.de Registry Lock

What is a Lock?

The lock (DENIC product name ".de Registry Lock") for a domain prevents manipulative, unwanted changes to the domain data.

.de Registry Lock is a paid product that members offer domain owners.

Involved

  • Domain Owner
    The domain owner specifies exactly one lock contact for a domain for which a lock is set up.
  • Lock Contact
    The lock contact must be a natural person and approves requests for a locked domain.
  • Mitglied
    For a locked domain, the member remains the contact person for the domain owner and is involved in the changed processes for a locked domain.
  • DENIC
    DENIC manually checks all orders (forms and e-mail) and carries out the changes. Finally, the participants are informed about the result. DENIC can also have the authenticity of a request for a locked domain confirmed by the lock contact.

Particularities

  • Contacts that are used for a locked domain are protected against changes by contact requests to the RRI.
  • At .de Registry Lock, requests that change the domain data are sent via email to DENIC and INFO requests are sent to the RRI server. Requests that change the domain data are rejected by the RRI server with an error message.

Request Forms mentioned in the Descriptions for easier Orientation

In this chapter, we give the underlying requests, in line with the locked domain workflows, for easier orientation, for example in the headings such as "CHHOLDER and UPDATE with a locked domain".

Which Requests are affected by a changed Procedure for a locked Domain?

  • Domain CHHOLDER
  • Domain UPDATE
  • Domain CHPROV
  • Domain TRANSIT
  • Domain DELETE
  • Contact UPDATE

Set up Lock

If a lock is set up (Lock CREATE), the domain owner (or his representative), you as a member, Lock Contact and DENIC are involved. As soon as the lock has been set up, the domain is protected against changes via the RRI.

Schematic overview - Set up Lock

Step-by-Step - Set up Lock

  1. The domain owner fills out the set up lock form and sends it to you. You can find the form at:
    • German and English

    • In addition to the domain data, the name, the mobile phone number and the e-mail address of the lock contact are recorded.

    • The lock contact confirms its details with an attached proof of identity.

    • If the lock for the domain is requested by a representative of the domain owner, proof of the representation must be provided.

  2. Please check that the form is correct and that all necessary evidence has been attached before you send the form to DENIC.

    NOTICE

    Send the form as an e-mail attachment to DBS (Kontaktinformation
    Contact information) and sign the e-mail with your master key.

  3. DENIC will check the information in the form and the evidence and will contact you, if corrections are necessary or the evidence is insufficient.
  4. DENIC then enters the lock in the registration database.
  5. DENIC informs you, the domain owner and the Lock Contact about the successful establishment of the lock.

Remove Lock

When a domain owner removes the lock for a domain (Lock DELETE), the workflow for the domain shifts back to RRI after the removal and the lock contact is no longer responsible for the domain.

Step-by-step - Remove Lock

  1. The domain owner fills out the form to remove the Lock and sends it to you. You can find the form at:
    • German and English
    • The domain data is required in the form.
    • If the request is made by a representative of the domain owner, proof of the representation must be provided.
  2. Please check that the form is correct and that all necessary evidence has been attached before you send the form to DENIC.

    NOTICE

    Send the form as an e-mail attachment to DBS (Kontaktinformation
    Contact information) and sign the e-mail with your master key.

  3. DENIC will check the information in the form and the evidence and will contact you, if corrections are necessary or the evidence is insufficient.
  4. DENIC informs you, the domain owner and the lock contact about the removal of the lock.

Update Lock Contact

The lock contact is named by the domain owner, when setting up the lock and confirms the authenticity of a request for a locked domain. The domain owner can designate someone else as lock contact at any time. The lock for a domain remains unchanged, when changing a lock contact.

Schematic overview - Update Lock Contact

Step-by-Step - Update Lock Contact

  1. The domain owner fills out the Lock Contact update form and sends it to you. You can find the form at:
    • German and English
    • In addition to the domain data, the name, the mobile phone number and the e-mail address of the new lock contact are recorded.
    • The new lock contact confirms its details with an attached proof of identity.
    • If the update of the lock contact is requested by a representative of the domain owner, proof of the representation must be provided.
  2. Please check, that the form is correct and that all necessary evidence has been attached before you send the form to DENIC.

    HINWEIS

    Send the form as an e-mail attachment to DBS (Kontaktinformation
    Contact information) and sign the e-mail with your master key.

  3. DENIC will check the information in the form and the evidence and will contact you, if corrections are necessary or the evidence is insufficient.
  4. DENIC then enters the new lock contact in the registration database
  5. DENIC informs you, the domain owner and the old and new lock contact about the change of the lock contact data.

