.DE Domain NIS2 Compliance

DENIC is updating .DE domain registration rules to comply with the EU NIS2 Directive. These changes affect registrant data requirements, WHOIS publication, and identity verification - and apply to both new and existing .DE domains.

Key Dates at a Glance

What Registrant Data Is Now Required

For all new registrations, ownership transfers, and contact updates, the following information must be accurate and complete:

• Full name (real first and last name)
• Organisation name (required for legal entities)
• Valid email address (must be verified)
• Valid phone number (no placeholders or dummy numbers)
• Full postal address - street, house number, postcode, city, and country

What is Published in WHOIS

The following information is publicly visible for all .DE domains:

All Domains

• Domain registration date
• Managing DENIC member name, address, email, and phone number

Legal Entities (Companies & Organisations)

• Name, address, email address, and phone number

Private Individuals

• Registration date
• Administering DENIC member (personal details are not published) 

Organization (Org) Field Must Be Left Blank for Private Individuals

When submitting or updating registrant contact data for .DE domains:

• The Organization (Org) field is now optional.
• If the registrant is a private individual, the Org field must be left empty.
• The Org field should only be completed where the registrant is a legal entity (e.g., company or organization).

Please ensure your registration and update processes reflect this requirement.

Email Verification

Here is how it works:

• When a new or updated registrant email address is submitted (and has not been previously verified), a verification email is sent to the registrant.
• The registrant must click the verification link to confirm their email address.
• If the verification is not completed, DENIC will be notified. Failed verification results are submitted to DENIC on day 31 after the initial registrant verification email was sent. A 7-day risk assessment process will then be triggered.
• Please refer to the email verification process outlined in here for further details.

Annual WHOIS data reminders

• Domain holders will receive annual reminders to review their registration data.
• Any missing or inaccurate information must be corrected.

Transition period for existing domains

• Existing .DE domains that do not include a telephone number must be updated within one year, by April 2027.
• Resellers are expected to review their portfolios and coordinate with registrants to ensure that any missing data is completed within the required timeframe.
• Failure to update the missing information may trigger a risk assessment and could result in the domain being suspended or permanently deleted.

Risk Assessments & Verification Procedures

DENIC applies a risk-based approach to assess registrant data quality. A risk assessment may be triggered in the following situations:

• Registrant data appears invalid, incomplete, or suspicious
• Registrant email verification fails
• A registrant violates DENIC policy
• A new registration, ownership change, or contact update

Important: All domain names associated with a registrant handle that has been flagged for risk assessment may be suspended if the verification is not completed. This applies not only to a single domain name, but to all domains linked to that registrant handle.

DENIC does not proactively verify registrant data but may initiate a risk assessment where potential irregularities are identified. 

30-Day Risk Assessment

Applies when registrant data is flagged as potentially invalid.

Please note: OpenSRS processes these cases manually. As a result, it may take up to 48 hours to issue the initial notification to the reseller for further action.

7-Day Risk Assessment

Triggered when email verification fails or a DENIC policy violation occurs. The same quarantine and deletion process applies as above (please refer to the above table), but the reseller or/and registrant only have 7 days to respond before the domain enters quarantine.

Verification Handling During Holder Changes

When a domain is flagged for verification, verification must always be completed for the current (active) holder at the time of processing — regardless of who originally triggered the request.

Inaccurate data can be corrected by processing:

• Owner change
• Contact update

Example Scenario

• Domain: domainname.de is registered under Handle 1 – "John Smith"
• A verification request is triggered
• Before verification is completed, the holder changes to Handle 2 – "Mark Schmidt"
• Result: Mark Schmidt must be verified

Key Rules

1. Verification follows the current holder. If the holder changes while verification is pending, the new holder is the party that must be verified.
2. Deadlines do not reset. Changing the domain holder does not restart or extend the verification deadline — the original clock continues to run.

Compliance

• To prevent suspension, the current holder must be successfully verified before the original deadline. There is no alternative way to clear a pending verification.
• Important: Domain(s) linked to the affected registrant handle will be placed on serverHold during the 90-days quarantine period. Suspension may apply to all domains linked to the unverified registrant handle.

Acceptable verification documents

Depending on the registrant type, DENIC may request supporting documentation:

Natural persons

• Passport or national ID
• Utility bill
• Bank statement
• Payment verification
• Video or on-site identity verification

Legal entities

• Commercial register extract
• Founding documents
• Federal Gazette entry
• VIES request
• Comparable official documentation.

List of Proofs

• The table below lists the proofs accepted by DENIC.

Here is the list extracted from the image:

Reseller Action Checklist

Use this checklist to ensure compliance:

• Communicate NIS2 requirements to your customers.
• Ensure all existing .DE registrant records include a valid phone number (deadline: April 2027).
• Ensure that all registrant email addresses are verified at all times.
• Monitor verification request emails - resellers will be copied on all requests.

Was this article helpful? If not please submit a request here