In 2026, the domain industry is experiencing its most significant regulatory shift in years. New requirements for domain registration, transfers, and modifications have been introduced to enhance internet security.

Two major frameworks are driving these changes:

• EU NIS2 Directive (Article 28): This EU-wide cybersecurity legislation mandates that all registries (such as DENIC for .de) and registrars must verify the accuracy of registrant data. The goal is to eliminate "anonymous" domains used for phishing and malware.

• Updated ICANN Registration Data Policy: Globally, ICANN has tightened requirements for generic top-level domains (e.g., .com, .net, .org). Registrars are now required to implement much stricter validation processes for Registered Name Holders.

For you as a domain owner and for your clients, this means that two major changes have come into effect for every domain registration, transfer, or update:

• Contact Validation (applies to every domain)

• Data Verification (currently applies only to some domains)

Domain Contact Validation

Every domain registered or transferred must have a valid email address as a contact. In this case, you will receive an email from our provider asking you to confirm your email address. Unfortunately, these emails often end up in the spam folder. Please wait a few hours after registration; if you have not received an email by then, play it safe and contact us directly.

Please be aware that if the domain is not validated or the data is not verified when requested, there is often no direct warning in the Project Manager or Domain Manager. After a few days, the domain will simply be suspended and taken offline. Your active cooperation in this process is mandatory.

Verification of Domain Data

Domains must have correct owner details at the time of registration or transfer. Verification is carried out via a request from us for identity proof (ID upload).

Currently, this does not affect everyone. Most registrars use a risk-based validation model. This means a manual ID check is not triggered for every purchase, but rather by:

• Compliance Audits: Random checks by our registrar to ensure the database meets new legal standards (this is the primary reason for us).

• Discrepancies: Mismatches between payment data, IP address, and the registrant’s contact details.

• New Customer Profiles: Stricter scrutiny for accounts that have recently started managing a high volume of domains.

This adds a slight overhead to the onboarding and registration process for agencies, web designers, and private users alike.

Recommendations

• Inform Clients Early: Let your customers know that a registrar-led process might be required. Usually, a copy of the domain owner’s ID and often an official business document are requested.

• Important Security Note: Advise your clients to add a watermark to their ID for security purposes! As soon as the process is complete, please delete the ID copy from all your devices immediately.

• Precise Data: Ensure that the "Owner-C" (registrant contact) data is 100% accurate from the start. Correct data minimizes the risk of manual audits.

• Act Quickly: When verification is requested, there is usually a strict deadline (often only 7–15 days). If the data is not provided, the domain will be suspended and eventually deleted. Since the process is random, it is best to contact our support team immediately after you have registered or transferred a domain. We can then promptly check if verification is necessary.

If you have any questions or are unsure about the status of your domains, please reach out to us! We are here to help.

Sources

Official Sources: Richtlinie (EU) 2022/2555 (Amtsblatt der EU) – Article 28
Official Sources: Bundesamt für Sicherheit in der Informationstechnik (BSI) - Informationen zur NIS-2-Umsetzung
Official Sources: ICANN Announcement: Registration Data Policy Now In Effect (August 2025)