Update Domain Data (CHHOLDER/UPDATE) with a locked Domain

  • The domain data for a locked domain can be changed to the same extent as for CHHOLDER or UPDATE requests.

  • The lock contact confirms the changes in the request of the domain owner, so that DENIC can make the changes.

  • Incorrect name server data or non-functioning name servers have no influence on the lock and do not release the lock.

Schematic overview - Update Domain Data (CHHOLDER/UPDATE) with a locked Domain

Step-by-step - Update Domain Data (CHHOLDER/UPDATE) with a locked Domain

  1. The domain owner sends you a request for changing the domain data (e.g. by e-mail).
  2. You can check the request in advance and then send it to DENIC in an informally format or a key/value format in an e-mail.

    NOTICE

    Please do not send DENIC a request for a locked domain as an XML document. Sign the e-mail with your master key.

  3. DENIC will check the information in the e-mail and will contact you if corrections are necessary.

    NOTICE

    Please, also send corrections in an informally format or in a key/value format and sign your e-mail with the master key. Please, do not send any XML document.

  4. The lock contact receives two messages from DENIC:

    • an e-mail with the domain data to be changed and the request to confirm the change by specifying a one-time password (OTP) and

    • an SMS with the OTP.
  5. The lock contact has 7 working days to inform DENIC of his OTP for a cross-check and to confirm or reject the request, via (Kontaktinformation
    Contact information). If the Lock Contact does not respond within 7 working days, the request expires.
  6. If the order has been successfully completed, DENIC's domain data will be updated in the registration database.
  7. DENIC informs you and lock contact via e-mail about the successful updates of the domain data.

    NOTICE

    If necessary, you can inform the domain owner about the completion of the order. The exact time of the change can be traced in the "Changed:" field via a Domain INFO request.

CHPROV with a locked Domain

The lock is removed before a provider change, since the necessary changes to the domain data (e.g. new handles or name servers) would otherwise not be possible. If the lock for the domain is to be continued, the lock must be set up again with the member who takes over the domain in its inventory and offers the .de registry lock.

TRANSIT with a locked Domain

If you want to give up the administration of a domain with .de Registry Lock, this is only possible directly via DENIC. Domains with .de registry lock can only be entered into TRANSIT manually via DENIC. In addition, disconnection is not possible in this case. DENIC will remove the lock and inform the domain owner as well as the lock contact.

DELETE with a locked Domain

Deletion of a domain must be confirmed by the lock contact. The lock will be removed by deleting the domain. Alternatively, the lock can be removed first and then the domain can be deleted.

The RGP for the domain then takes place.

Domain INFO with a locked Domain

Abfrage und Antworten bei einer Locked Domain

Queries and answers for a locked domain continue to be sent to and received from the RRI.

NOTICE

There is no "RegistryLock: false" entry for all domains without a lock. A value for the field is only output if a lock is set. Query for a locked domain in Key/Value Format.

Request for a locked Domain in Key/Value Format

Version: 3.0
Recursive: true
AuthInfo <Passwort>
Domain: denic.de

Response for a locked Domain in Key/Value Format

RESULT: success
STID: 4e5bfed2-80b1-11ea-b1ca-639027db68ba

Domain: de-registrylock.de
Domain-Ace: de-registrylock.de
Nserver: ns1.denic.de.
Nserver: ns2.denic.de.
Nserver: ns3.denic.de.
Status: connect
RegistryLock: true
RegAccId: DENIC-1000006
RegAccName: DENIC eG
Changed: 2020-04-23T09:58:11+02:00

[General Request]
Type: REQUEST
URI-Template: mailto:example@denic.de
Changed: 2018-08-13T14:14:18+02:00

[Abuse Contact]
Type: REQUEST
URI-Template: mailto:abuse@denic.de?subject=domain:{Ulabel}
Changed: 2018-08-13T14:14:18+02:00

[Holder]
Type: ORG
Name: DENIC eG
Address: Theodor-Stern-Kai 1
City: Frankfurt am Main
PostalCode: 60596
CountryCode: DE
Email: info@denic.de
Changed: 2017-01-06T15:51:08+02:00

Request for a locked Domain as an XML Document

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<registry-request xmlns="http://registry.denic.de/global/3.0" xmlns:domain="http://registry.denic.de/domain/3.0">
 <domain:info recursive="true">
  <domain:handle>denic.de</domain:handle>
  <domain:authInfo>Passwort</domain:authInfo>
 </domain:info>
</registry-request>

