tips Beware: GoDaddy's DTVS system may jeopardize your sales!

[discobull]

For those of you that are unfamiliar with DTVS, it stands for Domain Transfer Verification Service and it's a security feature that is available to premier services accounts at GoDaddy. When DTVS is activated on an account, a GoDaddy rep has to phone an account holder to get verbal authorization for every domain being transferred out. The point of it is to add an extra layer of protection against domain theft.

I had been hesitating to activate it because it seems like a bit of a headache but after reading about so many domains being stolen, I finally decided to give it a test. Sadly, I have to report that it failed me on the very first transfer.

I sold a domain last week for $2.1K using escrow.com. The buyer paid for the domain and once the payment was approved, I had him initiate a transfer to his registrar in Australia ( he refused to open a Godaddy account so I couldn't get it to him with a simple push). As expected, I received the authorization request from his registrar and I approved it. The only thing left to do was to authorize it on GD's end, and the deal would have been completed last Wednesday. Unfortunately that last step never happened due to a glitch with Godaddy's DTVS system.

Apparently, once the transfer request gets to GD, a support ticket is supposed to automatically get generated which prompts a GD rep to make the authorization phone call. In this case, however, no ticket was generated. After waiting 12 hours and never receiving a call, I contacted GD and was informed that there was a problem with the ticket generation part of the process and that THERE WAS NO WAY TO MOVE FORWARD WITH THE TRANSFER! The only way they could resolve the problem was for them to completely reset the transfer and have it start over. This meant that the status of the domain at GoDaddy would be changed from "pending transfer" to "active" and that I'd have to contact my buyer and ask him to resubmit the transfer request.

The implications of GoDaddy's "fix" was a) that I was made to appear incompetent and unprofessional right in the midst of deal and b) that my deal went from being a done deal to one where my buyer would be given a fresh opportunity to cancel the transaction if he so desired. I also had to rely on him to get things moving again.

The good news is that my customer was cooperative. The bad news is that his registrar had no way to resubmit the transfer request until the first one was cancelled and they had no way to cancel the existing one. The problem is that even though the status had been reset at GoDaddy's end, the status with the registry remained "pending transfer" and as long as that's the case no new transfer request can be submitted on this domain. It currently appears as though GoDaddy is unable to reset the status at the registry level and that the only way it will change is to wait for the pending transfer to lapse ( nobody can tell me how long that takes ). Meanwhile, my buyer is set to leave on a trip this Wednesday which means that if the transfer doesn't happen before he leaves, it won't happen until mid January! Of course, this means a few more weeks where he has the opportunity to change his mind.

So, the bottom line is that what you get with DTVS is that instead of losing money on stolen domains, you might lose money on sales whenever GD's DTVS system fails. Nice trade-off, huh? Does their DTVS system fail often? I have no idea. I just know that it failed for me 100% of the time that I used it. Needless to say, I'm not very happy with GD at the moment.

 

[nvdomains]

Thank you for sharing.

 

[JayJay]

Does their DTVS system fail often?

Somewhat curious myself as I would like to activate dtvs if this was only a rare glitch in their system. Not sure if its anything he would know about but may as well tag him.... @Joe Styler

 

[Kate]

Thanks for sharing your experience. I think the benefit of DTVS is not that obvious, except for strategic domains that normally would never move or even change DNS ie google.com facebook.com.

For those special domains, you have registry lock offered by certain registrars.

If have a good security hygiene, a clean computer, common sense, don't click on phishing links etc you shouldn't have problems unless GD itself gets hacked.

2FA is a better option.

 

[thekiller]

2FA is good imo as already stated. Instant and secure.

 

[discobull]

Thanks for sharing your experience. I think the benefit of DTVS is not that obvious, except for strategic domains that normally would never move or even change DNS ie google.com facebook.com.

For those special domains, you have registry lock offered by certain registrars.

If have a good security hygiene, a clean computer, common sense, don't click on phishing links etc you shouldn't have problems unless GD itself gets hacked.

2FA is a better option.

Yeah, I already had 2FA turned on. I was just feeling paranoid and thought that activating DTVS couldn't hurt. I now know better.

 

[Joe Styler]

I would have to know more details to look into the specific case, but I think it is pretty rare for a domain name to get stuck because of a missed DTVS. I have it on my account and I wouldn't take it off but of course I wouldn't want to lose a sale and that would upset me as well. I can only say to my knowledge issues with DTVS are pretty rare.

 

[SpareDomains]

I've never had an issue but I've never told a buyer to submit the transfer. After payment is good in Escrow then I personally call my GoDaddy account rep and tell him what domain is sold and then he rings me back and I tell him my security passcode and then I tell the buyer to do his thing and my account rep is then expecting it to hit approve on. Has delayed a sale when my guy was off duty but just a short delay. I've thought of just using 2 Factor to kill any delay but still use 2 Factor and DTVS as delay so far has been minimal.

 

[Joseph Green]

I've encountered countless issues with GoDaddy's DTVS, but like Joe said, I wouldn't risk removing it from my account.

Tips

• Do not miss the DTVS call; if they can't reach you after 72 hours, DTVS fails.
• If you have a dedicated GoDaddy account rep, hope that he/she doesn't go on vacation, because then your DTVS request will most likely not get handled within 72 hours, and then DTVS fails.
  (DTVS is supposed to be transferred to another rep, but in my experience, it either fails to do so or that receiving rep fails to pick it up; I always have to call in myself to make them find it and get it done.)
• Use a landline if possible, because if your mobile phone has poor reception, after the DTVS rep fails to reach you thrice, DTVS fails
• Account Changes are even worse with DTVS. Once you confirm the transfer, you must open the Domain Manager on your account, then Domains, then Pending Account Changes, then Outgoing Account Changes, then select the domain(s) being pushed, and then click Resend Email before the receiving account holder (your buyer) will ever know it is ready and can accept it.
  (DTVS prevents this email from being sent automatically, and it is not sent once the DTVS is approved.)
• There are more caveats, but they occur less frequently. The system is full of bugs at every turn, but it does protect the domains from being stolen, which is most important.
• Dynadot has simpler and superior protection options, in my opinion. I always transfer my domains there when it's time to renew.

