I am about to move a domain created on one deSEC account onto another. It started out on my personal account, but I need to detach it onto a colleague’s. Searching the Discourse, I see this question asked before:
We can transfer domains between users if both old and new user confirm from their email accounts. Domain names need to be listed explicitly, and we will go through a verification process with either party.
Yet, this sounds somewhat manual? I haven’t detected a transfer button anywhere.
Would it be of interest to make this an automated feature so that it doesn’t require manual intervention? I’m transferring 2 domains (say, foo.xyz, bar.xyz) + 2 additional zones on one domain (say, hello.foo.xyz, world.foo.xyz). I would be happy to provide this feature as a contribution prior to doing the transfer, if that saves time in cases like these. I’m not sure of the security implications of making this easy.
It is indeed a manual process currently. I happens about 1-2 times a month, so hasn’t been a pressing issue.
Automation likely would most naturally work through what we call “Authenticated Actions”, which essentially are operations that require authorization through a confirmation link. So far these are stateless, but a domain transfer would involve two accounts, so either some state is necessary or the second code is sent only upon the first one’s confirmation (with the first approval encoded).
Alternatively, it may be possible to exercise the logic used in user override tokens, although it’s not immediately clear how.
Finally, there’s a question whether to purge the domain (remove all RRsets except NS) during transfer or not. We normally do that unless there is consent to keep contents. This may need some sort of switch, and that consent may have to expire under certain conditions (but which?).
