.DE NIS 2 Domain Registration Requirements

DENIC (the registry operator for .DE domains) will introduce significant changes to its registration and data verification processes to comply with the EU NIS 2 Directive. 

Important to note: The directive is still being transposed into German law, so definitive dates, details, and requirements remain pending and may change.

Key Dates:

From March 2025 (exact date TBC)

• Phone Number Requirement
  • DENIC will record the phone number of the domain holder in addition to existing data.

From June 2025 (exact date TBC)

• Publicly Available Data
  • Legal person (domain holder of type “ORG”)
  • Domain registration date
  • Administering DENIC member

At a Later Date (TBD)

• Additional publication of the administering RegAcc (Registrar Account) for both natural and legal persons.
• WHOIS Data Reminders (WDRP)

Transition Period

• Existing domain holder handles, where the phone number is currently missing must be amended within 1st year from the effective date. 

Mandatory & Optional Contacts

• Mandatory Contact
  • Registrant (domain holder)
• Optional Contacts
  • Admin-c
  • Billing-c
  • Tech-c

Mandatory Fields (for New Registrations & Updates)

• Name
  • Must be a valid, real name (First Name/Last Name)
• Organization (for legal entities/organizations).
• Phone Number
  • Must be valid
• Postal Address
  • Full address (Street, House Number, Postal Code, City, Country)
  • Must be valid

Important: For new contact creations or contact updates, all these fields must be accurate and complete. Failure to provide accurate registrant information during the registration process and contact updates may result in suspension.

Ensuring Data Accuracy & Completeness

Risk-Based Approach

• Regular Checks
  • Applied to new, updated, or transferred domains.
• Exception Handling
  • Existing domains in inventory are only checked upon complaints or irregularities.
• Ex-Post and Ex-Ante Verification
  • DENIC may verify data both before and after a domain is delegated.

Verification Triggers & Methods

Which Data will be verified?

• Name, address, and email address of the registrant.
• For legal entities/organizations: company name, registered address, and email.

Acceptable Proofs for Verification

• Natural Persons: ID card, passport, utility bill, bank statement, payment verification, on-site or video identity checks.
• Legal Entities: Extract from official registers (e.g., commercial register), founding documents, Federal Gazette entry, VIES request, or similar official proof.
• Other Options: Personalized letter with active confirmation, verified payments (where data is securely transmitted), confirmation by an already verified natural person.

Common Invalid Data Examples

• Names/addresses are comprised solely of special characters, digits, single letters, or repeated identical letters.
• Two-character name/address strings with special characters.
• Three-character name/address strings that include special characters or whitespace.

List of Proofs

• The table below lists the proofs accepted by DENIC.

DENIC Validation Rules:

Risk Assessment & Quarantine

DENIC applies a traffic light system for risk assessment:

Low Risk

• The domain is registered and immediately delegated.
  • The validation of the data resulted in a score in the "low risk" range.
  • All the verification results of the contact data of the domain holder submitted to DENIC by the member have the value of success.

Suspicious

• The domain is registered and delegated but requires verification within a defined period.
• If not verified in time, the domain moves to high-risk quarantine.
  • The data of the domain are suspicious because the risk assessment resulted in a corresponding score.
  • If a successful verification is carried out within the deadline, the domain is reclassified to low risk.

High Risk

• The domain is registered but not delegated.
• Placed in quarantine immediately; if not verified within the specified period, it is deleted.
  • The domain is assessed as “high risk” because the risk assessment resulted in a score in the high-risk range

Deadlines

DENIC verification timeline

Internal verification timeline

[TBC]

Publication of Domain Registration Data

Legal Persons (Contact Type “ORG”)

Publicly available via DENIC’s information services:

• Name
• Address
• E-mail address
• Phone number
• Domain registration date
• Administering DENIC member
• Administering RegAcc (Release at a future date - exact date TBD)

Natural Persons (Contact Type “PERSON”)

• Domain registration date
• Administering DENIC member
• Administering RegAcc (Release at a future date - exact date TBD)

Back to top

Was this article helpful? If not please submit a request here