction is imposed at registry level, accepting a transfer cannot, by itself, override it.

Domain status codes help distinguish these layers. ICANN’s guidance explains that registrars set client codes and registries set server codes. A clientHold prevents a domain from being activated in the Domain Name System, so it does not resolve. A serverHold has the same effect but is set by the registry. Neither code alone identifies the legal reason for the restriction.

GoDaddy’s terms allow it to suspend, restrict or terminate services and lock domain names to comply with sanctions laws. Those general provisions do not explain why any particular domain became inaccessible.

Where the problem stems from a registrar’s own policies, moving to another provider that lawfully serves Iranian customers may reduce some risk of losing service, provided a transfer is possible. That is different from lifting a registry restriction or removing a legal obstacle arising from sanctions.

An outage is not proof of a sanctions designation

A blocked domain does not, by itself, mean its owner has been placed on a sanctions list.

The U.S. communications-services authorization in 31 CFR 560.540 treats domain registration and web hosting separately. Paragraph (b)(3) excludes hosting for websites of commercial entities in Iran from that authorization. For domain registration, it excludes services for or on behalf of Iran’s government or people and entities whose property is blocked under the cited sanctions provision.

That distinction does not support a blanket conclusion that every private Iranian business is barred from registering a domain. Nor does it establish whether a particular transaction is permitted; the applicable rules and parties still matter.

Why an “Asian” label is not enough

A registrar’s location can affect the laws governing it. It does not establish how reliably it will serve Iranian customers. Companies on the same continent may have different rules for identity checks, account suspension and the time allowed to transfer a domain elsewhere.

Buying through an Iranian company does not necessarily mean the underlying registrar is Iranian, either. The seller may be a reseller for a foreign registrar.

Before paying a transfer fee, businesses should obtain the underlying registrar’s name, its terms for Iranian customers and its process for challenging restrictions. A provider promising sanctions immunity should explain what its guarantee covers and what authority it has to reverse a registry-level block.

Without clear answers, an Asian or European address is insufficient grounds for choosing a provider.

The Resello precedent

Iranian customers have faced registrar withdrawals before. In 2017, Resello, described in the reporting as a Dutch-Indian provider used by many Iranian companies, emailed customers about new restrictions.

Our August 2017 report described a phased plan: stopping registrations for new customers from July 18, raising existing customers’ service charges from Aug. 18 and ending renewals for Iranian customers from Sept. 18. The plan would bring its four years of activity in Iran to an end.

The Tehran ICT trade association formed a working group of private companies and specialists to address the problem.

That history shows why past service to Iranian customers cannot guarantee future availability. Businesses need to know how much time they would have to transfer a domain if a provider changes policy, and what assistance the provider would offer.

They also need an alternative address set up and tested in advance, alongside a way to notify users that will remain available if the main domain stops working.