Please use the “Print” function at the bottom of the page to create a PDF.
As of December 6, 2025, Germany has been implementing the EU NIS2 Directive to strengthen cybersecurity into national law. This results in new requirements for the registration and administration of .de domains. For owners of .de domains, this means stricter rules for verifying their contact details in order to increase security and transparency on the internet.
Why do I need to verify my .de domain?
The NIS2 Directive obliges the German registry DENIC to ensure that domain holder data is complete, correct, and accessible. As your domain registrar, IONOS implements these requirements. This applies to both new registrations and existing domains.
What will change for you?
Since the beginning of 2026, DENIC has been gradually introducing stricter validation processes. This includes the following two requirements in particular
1. Mandatory email verification
Active verification is required for new domain registrations or changes to the holder's contact details.
- Procedure: DENIC initiates the verification process and notifies IONOS. You will then receive an email from IONOS asking you to confirm your data. In case of imminent quarantine or deletion, you will also be informed directly by DENIC.
- Procedure: Emails from IONOS will redirect you to a verification page where you can confirm your data via the service provider, IDnow.
- Time limit: Depending on the case, you have between 14 and 30 days to complete the verification. In certain cases, the deadline may be shorter.
2. Providing a valid telephone number
Since January 28, 2026, it has been mandatory to provide a real, working telephone number.
- "Dummy values" or placeholders will be rejected by the system.
- If you have not yet entered a correct number, please update it immediately in your IONOS account under My account > My customer data.
Deadlines and consequences of missing verification
It is important that you respond to verification requests promptly. The following procedure shows what happens if you fail to do so:
| Step | Time period | What happens? |
|---|---|---|
| Open verification | 14 to 30 days | Your domain is still actively accessible. You will receive reminders by email. |
| serverHold (DNS lock) | After the verification period has expired | Your domain is technically deactivated. Website and emails are no longer accessible. However, verification is still possible. |
| Quarantine | Up to 90 days | The domain is in a lock period. You can still make up for the verification and reactivate the domain. |
| Final deletion | After the quarantine period has expired | The domain is irrevocably deleted and is then available for re-registration by third parties. |
Please Note
In contrast to the regular deletion of a .de domain (where a 30-day recovery period applies), there is no Redemption Grace Period (RGP) for a NIS2-related deletion. It is therefore essential that you respond to verification requests as quickly as possible.
Frequently asked questions (FAQ)
My domain is suddenly no longer accessible. What can I do?
Check whether you have overlooked a verification email from IONOS. If the deadline has expired, the domain has been set to "serverHold" status. Carry out the verification immediately to reactivate the domain. If you have any questions, please contact IONOS Customer Service.
I missed the first deadline – is my domain lost for good?
No, not immediately. Your domain will be technically deactivated after the verification period has expired (serverHold), and will then go into a 90-day quarantine. However, during this entire period you have the opportunity to catch up on the verification and reactivate your domain. The domain will only be permanently deleted once the quarantine has expired.
How much time do I have in total?
You have up to 120 days in total (up to 30 days verification period + 90 days quarantine). The sooner you act, the sooner your domain will be available again.
Will my private data now be published?
No. The NIS2 policy distinguishes between private individuals and companies. The data of private individuals remains protected in the public WHOIS directory. Only the contact details of legal entities (companies, associations, organisations) will be displayed publicly.