[Updated from the original, it's not as bad as I first thought.]
I'm in the midst of correspondence with several eNom support people. The upshot is that I recommend against the "easy" default path of registering a domain through the Google Apps process.
Instead I recommend working with DreamHost (my most recent blurb on them, with discount code). They will provide a full service registrar function and any desire mix of Google Apps and standard web and web app services.
It all started when I registered a Google Apps domain for a specific project. I then realized I needed a true web server with the domain, rather than Google's moribund and dysfunctional "Sites" service.
No problem, I've done something this before, though this time I simply chose the DreamHost web+Google Apps option. I then changed the DNS settings at eNom and everything just worked (DNS propagation meant a full switch took about 10 hours, but there was no service discontinuity). I had the standard Google apps and my domain name now pointed to a web server.
[Update: Normally when you change DNS settings at a registrar I think you can enter either the IP address or the readable name (ex: NS1.dreamhost.com). Not so with eNom. The IP address won't work. Sheesh.]
Then it occurred to me that there was no obvious way to unlock the eNom managed domain name and request a domain transfer.
So I asked customer support.
I must say they answered quickly, but the answers were very confusing. I think after parsing them out (updated here, I had this wrong before) they can be moved after 60 days post-registration but the process is pretty manual and documentation is hard to find:This is the best official documentation I can find ...
To unlock your domain with eNom, please contact the eNom support team to request this action. You can reach eNom.com support via email at firstname.lastname@example.org, or via phone at 425-974-4623. These channels are dedicated to Google Apps administrators who registered a domain with eNom during the signup process...
Messy. I think I'll gradually consolidate my eNom domains with DreamHost. (To be clear, I don't speculate in domains -- I use 'em all!)
eNom does have a process for transferring domains, but it's not publicly documented.
The following is translated from what I was sent by eNom customer service. They're very responsive but I'm pretty sure they aren't native English speakers. If you email keep things very short and simple. I think the phone number option is preferable.
... in order to transfer the domain, it needs to be 60 days after registration...The domain access password business can be tricky.
... This isn't an eNom-specific rule - this is a rule for all registrars set by ICANN.
If a domain name has been registered for more than 60 days, email with a request. Include the domain access password for verification. (This isn't your Google pw -- NEVER give that out.)
Remember that in the Google Apps domain admin page there's an "advanced DNS settings" link that will display your eNom domain access password (and a link to the eNom admin page, but that's not relevant here.)
If you haven't changed the eNom domain access password Google generated you just need to include this password in your email.
If you've changed the original pw using the eNom admin page and haven't lost your new password, that's the one you put in the email (frankly I suggest phoning instead).
If you've lost your revised pw here's where you're reminded how critical it is to retain control of your email accounts (read this as a reminder!)
simply put in your domain name at the access login screen and then click on the "forgot password" link and it will be emailed to you at the address on file with Google for your domain name.Yikes. You really don't want to lose control of your Gmail account.
Once you've submitted the unlock request, in a day or so your domain will be unlocked. At that point you can initiate a domain transfer request from DreamHost (or any other registrar).
I don't know what happens next, but I suspect eNom sends you an email when they get the domain transfer request and you have to validate that. Either that or the domain transfer. Or something. I think I'll do this sometime in the next few weeks, so wait for the next update ...