I am unable to transfer an App Service Domain out to an external registrar

Hi @Joe K

Thank you for reaching us regarding the issue you’ve already generated the auth code but are stuck because you can’t update the NS records and you need to log into the underlying GoDaddy account that Azure automatically created for your App Service Domain.

Here is the recommended process for transferring your Azure App Service Domains to an external registrar such as Cloudflare.

1. Generate the Authorization Code (Already Completed)

You can successfully generate the authorization (EPP) code using the TransferOut API or PowerShell as documented. Use this code when initiating the transfer at Cloudflare.

2. Prepare the Domain at the Registrar Level (Key Requirements)

Azure App Service Domains are registered through GoDaddy (as the backend registrar) with DNS hosted in Azure DNS. Some actions required by the new registrar (such as updating nameservers) must be performed at the registrar level.
Important preparatory steps from Microsoft docs:

• Update/Verify Contact Information It is critical to have access to the email address listed in your domain’s contact information. GoDaddy sends important transactional and verification emails from a @secureserver.net address. To view or update contact info:
  1. Go to the Azure portal > Search for App Service Domains > Select your domain.
  2. In the sidebar, select Advanced domain management (preview).
  3. Select Edit contact and review/update the email address. Ensure you can receive emails at this address.
• Disable Privacy Protection (if enabled) Many transfers require this.
  1. In the same Advanced domain management (preview) blade for the domain.
  2. In the Domain Privacy section, select Disable. Note: Once disabled, privacy protection cannot be re-enabled.
• Unlock the Domain Use the Advanced domain management (preview) options to ensure the domain is unlocked for transfer.

3. Update Nameservers for Cloudflare (at Registrar Level)

• Use the contact email from the Advanced domain management (preview) blade to log in or recover access to GoDaddy at https://dcc.secureserver.net/domains.
• Change the nameservers to Cloudflare’s provided values.
• Wait for DNS propagation.

4. Complete the Transfer at Cloudflare

• Submit the authorization code (already generated) to Cloudflare.
• Ensure the domain is unlocked, privacy is disabled (if required), and it is at least 60 days old.

Reference:
https://learn.microsoft.com/en-us/azure/app-service/manage-custom-dns-buy-domain

Thank you. Following the recommended steps, I have the following issues:

Under Step 2:

• There is no option to Unlock the Domain under Advanced Management (preview)
• The contact email was successfully updated (including received confirmation emails from secureserver.net to old and new email addresses)

Under Step 3:

• I am unable to access GoDaddy at https://dcc.secureserver.net/domains - I have never established credentials here, so can't login, and I do not receive recovery emails to establish username or change password (despite having successfully received the email to confirm email change in Step 2).

Hi Joe, normally you can just request authCode and give it to new registrar. Please see my instructions on below thread:

https://learn.microsoft.com/en-us/answers/questions/5780367/how-to-request-ds-record-through-azure-for-dnssec

Thanks TP, I am following your recommendation below to transfer to a different registrar, then transfer again to Cloudflare. Seems like it will work fine, apart from the added cost (new registrar changing for the incoming transfer) and delay - I will confirm once transfer is complete.