diff --git a/app/models/concerns/domain/transferable.rb b/app/models/concerns/domain/transferable.rb
new file mode 100644
index 000000000..84c855a55
--- /dev/null
+++ b/app/models/concerns/domain/transferable.rb
@@ -0,0 +1,18 @@
+module Concerns::Domain::Transferable
+  extend ActiveSupport::Concern
+
+  included do
+    after_initialize :generate_auth_info, if: :new_record?
+  end
+
+  def transfer(new_registrar)
+    self.registrar = new_registrar
+    generate_auth_info
+  end
+
+  private
+
+  def generate_auth_info
+    self.auth_info = SecureRandom.hex
+  end
+end
diff --git a/app/models/domain.rb b/app/models/domain.rb
index 3abcb026a..31ef08cca 100644
--- a/app/models/domain.rb
+++ b/app/models/domain.rb
@@ -6,6 +6,7 @@ class Domain < ActiveRecord::Base
   include Concerns::Domain::Activatable
   include Concerns::Domain::ForceDelete
   include Concerns::Domain::Deletable
+  include Concerns::Domain::Transferable
 
   has_paper_trail class_name: "DomainVersion", meta: { children: :children_log }
 
@@ -79,9 +80,7 @@ class Domain < ActiveRecord::Base
     self.status_notes = {} if status_notes.nil?
   end
 
-  before_create :generate_auth_info
   before_create -> { self.reserved = in_reserved_list?; nil }
-
   before_save :manage_automatic_statuses
   before_save :touch_always_version
   def touch_always_version
@@ -497,19 +496,6 @@ class Domain < ActiveRecord::Base
     Registrant.find_by(id: pending_json['new_registrant_id'])
   end
 
-  def generate_auth_info
-    return if auth_info.present?
-    generate_auth_info!
-  end
-
-  # rubocop:disable Lint/Loop
-  def generate_auth_info!
-    begin
-      self.auth_info = SecureRandom.hex
-    end while self.class.exists?(auth_info: auth_info)
-  end
-  # rubocop:enable Lint/Loop
-
   def set_graceful_expired
     self.outzone_at = expire_time + self.class.expire_warning_period
     self.delete_at = outzone_at + self.class.redemption_grace_period
@@ -672,11 +658,6 @@ class Domain < ActiveRecord::Base
     pending_json['new_registrant_id']
   end
 
-  def transfer(new_registrar)
-    self.registrar = new_registrar
-    regenerate_auth_info
-  end
-
   def self.to_csv
     CSV.generate do |csv|
       csv << column_names
@@ -710,11 +691,5 @@ class Domain < ActiveRecord::Base
   def self.uses_zone?(zone)
     exists?(["name ILIKE ?", "%.#{zone.origin}"])
   end
-
-  private
-
-  def regenerate_auth_info
-    generate_auth_info!
-  end
 end
 # rubocop: enable Metrics/ClassLength
diff --git a/app/models/epp/domain.rb b/app/models/epp/domain.rb
index 997c77fc5..20e30fdde 100644
--- a/app/models/epp/domain.rb
+++ b/app/models/epp/domain.rb
@@ -722,7 +722,7 @@ class Epp::Domain < Domain
       if dt.approved?
         transfer_contacts(current_user.registrar_id)
         dt.notify_losing_registrar(old_contact_codes, old_registrant_code)
-        generate_auth_info!
+        generate_auth_info
         self.registrar = current_user.registrar
       end
 
diff --git a/spec/models/domain_spec.rb b/spec/models/domain_spec.rb
index fe9dae9a6..0ccc9f4fa 100644
--- a/spec/models/domain_spec.rb
+++ b/spec/models/domain_spec.rb
@@ -538,11 +538,6 @@ RSpec.describe Domain do
     expect(domain.errors[:base]).to include('Required parameter missing; reserved>pw element required for reserved domains')
   end
 
-  it 'generates auth info' do
-    d = create(:domain)
-    expect(d.auth_info).to_not be_empty
-  end
-
   it 'manages statuses automatically' do
     d = build(:domain)
 
diff --git a/test/models/domain_test.rb b/test/models/domain_test.rb
index 090fc17a5..5a244138b 100644
--- a/test/models/domain_test.rb
+++ b/test/models/domain_test.rb
@@ -5,6 +5,26 @@ class DomainTest < ActiveSupport::TestCase
     @domain = domains(:shop)
   end
 
+  def test_validates
+    assert @domain.valid?
+  end
+
+  def test_generates_random_auth_info_if_new
+    domain = Domain.new
+    another_domain = Domain.new
+
+    refute_empty domain.auth_info
+    refute_empty another_domain.auth_info
+    refute_equal domain.auth_info, another_domain.auth_info
+  end
+
+  def test_does_not_regenerate_auth_info_if_persisted
+    original_auth_info = @domain.auth_info
+    @domain.save!
+    @domain.reload
+    assert_equal original_auth_info, @domain.auth_info
+  end
+
   def test_transfers_domain
     old_auth_info = @domain.auth_info
     new_registrar = registrars(:goodnames)