.de Domains: NIS2 and Contact Verifications from 14 April 2026
On 6 December 2025, Germany's NIS2 Implementation Act (NIS2UmsuCG) came into force. From 14 April 2026, the resulting holder data verification by DENIC applies.
In general, NIS2 requires registries and registrars to make sure that domain holders' data is complete and correct. For you as a domain holder, this means you are responsible for keeping your data correct and up to date. If in doubt, you also need to cooperate with a verification.
You'll find the details in our article: NIS2 Directive: What does it mean for domain holders?
Which data has to be verified for .de domains?
In general, DENIC checks the following data that you provide when registering a .de domain:
- full name (for legal entities, including the legal form)
- current postal address
- email address
- phone number
Since NIS2 came into force in Germany, we verify the holder's email address for every new registration, regardless of the domain extension.
Name and address do not have to be verified for every contact of a .de domain. DENIC has chosen a risk-based model. This means DENIC checks the data stored for a domain for completeness and plausibility during registrations, trades and updates. If it finds inconsistencies, the data has to be verified. This can also affect domains that have been registered for years.
How can you verify your data?
Verification is carried out exclusively by registrars, which means by us at INWX. If a verification is necessary, our customer (not the domain contact) receives an email about it. The email explains how to verify the contact data.
If your email address has not been verified by then, you'll also receive an email with a confirmation link.
Maybe you notice during a verification that your stored data is incorrect. A simple correction is not enough in that case. If you correct the address, the domain contact still has to be verified. If you need to correct the name, you need a new domain contact and have to assign the affected domains to it. After that, you have to verify this new contact.
As long as you haven't received a request, you don't have to do anything or submit any documents.
What happens if you don't verify?
If you don't respond to a request, your domain is technically deactivated after 30 days and is no longer reachable. The domain contract does not end at that point, and the block lasts for 76 days. During this time, you can still verify and reactivate the domain. If you don't, DENIC terminates the domain contract.
If you don't respond to the verification request in time, you'll also receive an email from DENIC 5 days before deactivation and again when the domain contract is terminated.
Important: Even if your data is correct, a request that you answer too late or not at all can cost you the domain. Make sure the email address we have on file for you is up to date, so the verification request actually reaches you.
What should you do now?
- Check that your stored email address is correct.
- Make sure the stored data is correct for new registrations and updates.
- Follow verification requests.
If you receive a verification request, make sure it is legitimate and comes from DENIC or from your provider. Phishing messages imitate DENIC or us. You can recognize a genuine email by its sender domain, which is always inwx.de or denic.de. Genuine emails also never ask for payment details, because verification is free. Our checklist for recognizing phishing emails shows you more warning signs, with examples and protective measures.
Do you have more questions about NIS2 and data verification for .de domains? The registry DENIC has put together information on holder data verification for domain holders.
