MonikerMan said:
sending an email from that admin email is actually harder than it used to be...
The only way faking a return address would be harder for someone trying to steal a domain is that they
might encounter SPF or Sender-ID protection, which would block their attempted send at the mail server. Otherwise, it's as simple as doing a WHOIS query, then setting your Outlook email account to mimic the "from" email address in question, and hitting Send...
MonikerMan said:
... and then our system sends back out a confirmation to that email so you would also have to receive it - trust me it works very well along with our personal review of the transfer out logs. The extra set of actual eyes looking over transfer out logs is something that no other registrar does.
... I see now, it's the REPLY confirmation that is the actual secure portion of the process. That's fine with me, I was just under the impression that you somehow put weight on the "from" address, which is very easy to impersonate.
As it happens, I am attempting my first transfer from your registrar as we speak (you should already have received two emails from me), so I will see first hand how everything works. I have followed the advice in this thread, as well as the instructions in your control panel (which are in conflict, BTW), and will post my results here when the dust clears.
FWIW, I think there is certainly some need for a registrar that puts domain protection in the forefront for a premium, as long as they don't take offense or exert undue pressure (once identification has been reasonably provided, etc.) when someone transfers domains away from them if this protection is no longer needed.