Home
/
Common Troubleshooting
/
NIS2 Compliance

NIS2 Compliance

EU Directive 2022/2555 Article 28 — domain registration data accuracy

The NIS2 Directive (EU 2022/2555) is the EU's updated cybersecurity legislation, in force since January 16, 2023, with member state transposition deadline October 17, 2024. is the key provision for the domain name industry, requiring TLD registries and domain name registration service providers (registrars, resellers, privacy/proxy services) to collect and maintain accurate and complete registration data.

⚠ Transposition status (as of April 2026): Only 10 EU member states have completed transposition (Belgium, Croatia, Finland, Greece, Hungary, Italy, Latvia, Romania, Slovakia, Lithuania). The remaining 17 are still in process, meaning their national ccTLD registries may not yet enforce NIS2 requirements.

Requirements

Accurate data: Registries and registrars must collect and maintain accurate and complete domain name registration data. This includes registrant name, email, phone, and address.
Data verification: Entities must implement processes to verify the accuracy of registration data. Verification methods may include email confirmation, phone verification (SMS/voice), and document-based KYC for high-risk cases.
Public disclosure: Non-personal registration data must be made publicly available without undue delay. Personal data subject to GDPR.
Access requests: Legitimate access requests for non-public data must be processed within 72 hours. Registries and registrars must publish data disclosure policies.
Cooperation: TLD registries and registration service providers must cooperate to avoid duplication of data collection.
Scope: Applies to registrars, resellers, and providers of ancillary services (including privacy and local presence services). Both registrars and resellers share responsibility.

Registry Implementation Status

.DE (DENIC): Active since December 2025. Phase II enforcement from 14 April 2026 includes trustee elimination, mandatory email verification, and strict address validation. Phone number mandatory for domain holder. Email validity verified. Automated data validation with risk assessment. Adverse risk level triggers mandatory holder verification. Failure results in contract termination and domain deletion.
.SE (IIS): Active since January 2025. New registrations flagged for NIS2 data verification. From May 2025: existing domains flagged. ServerHold applied for inaccuracy: domain stops resolving, cannot renew/transfer, expires on scheduled date. 60-day correction window.
.FI (Traficom): NIS2 regulation M68 in force August 18, 2025. Cyber Meter (Kybermittari) required from registrars by January 31, 2026. Registrars must collect/maintain accurate WHOIS data. 72-hour response to legitimate access requests.
.HR (CARNET): Active since February 2025. Mandatory domain owner identity verification for all registrants. Documentation required: ID card/passport for individuals; company registration extract for organisations. Unverified domains flagged for suspension and deletion. One of the strictest EU ccTLD verification regimes. Retroactive review of all existing .hr registrations.
.DK (Punktum dk): Final executive order effective January 1, 2026. Verification needed at registration (email or phone, one is enough). 72-hour grace: domains may activate before validation, suspended after if unverified. Company data public in WHOIS from July 1, 2025.
.BE (DNS Belgium): Stricter validation during creation and updates. Name, org, street, city must have at least one alphanumeric character. Street and city must not be identical. Postal code syntax validated per country. Phone number length validated per prefix.
.IT (NicIT): Italy transposed NIS2. NicIT may enforce additional data accuracy requirements. Existing "Bad WHOIS" procedure strengthened.
.NL (SIDN): Netherlands transposition in progress. SIDN may implement additional registrant verification. WHOIS privacy already removed by SIDN.
.FR (AFNIC): AFNIC operates under French NIS2 transposition. Standard obligations apply. No additional registry-specific NIS2 measures documented yet.
.EU (EURid): EURid operates under Belgian jurisdiction. Belgium has completed transposition.

Non-EU Registries

.CH (SWITCH): Switzerland not EU/EEA. NIS2 does not directly apply. SWITCH may implement equivalent standards.
.UK (Nominet): UK not subject to EU NIS2. Nominet operates under UK regulations.
.NO (Norid): Norway is EEA. NIS2 applies via EEA agreement. Latest policy version: August 2025.
.IS (ISNIC): Iceland is EEA. NIS2 applies via EEA agreement.
.LI (SWITCH): Liechtenstein is EEA. NIS2 applies via EEA agreement.

Impact on InterNetX / AutoDNS Operations

Contact data quality: Email and phone are becoming mandatory fields across EU ccTLD registries. Single-letter names, obviously fake data, and temporary email services increasingly rejected.
Verification workflows: New verification events will be triggered by registries. Failure to complete verification within registry deadlines leads to domain suspension (ServerHold/clientHold) or deletion.
Privacy/proxy impact: Privacy and proxy services must maintain actual registrant data internally. Registrars remain responsible for data accuracy even when privacy services are used.
72-hour access: Legitimate access requests for non-public data must be processed within 72 hours. InterNetX must have procedures in place to handle these requests.
Penalties: Non-compliance may lead to substantial financial fines and liability for natural persons who failed to ensure compliance (.6).

⚠ Operational guidance: Review all EU ccTLD contact data for accuracy before registry enforcement deadlines. Ensure email and phone fields are populated and valid for all EU-jurisdiction domains. Monitor registry announcements for TLD-specific NIS2 enforcement dates.

B2B Reseller: What You Need to Do

⚠ DENIC Phase II enforcement begins April 14, 2026. From that date, .de domains with unverified or inaccurate registrant data are subject to automated risk assessment, quarantine, and deletion. You as the reseller are responsible for ensuring your domain portfolio and your end-customers are ready.

