First a letter arrives from an organisation nobody in the business has heard of, and inside that letter there is a password. Weeks later the website no longer loads, and the mailbox printed on the letterhead stops accepting messages. That is what losing an internet address looks like in practice: not a warning with a countdown, but post that somebody set aside. Yet a .de domain has no expiry date at all. “The domain contract is concluded for an indefinite period”, says Section 7(1) of the DENIC domain terms and conditions. A domain does not run out like a contract with an end date - it gets terminated, and often by the other side. At the end of 2025 around 17.7 million .de domains were registered worldwide (DENIC). For every single one of them, survival hangs on a question that is rarely asked inside a company: are the name, postal address, phone number and email address on the holder record still correct?
A .de domain has no expiry date
Anyone ordering a domain thinks in terms of fixed contract periods: one year, two years, then the renewal.
A .de domain does not work that way. “The domain contract is concluded for an indefinite period”, states Section 7(1) of the DENIC domain terms, and the holder may terminate it at any time without notice. There is no date to mark in the calendar. That sounds reassuring, and it is precisely why losing the address takes people by surprise: there is no countdown, no reminder four weeks ahead, no red field in a customer account. How an address comes about in the first place, and what has to be decided along the way, is covered in our basics of a domain and business email. This article picks up afterwards - at what happens during ongoing operation, without anybody having done anything.
The scale shows how ordinary the case is. The German country code grew slightly again in 2025 and reached around 17.7 million addresses worldwide by the end of the year, and the registry adds as a side note that one in five inhabitants of Germany holds a .de domain (DENIC). A substantial share is held from abroad - the same statistics report that 12.2 percent of all .de domains, roughly 2.15 million of them, are registered outside Germany. For a trade, retail or service business that means one thing above all: your own address is not a special case but a mass procedure that follows fixed rules. Those rules are published in the domain terms, and they make no allowance for an envelope that stayed shut.
An address is lost in three ways, and all three start with post. The first: the current provider hands back administration of the domain, and the registry writes to the holder directly. The second: the stored holder data is checked and does not stand up to that check. The third: a payment demand carrying a notice of intended termination arrives at an address where nobody has looked since the move. The three routes look different but converge on the same point. Working through them one after another shows quickly where the chain breaks in your own business.
The two-minute test
Cause 1: the provider hands the domain back
A domain is usually not held at the registry itself but through a provider that administers it. When that administration ends, the domain does not end - responsibility moves.
The domain terms put it like this: “If the domain application was submitted directly to DENIC, or if the DENIC member that has administered the domain to date gives up its administration, the domain is administered further by DENIC itself (direct administration through DENICdirect)” (Section 1(3)). This happens when a provider leaves the market, when a contractual relationship ends, or when an invoice stays unpaid there. For the business several things change at once: the domain sits with the registry, and the registry knows exactly one address - the one on the holder record.
To stop the address disappearing by accident in that situation, there is a dedicated procedure. The registry writes to the holder, and that letter carries a password with which the domain can be moved to a new provider. The deadline is short and clearly stated: “The domain holder has one month to decide on a change of provider” (DENIC). The password has a shelf life of its own: “The password is valid for 30 days from deposit with, or issue by, DENIC and may only be used once” (Section 1(4)). Opening the letter late therefore means not only less time, but possibly a password that has already expired and has to be requested again.
- Who in the business is responsible for opening post from an unknown sender and passing it on?
- Is the address on the holder record the current site, rather than the provider or a former office?
- Is there a shared inbox for contract and registry post that does not depend on one person?
- Is it known which provider administers the domain today - and where the access credentials are?
- Is there a note on where the domain should move if the current provider drops out?
- Is there a fixed date in the calendar on which the holder record gets reviewed?
Sender: Registry of the top level domain .de
Subject: Your domain is no longer administered
Contents: Domain name
Password for the change of provider
Individual date of the decision deadline
Path A: Order with a new provider, quote the password
-> Domain continues, provider invoices you
Path B: Direct administration by the registry
-> Domain continues, registry invoices you
Path C: No response by the date given
-> Termination, switch-off, later deletionThe decision itself is manageable: a new provider, or direct administration by the registry. Both keep the address alive, and both require action within the stated deadline. Anyone who wants to use the occasion for a planned move will find the procedure in our article on switching website providers - that one is about the move you choose, with lead time. The case described here is the one you do not choose: it starts without warning, and the order is reversed. First the domain is in someone else's care, then the business decides where it should go.
When the post does not arrive
Cause 2: the holder data fails the check
The second route is new to everyday practice in many businesses and has not been covered anywhere else on this blog: verification of the holder data.
The registry does not check the stored details only once at registration. “As part of the registration and administration of .de domains, the stored holder data is checked automatically for completeness and plausibility”, says the description of the procedure, “if discrepancies are found, additional verification may be required”. The registry names two purposes, and the second is the legal trigger: “compliance with statutory requirements under NIS-2 and the German BSI Act”. The check is therefore not an administrative exercise for its own sake but the implementation of a requirement that applies to the whole zone.