Response for a locked Domain as an XML Document

<?xml version="1.0" encoding="UTF-8"?>

 <registry-response xmlns="http://registry.denic.de/global/3.0" xmlns:tr="http://registry.denic.de/transaction/3.0">
  <tr:transaction>
   <tr:stid>d5c0f12a-aac9-11e8-afa4-f7fda02f01db</tr:stid>
   <tr:result>success</tr:result>
    <tr:data>
     <domain:infoData xmlns:domain="http://registry.denic.de/domain/3.0">
      <domain:handle> de-registrylock.de </domain:handle>
      <domain:ace> de-registrylock.de </domain:ace>
      <domain:status>connect</domain:status>
      <domain:registryLock>true</domain:registryLock>
      <domain:regAccId>DENIC-1000006</domain:regAccId>
      <domain:regAccName>DENIC eG</domain:regAccName>
      <domain:contact role="generalrequest">
       <contact:handle xmlns:contact="http://registry.denic.de/contact/3.0">DENIC-1000006-GENERAL-REQUEST</contact:handle>
       <contact:type xmlns:contact="http://registry.denic.de/contact/3.0">REQUEST</contact:type>
       <contact:uri-template xmlns:contact="http://registry.denic.de/contact/3.0">mailto:example@denic.de</contact:uri-template>
       <contact:changed xmlns:contact="http://registry.denic.de/contact/3.0">2018-08-13T14:14:18+02:00</contact:changed>
      </domain:contact>
      <domain:contact role="abusecontact">
       <contact:handle xmlns:contact="http://registry.denic.de/contact/3.0">DENIC-1000006-ABUSE-CONTACT</contact:handle>
       <contact:type xmlns:contact="http://registry.denic.de/contact/3.0">REQUEST</contact:type>
       <contact:uri-template xmlns:contact="http://registry.denic.de/contact/3.0">mailto:abuse@denic.de?subject=domain:{Ulabel}</contact:uri-template>
       <contact:changed xmlns:contact="http://registry.denic.de/contact/3.0">2018-08-13T14:14:18+02:00</contact:changed>
      </domain:contact>
     <domain:contact role="holder">
      <contact:handle xmlns:contact="http://registry.denic.de/contact/3.0">DENIC-1000006-DENIC</contact:handle>
      <contact:type xmlns:contact="http://registry.denic.de/contact/3.0">ORG</contact:type>
      <contact:name xmlns:contact="http://registry.denic.de/contact/3.0">DENIC eG</contact:name>
      <contact:postal xmlns:contact="http://registry.denic.de/contact/3.0">
       <contact:address>Theodor-Stern-Kai 1</contact:address>
       <contact:postalCode>60596</contact:postalCode>
       <contact:city>Frankfurt am Main</contact:city>
       <contact:countryCode>DE</contact:countryCode>
      </contact:postal>
      <contact:email xmlns:contact="http://registry.denic.de/contact/3.0">info@denic.de</contact:email>
      <contact:changed xmlns:contact="http://registry.denic.de/contact/3.0">2017-01-06T15:51:08+02:00</contact:changed>
     </domain:contact>
     <dnsentry:dnsentry xmlns:dnsentry="http://registry.denic.de/dnsentry/3.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="dnsentry:NS">
      <dnsentry:owner>de-registrylock.de.</dnsentry:owner>
      <dnsentry:rdata>
       <dnsentry:nameserver>ns1.denic.de.</dnsentry:nameserver>
      </dnsentry:rdata>
     </dnsentry:dnsentry>
     <dnsentry:dnsentry xmlns:dnsentry="http://registry.denic.de/dnsentry/3.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="dnsentry:NS">
      <dnsentry:owner>de-registrylock.de.</dnsentry:owner>
      <dnsentry:rdata>
       <dnsentry:nameserver>ns2.denic.de.</dnsentry:nameserver>
      </dnsentry:rdata>
     </dnsentry:dnsentry>
     <dnsentry:dnsentry xmlns:dnsentry="http://registry.denic.de/dnsentry/3.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="dnsentry:NS">
      <dnsentry:owner>de-registrylock.de.</dnsentry:owner>
      <dnsentry:rdata>
       <dnsentry:nameserver>ns3.denic.de.</dnsentry:nameserver>
      </dnsentry:rdata>
     </dnsentry:dnsentry>
     <domain:changed>2020-04-23T09:58:11+02:00</domain:changed>
    </domain:infoData>
   </tr:data>
 </tr:transaction>
</registry-response>

Error Message with a locked Domain

Locked Domain - Error Table

If a lock has been set for a domain, all requests to the RRI that change the domain data are blocked by the same error message:

Error Code Error Message Input Format Update / Chholder / Delete / Chprov / Transit Brief Description
53000080009 Request rejected - this domain is locked! KV / XML all The request cannot be carried out via the RRI because a lock was set on the domain..