What Needs to Be Verified

Email verification (OcVal): Registrant must confirm their email by clicking a link sent by AutoDNS within 14 days of registration, transfer, or owner contact change. Required for all TLDs. DENIC may also request verification at any time without a specific trigger (random sampling); holders then have 30 days to confirm.
Address validation: Registrant address checked automatically against reference data when created or updated. Grades A, B, C pass. Grades D and E trigger a warning and require correction. Contact creation or update fails with error code EF01152 on D or E ratings. To override, pass ignoreAddressQuality as a query parameter key (API) or click "Confirm Address" in the AutoDNS Platform pop-up. To re-trigger validation on update, use recheckAddressQuality.

Consequences of Non-Verification (by TLD)

.DE (DENIC): DENIC runs automated risk assessment from April 14. Unverified contacts trigger verification request to InterNetX. You have 7 days to resolve. If unresolved: 90-day quarantine with DNS deactivated. After 91 days: domain deleted.
gTLDs (.com, .net, .org): EPP clientHold applied at registry level. Domain stops resolving immediately after the 14-day window expires.
ccTLDs without clientHold (.fr, .nl, .uk, .at, .ch, .be, .it, .es, .pl, .dk, .pt): InterNetX redirects nameservers to a suspension landing page explaining the issue and providing verification instructions. Original NS restored automatically once verification is completed.

⚠ In all cases, an unverified domain means your end-customer's website and email go offline. The liability sits with you as the reseller if you failed to ensure verification was completed.

How to Audit and Manage Verification in AutoDNS

Go to Contacts in AutoDNS.
Filter by email verification status to show unverified ownerC contacts.
Filter by address validation status to show contacts graded D or E.
Prioritise .de ownerC contacts first (April 14 DENIC deadline).
Use the Re-send Verification button on any contact to trigger a new confirmation email.
For failed address validation: open the contact, correct the address, save. Validation re-runs automatically.

Handling DENIC Verification Requests

Notification: InterNetX relays DENIC requests via your registered notification channels (email, API, or both).
Review: Open the flagged contact in AutoDNS. Review the data. If accurate, manually confirm. If not, contact the registrant to correct first.
Confirm: Confirmed status transmitted to DENIC. Request closed.
Deadline: 7 days from notification for DENIC verification requests. Do not let it expire. For separate DENIC identity check cases (IDnow-based), the holder has 30 days. Reminder cadence: InterNetX every 3 days, DENIC 7 days before window ends, reseller 5 days before deadline.

Manual Verification Path

Automated identity verification via IDnow is the primary verification method. IDnow supports German, English, French, Spanish, and Portuguese (the web app adapts to browser language). Verification emails are sent from do-not-reply@domain-robot.org and use the same design as existing ICANN verification emails. For ORG contact types (organisations), a natural person can be nominated to complete the verification, with a final step confirming the verified person's data matches the domain holder organisation's data. A manual verification path will be available as a secondary option for edge cases where automated verification is not possible (e.g. registrant cannot complete IDnow, address not in reference databases). When you manually confirm data, you accept legal responsibility for its accuracy. InterNetX logs all manual confirmations with timestamp and user ID.

When to use: End-customer cannot complete IDnow automated verification (technical issues, unsupported ID document). Address fails automated validation but you have independently confirmed it is correct (e.g. newly built address not in reference databases). DENIC request arrives within 7-day window and automated path is not available for this registrant.
Tooling timeline: Automated identity verification (IDnow) is deployed first. A manual verification path for edge cases will follow. Full address validation (Loqate) for the complete B2B portfolio is targeted for Q3 2026.

What to Communicate to Your End-Customers

Email verification: Mandatory and time-limited. When they receive a verification email from AutoDNS, they must click the confirmation link within 14 days. If they don't, their domain will be suspended.
Address accuracy: If AutoDNS shows a validation warning on their contact record, they need to correct it before April 14.
Domain suspension: If suspended, contact you immediately. They will see a suspension landing page instead of their website. The sooner they act, the sooner it is restored.
WHOIS visibility (.de): For legal entity registrants: company name, address, email, and phone are now publicly visible in DENIC WHOIS from January 28, 2026.

Trustee Elimination (.DE)

From 14 April 2026, a German-based domain holder or AdminC is no longer required for .de registration. Trustee service is no longer necessary for foreign individuals or companies without a German branch.

Operational implication for existing trustee-held domains: a failed email verification on a trustee contact can cascade and deactivate all domains held under that same trustee. Existing trustee-held .de domains should be updated to the actual registrant before the next email verification cycle. External trustees should be informed of the new DENIC requirements.

Suspicious Handles

A suspicious handle is an ownerC contact flagged by DENIC's risk assessment as potentially non-compliant: unverified email, failed address validation, data anomalies, or registration behaviour that triggered a risk score. From April 14, each suspicious handle is a potential DENIC verification request. Each unresolved request is a potential domain quarantine.

ℹ Do not wait for DENIC to flag them. Run the AutoDNS contact filter now and remediate proactively. Contacts with failed address validation or unverified email status are your starting point.

Notification Setup Checklist

✓ Contacts current: Confirm notification contact details are current in AutoDNS.
✓ API webhook: If using API: ensure webhook endpoint is active and tested.
✓ Named owner: Designate a named person in your organisation who owns the NIS2 verification request queue.
✓ Test path: Test the notification path before April 14. Do not discover it is broken when the first live request arrives.

Urgent Cases

Contact InterNetX support and reference NIS2 in your ticket. For urgent cases (domain already suspended, quarantine notification, 7-day window at risk), mark as high priority and include: the domain name, the affected ownerC handle, the DENIC notification reference if available, and the date the 7-day window expires.

API task references

Key AutoDNS API tasks: 0374 (inquire single case), 0375 (list cases). Address validation runs during ContactCreate and ContactUpdate.