PT NIS2

DNS.pt NIS2 — what's changing for .PT domains

From 30 June 2026, DNS.pt enforces the registrant contact validation and verification requirements introduced by Portugal's Legal Framework for Cybersecurity (Decreto-Lei n.º 125/2025), which transposes the NIS2 Directive into national law. Without a valid NIS2 status on the registrant contact, the following operations will be blocked:

New .PT domain registrations
Ownership transfers
Registrant updates that change an email address or phone number

Realtime Register handles both validation and verification steps on your behalf.

Timeline at a glance

Date	What happens
3 April 2026	Legal obligation to validate and verify registrant contacts enters into force under Portuguese law.
30 June 2026	DNS.pt starts enforcing this via EPP. Operations on contacts without a valid NIS2 status are rejected from this date.

What the rules require

The legal framework introduced two distinct obligations for every .PT registrant contact.

Validation — confirms that the contact data on record is accurate, complete, and internally consistent:

Name, address, and country
Email address and phone number
Tax identification number

Registrars have always carried data quality duties under GDPR and the Registry-Registrar Protocol. The new law makes that obligation explicit.

Verification — confirms that the email address and phone number on record are actually reachable:

The registrant must be contactable through the details provided
A contact that looks correct on paper is not sufficient; operability needs to be proven
This is the new obligation introduced by the NIS2 legal framework

Both must be completed and reported to DNS.pt before the affected operation can proceed.

Contact verification flow

Which operations are affected

Operation	Validation + verification required?
New .PT domain registration	Yes
Ownership transfer	Yes
Registrant update (email or phone number change)	Yes
Renewal	No
Other domain updates (nameservers, DNS settings, etc.)	No

Once confirmed, the status is valid for three years. After that, the contact must go through the process again before any affected operation can proceed.

Note: DNS.pt does not send expiry alerts. For long-lived contacts, tracking the expiry date at contact level in the platform is recommended.

What Realtime Register handles for you

We cover both steps before submitting any domain operation to DNS.pt.

Requirement	How Realtime Register handles it
Email validation	Runs through the existing terms and conditions acceptance flow already part of the .PT registration process. No change to the standard workflow.
Phone verification	At the point of a domain registration, transfer, or registrant update, the registrant receives a one-time code by SMS to the phone number on record. They confirm the code to prove the number is reachable.
Reporting to DNS.pt	Once both checks pass, we submit the declaration to DNS.pt via the required EPP extension. The contact is then cleared for the operation.
Status tracking	The validation and verification status and its expiry date are visible at contact level in the platform.

Note: Phone verification is triggered at the point of domain registration, transfer, or registrant update. It is not triggered when creating a standalone contact or adding contact properties.

What you need to do

1. Inform your customers about the SMS verification step

Registrants will receive an SMS during registration, transfer, or registrant update
They must confirm the code in that message before the operation can complete
The SMS relates to the domain operation, not to a security alert or account change
Without confirmation, the operation cannot proceed

2. Ensure phone numbers are accurate

The verification SMS is sent to the phone number on the registrant contact record
A missing, incorrect, or unreachable number will block the operation
Check phone number accuracy before initiating registrations or transfers for new contacts

3. Do not reverify unless required

Existing contacts that are already validated and verified keep their status
The three-year clock runs from the date of last verification
The process only repeats if that window expires, or the registrant changes their email address or phone number
There is no requirement to proactively reverify contacts before their expiry date

Frequently asked questions

Does every .PT domain require phone verification?

No. Verification is only triggered when a domain is registered, transferred, or when the registrant's email address or phone number is updated. The following are not affected:

Renewals
Nameserver changes
DNS updates
Other domain updates that do not change the registrant's email address or phone number

What happens if the registrant does not confirm the SMS code?

The operation remains pending until the code is confirmed
If the code expires before the registrant confirms it, they will need to go through the process again
Registration, transfer, or registrant update cannot complete without confirmation

Is a contact that was verified by another registrar still valid?

Yes. The validation and verification status is stored at contact level in the DNS.pt registry. If the contact was already validated and verified by another registrar and the three-year window has not expired, no new verification is required.

What is the validity period and what happens when it expires?

Validation and verification is valid for three years from the date it was last completed
After that, DNS.pt will reject any new registration, transfer, or registrant update for that contact
The process must be completed again before the next applicable operation can proceed
DNS.pt does not send expiry alerts proactively

Does the requirement apply when adding or updating contact properties?

No. Adding or updating .PT contact properties (such as the VAT number or registration goal) on a standalone contact does not trigger the verification process.

What if the registrant cannot be reached to complete verification?

If the registrant cannot confirm the SMS code, the operation cannot be completed
There is no override
Ensure the phone number on the contact is current and reachable before initiating a registration, transfer, or registrant update