Good luck with future deals!

 

[discobull]

This gets better. The domain in question is apparently no longer in my GoDaddy account. Despite GoDaddy telling me that they had cancelled the transfer, the whois for the domain is now showing that the domain is currently in the control of my buyer's registrar.

So, in addition to causing me a great deal of aggravation and embarrassment, DTVS apparently didn't even serve the purpose for which it was intended because the transfer happened without my ever having received the authorization phone call.

 

[Joe Styler]

That seems very strange to me. I would like to know the domain name so I can look into it. I have seen us expedite transfers out after clearing DTVS in the past but to know what happened I would need to know the domain. It does not seem like a dtvs issue from how you are explaining it. I have a couple guesses but would need to know the domain to know for sure.

 

[discobull]

That seems very strange to me. I would like to know the domain name so I can look into it. I have seen us expedite transfers out after clearing DTVS in the past but to know what happened I would need to know the domain. It does not seem like a dtvs issue from how you are explaining it. I have a couple guesses but would need to know the domain to know for sure.

This wasn't expedited, it was delayed. The transfer request was placed by my buyer last Tuesday/Wednesday ( he's in Australia so there's a big time difference). I approved the request when I received the email from the receiving registrar but never received a DTVS call. GoDaddy support then told me that the DTVS ticket wasn't generated due to a glitch and that the only way to put this transfer through would be for them to reset the transfer and then have my customer resubmit the transfer request through his registrar. Unfortunately my customer was unable to resubmit the transfer because the domain was still in pending transfer status at the registry. My buy and I have wasted time the last bunch of days trying to figure out how to get a new transfer request submitted, but it turns out the original transfer wasn't cancelled after all and that it went through after the full 5 to 6 day transfer period.

 

[Domain Lead Finder]

Just put in a long secure password with lots of numbers and symbols. No need for additional security IMO

 

[Joseph Green]

never received a DTVS call

it went through after the full 5 to 6 day transfer period.

That is a serious issue for the security of our domains. The transfers always fail when I run into problems with DTVS, but what you've reported is far worse.

Please send Joe the domain name in a private message so he can investigate and provide us all with an update on exactly what happened.

 

[Joe Styler]

Yes if I can get the domain name I would be able to tell you what happened. Without it, I'd just be speculating but DTVS is pretty secure in my experience and as I said it is something I use personally.

 

[TheWatcher]

I have no plans of using DVTS for domains I sell. It will definitely slow the transfer process.

 

[Joe Styler]

It is set up to ideally be used for accounts with high value domains. So most of those are not quick sales although it does happen from time to time. Ideally if you had a domain name like namepros.com that you are actively using for a business or 888.com that is very valuable you would want the extra security on the domain. On most names 2FA is a great option so if I had ArizonaChiropractor.com I may only choose to have that with 2fa and allow for a quick sale. You can have two accounts with GoDaddy and only enable DTVS on one of them. Keep in mind DTVS is not offered to all customers and is reserved for our premier services customers, as it is a manual check done by your account rep. The reason we prefer to have your account rep call is that they know you and your voice and if something seems suspicious they can help protect you.
We also have a protected registration which is even more strict than the DTVS option and available for any customer to buy for their domain, this protects it from leaving your account and also enables an extra year of registration to the domain name if it expires and you didnt renew it in time so it won't drop. This is not fast to remove and involves filling out a form and proving you are the account owner with a valid govt issued ID etc.
The best approach for security is layered and not a one size fits all service. It is best to review your portfolio and determine the amount of security you want on each type of domain you own and weigh the pros and cons of each in your overall strategy. We have options for many scenarios allowing you to be as secure as you would like.

 

[discobull]

Yes if I can get the domain name I would be able to tell you what happened. Without it, I'd just be speculating but DTVS is pretty secure in my experience and as I said it is something I use personally.

I don't mind letting you know the domain name, but I'm going to wait until after the escrow transaction is completed. Cheers.

 

[Joe Styler]

Sounds good but either way send it to me in a pm please. I dont mind sharing what I find out publicly if you dont but I think its better to not mention the name.

 

[discobull]

Sounds good but either way send it to me in a pm please. I dont mind sharing what I find out publicly if you dont but I think its better to not mention the name.

PM is my preference too.

 

[Ali]

Sorry to hear. I've never encountered and issue with DTVS personally. I have it on both my personal and professional accounts, and it's been a seamless process thus far.

 

[Recons.Com]

is DTVS per name thing or you can choose it on the account level only?

 

[Joseph Green]

is DTVS per name thing or you can choose it on the account level only?

Account level only.

 

[DN_Hunter]

I have DTVS turned on in my account. I haven't had any issues with it. Yes, there is a slight delay -- If I don't hear from my Service Rep within a couple of hours, I usually call directly to get the ball rolling.

One note -- Account Transfers also need to go through the DTVS process. So even if you were pushing to another GoDaddy Account, you still need to go through the Phone Verification process.

Overall, I like the extra protection of DTVS on my account. Although most of my names aren't worth that much (why oh why do I keep renewing them - LOL).

Regards,
DN