You unlocked the domain, grabbed the auth code, started a transfer into EuroVDC — then waited days for an approval mail that never arrives. Spam is empty. Support says “approve the FOA.” The Form of Authorization message goes to the registrant email in Whois. With Whois privacy / redacted contacts enabled, that address is a proxy or hidden mailbox; your watched corporate inbox never sees it.
After GDPR, many gTLDs mask email in public Whois. Masking helps privacy; it blinds the transfer approval chain. This article explains why FOA vanishes while privacy is on, what to open temporarily, and how DNS/mail keep running independently of the registrar move.
Where FOA is delivered
On gTLD transfers the losing and/or gaining side emails the registrant (sometimes admin) contact from Whois. If that address is proxy@whois-privacy.example or a registrar privacy forward box, the message stays there or is filtered. Watching only info@yourcompany.com shows nothing. Steps into EuroVDC: transfer a domain to EuroVDC (EPP/auth code).
Temporary privacy-off sequence
- Disable Whois privacy / ID protection at the losing registrar; confirm the registrant email is a real mailbox you control.
- Wait for Whois/panel propagation (minutes to hours).
- Confirm transfer lock (
clientTransferProhibited) is off and the auth code is fresh — lock explainer: domain transfer lock. - Restart the transfer; approve FOA in that real mailbox.
- After completion you can re-enable privacy (per TLD/registrar rules).
Some registrars also drop FOA into the control panel — check Messages / Domain alerts; do not rely only on an external inbox.
Site and mail while you wait
A registrar change does not automatically wipe nameservers. If the zone already sits on ns1.eurovdc.eu / ns2.eurovdc.eu with MX securemail.eurovdc.eu (priority 10), web and mail keep working during the FOA wait. SPF such as v=spf1 mx ip4:45.84.90.12 -all continues to authorize senders while it remains published. Product page: corporate email.
FAQ
Can I transfer with privacy still on?
Sometimes panel approval is enough. If FOA email is required, the real address must be visible or you must read the proxy box.
What if FOA expires?
The transfer times out or cancels. Refresh the auth code, re-check privacy/lock, and start again.
Is watching the admin email enough?
FOA usually targets the registrant. Admin-only monitoring can miss it — read the role labels in the panel.
Same for .tr?
.tr / TRABIS uses a different approval and document chain; classic gTLD FOA mail is not a 1:1 copy. Follow TLD-specific steps.
Will turning privacy off attract spam?
Accept a short window of exposure; re-enable privacy after the move. Longer term, use a registrant mailbox you actually monitor.
