Prompt: transfer a .ro domain from another registrar to ird

Have an agent bring a .ro domain you hold at another registrar onto ird as its registrar — using the authorization key the old registrar gives you — then host its DNS on ird with the live records copied before the nameservers change, so nothing goes dark, and verify the result. Only .ro is transferred: any other TLD is claimed onto ird DNS instead (the bring-domain-dns prompt).

Needs: the ird CLI, logged in (transfers, nameserver changes and email verification are CLI-only); the domain's authorization key from its current registrar; access to the registrant email Costs: the transfer request (credits_prices → domains.transfer; the CLI shows what it charges before asking to confirm), the record copy (domains.dns-snapshot), then the hourly zone fee (recurring.dns-zone-hourly) Group: domains & dns

Paste everything below the line into a fresh conversation. Fill in the FILL IN block first.

Task

Transfer DOMAIN to ird, keep it resolving throughout, then (if DNS_PLAN says so) move its DNS onto ird with the current records. Show me each registry request before sending it.

FILL IN

DOMAIN:       example.ro
AUTH_KEY:     FILL IN            # authorization key from the current registrar's panel
DNS_PLAN:     ird                # ird = host DNS on ird afterwards, records copied | keep = leave the nameservers alone
EXTRA_NAMES:  intranet, vpn      # subdomains to check beyond the common ones (blank = none)

Non-negotiable rules

1. .ro only. ird is the .ro registrar. Any other TLD is not transferred: its registration stays put and its DNS is claimed with dns_claim_create — stop and point me to the bring-domain-dns prompt.
2. The auth key is mine to obtain. It comes from the current registrar; never guess it. Blank AUTH_KEY = stop.
3. Copy before switching. ird dns enable --copy-existing copies the domain's current live records; it only makes sense while the domain still resolves at its old host. Enable first, switch nameservers last.
4. Don't poll the registry. ird domains actions lists queued registry requests; check once when I ask, not in a loop.
5. Confirm each charge. Show the CLI's confirmation text before answering yes to the transfer, and report any DS record before removing it.

Steps

A. Preflight. list_domains — if DOMAIN is already on the account, stop. ird domains info DOMAIN --whois (CLI, small domains.info fee) → current registrar, expiry, status; dig +short NS DOMAIN → current nameservers. Report if the domain is expired or already pending a transfer elsewhere.

B. Transfer. ird domains transfer in DOMAIN --auth-key AUTH_KEY --keep-nameservers — keeping the nameservers is what keeps the site and mail up while the registrar changes. (--use-our-dns --copy-dns is the one-shot alternative: copies the records and hosts them at once; use it only if I ask.) Show me the confirmation — what it charges and says — send it, keep the answer. The help gives no duration: ird domains actions shows the request and, when I ask, list_domains shows DOMAIN with state, transferred_in: true, expires_at.

C. Registrant email. list_domains → ownership_verification_required and registrant_email_hint. If required, ird domains verify-email DOMAIN --adopt (adopts the registrant email of a transferred-in domain; the CLI says only that verification is "needed for some changes"). Follow what it prints — expect a mail to the registrant address; if a later step refuses for that reason, say so, don't retry.

D. Host the DNS (DNS_PLAN = ird). ird dns enable DOMAIN — copy is on by default (--copy-existing; no flag for extra names — EXTRA_NAMES are checked by hand). Then dns_get_zone(DOMAIN) (CLI: ird dns records DOMAIN) → the seeded records and the zone's nameservers. Compare with dig +short <type> <name> @<old nameserver> for the apex, www, MX, TXT and each EXTRA_NAMES entry; add anything missing with dns_set_record (whole record set per name+type; TXT {texts:[...]}).

E. DNSSEC. If list_domains shows dsdata entries from the old host, ird domains dsdata list DOMAIN and, after my ok, ird domains dsdata delete DOMAIN <keytag> <alg> <digest-type> <digest> for each — the DNSSEC-safe order: withdraw DS, switch nameservers, sign on ird (step G); a DS left in place breaks resolution the moment the nameservers change.

F. Switch nameservers. The dns enable help doesn't say whether it also repoints the registry nameservers, so compare: if list_domains → nameservers already equals dns_get_zone's, nothing to do; otherwise ird domains nameservers DOMAIN <ns1> <ns2> with exactly those.

G. Verify. dig +short NS DOMAIN @1.1.1.1 lists the zone's nameservers (parents update within an hour, sometimes 24 h); dig +short A www.DOMAIN @<ird nameserver> equals the old answer; list_domains shows active, the new nameservers and the expiry. Only now, if step E withdrew a DS, ird dns dnssec DOMAIN on. The old host's zone can be deleted once the old NS TTL has passed.

Deliverable

Transfer state, registrar shown by whois, expiry, registrant-email verification status, nameservers before and after, the record table now served by ird with any record that was on the old host but not in the zone (should be none), DS status, and what is still pending on my side.