.DE NIS2

Risk levels — consequences and deadlines

Deadline timeline — from suspicious to deletion

What happens if a flagged domain is not verified in time:

What Realtime Register handles for you

We've built DENIC's requirements directly into the platform. For Phase 2, you can rely on us for the following:

Verification methods — what can prove what

DENIC accepts three claims — name, address and email — and defines which evidence (proof documents) combined with which method (how it was checked) can support each claim. Below is the full matrix, aligned with DENIC's specification.

What you need to do

1. Clean registration data — for every new .DE order, make sure the holder's name, address, country, phone number and email are accurate and complete. Dummy values or placeholders are the single biggest cause of "suspicious" risk flagging.
2. Make the customer click the confirmation email — our contact-validation mail is what DENIC accepts as proof of email reachability. If it's ignored, the email claim is unverified.
3. Brand your outgoing emails — set up your brand and WDRP template so confirmation mails look familiar to your customers and don't get mistaken for phishing.
4. React to verification requests quickly — when DENIC flags a domain, we notify you. For suspicious domains you have 14 days; for high-risk domains you have 90 days after de-delegation. Verification information (ID card, company register, etc.) must be supplied through our platform within those deadlines.
5. For organization holders — be ready to provide a company-register extract (company_register) or a formation document (company_statement) if DENIC asks.
6. Keep holder contact data under control — a holder change (domainCHHOLDER) retriggers risk assessment. The verification deadline follows the current holder and does not reset when the holder changes.

Frequently asked questions

Does every .DE domain require manual verification?

No. Only domains that DENIC's risk assessment flags as suspicious or high require evidence-based verification. For the majority of domains with clean, accurate data, our automatic email verification is sufficient for the email claim and the domain scores low risk.

What's the difference between domainCREATE and domainUPDATE for verification?

Both trigger a risk assessment. A domainCREATE puts the domain into pendingCreate while the assessment runs. A domainUPDATE runs the assessment on the existing domain and can transition it from connect back to pendingCreate if needed. The outcome (low/suspicious/high) works the same way. Holder changes (domainCHHOLDER) and provider changes (domainCHPROV) also trigger assessment.

What happens if a domain is deleted after failing verification?

It's gone. Unlike normal deletions, domains deleted for failed verification are not eligible for the Redemption Grace Period (RGP). The only path back is a new registration once the domain becomes available again.

Can we pre-verify holders before anything goes wrong?

Yes — and we recommend it for business-critical domains. If a contact already has a successful verification on file at DENIC, every subsequent request using that handle is automatically scored as low risk.

Does a multi-holder domain need every holder verified?

Yes. If the domain has more than one holder, every holder contact must be verifiable when DENIC asks.

Is the email confirmation click timestamped and logged?

Yes. We store a transaction log with the timestamp of the confirmation, the event reference and the outcome — this is what DENIC accepts as the email_ver_transaction_log evidence. DENIC requires this evidence to be retained for 12 months.