Which details have to be correct is stated in the same place: “Under the DENIC domain terms and guidelines, all domain holders are obliged to store the following details correctly and keep them up to date” - the full name including legal form for legal entities, the current postal address, plus phone number and email address. Those four fields are exactly the ones nobody has looked at since the initial setup in many businesses. A sole trader becomes a limited company, the business moves into the new workshop, the phone number changes with the system, and the email address belongs to the intern from back then. Each of those events is harmless on its own - together they produce a record that will not survive a check.
Scroll table sideways
| Stage | What happens | Basis |
|---|---|---|
| Automatic check | The stored holder data is checked for completeness and plausibility | Description of holder data verification (DENIC) |
| Request | The business is asked to have the data verified through its provider | “Verification is carried out exclusively through your provider!” (DENIC) |
| Window for action | The registry's notice is headed “What you need to do in the next 5 days” | Holder data verification page (DENIC) |
| Switch-off | The domain is removed from the zone, the website no longer resolves | Section 2(1) DENIC domain terms |
| Deletion | The domain contract is terminated and the address becomes available again | Section 7(2)(g) DENIC domain terms |
The consequence comes in two stages, and the registry describes it without euphemism: “Should your data not be verified, we will first remove the domain from the .de zone and delete it later!” The legal basis is Section 2(1) of the domain terms, under which the registry may reverse the connection “if verification of the domain holder's data has not established that it is correct and complete, and the domain holder has, within the deadline set by DENIC, neither demonstrated the correctness and completeness of that data nor corrected the data and provided such evidence for the corrected data”. The first stage can be undone, the second cannot: a deleted address is free and can be registered by anyone.
Name Full name of the holder, including the
legal form for legal entities
Example: Muster Bau GmbH, not Muster Bau
Address Current postal address of the business
A PO box is not enough for formal service
Phone Number on which the business is reachable
Email An address that is read every day and does
not belong to a former member of staff
Check Public domain lookup of the registry,
changes always run through the providerWhy the registry does not simply call
Cause 3: the payment demand reaches nobody
As long as a provider administers the domain, the registry's fee appears on no invoice the business ever sees: “If the domain is administered by a DENIC member, the domain holder's payment obligation under paragraph 1 is suspended”, says Section 4(2). The second sentence of the same paragraph describes the switch: “If the DENIC member gives up administration of the domain (Section 1(3), second alternative), the payment obligation revives and the domain holder must pay the domain fees directly to DENIC in future.” An item that ran quietly inside a provider invoice for years becomes a claim of its own overnight - sent to an address nobody watches for invoices. The prices are published in the registry's price list, which may be changed “with two months' notice” (Section 4(1)).
The TRANSIT letter
Arrives when the provider hands administration back. Contains a password and an individual date. Answer: order with a new provider or direct administration.
The verification request
Arrives when the holder data shows discrepancies. Answer: have the data confirmed or corrected through the provider.
The payment demand
Arrives once the payment obligation has revived. Carries a notice of intended termination. Answer: pay, or move the domain to a provider.
If the claim stays open, the ground for termination is spelled out in the terms. The registry may terminate the contract for good cause where “the domain holder, after the payment obligation has revived (Section 4(2), second sentence), has within one month of receiving a payment demand with notice of intended termination neither transferred the domain into the administration of another DENIC member nor paid the domain fee to DENIC”. The second alternative is worth noting: even without payment the address survives if it is moved to a provider in time. So opening the letter leaves two options - and both cost less time than hunting for an address that is gone.
Without prejudice to further statutory rights, DENIC may, upon dispatch of the termination, remove the domain and its technical data from the name servers for the top level domain .de (disconnection).
The one question that decides all three
All three causes share the same bottleneck: the holder record. It decides whether a letter arrives, whether an email is read, and whether anybody in the business even learns that a deadline is running.
Keeping it current is not a recommendation but an obligation in the terms: “Immediately after registration the domain holder shall check its data using the DENIC domain lookup at https://webwhois.denic.de/ and shall notify DENIC of any corrections as well as any subsequent changes without undue delay” (Section 3(3)). The sentence does not stop at registration - it covers every later change too. That is exactly what slips in everyday practice, because a move or a change of legal form touches many places and the domain record is on nobody's checklist.
The second bottleneck is the email address on the record. It is the registry's fastest channel and at the same time the most fragile one inside a business: it often belongs to a person rather than a function, it lands in a spam folder, or it belongs to a mailbox nobody has opened since a change of provider. How messages get delivered reliably, and where delivery fails in day-to-day business, is described in our article on business email deliverability. For the holder record the simplest rule applies: an address that belongs to a role, not to a name - and a mailbox somebody looks into every day.
Scroll table sideways
| Field | What is often in there | What should be in there |
|---|---|---|
| Name | The trading name without legal form, sometimes a former owner | The full name, including the legal form for legal entities |
| Address | The address of the former office, or the provider's address | The current postal address of the business, where post is opened |
| Phone | An extension that no longer exists after the phone system changed | The number on which the business is actually reachable |
| The address of a former member of staff, or the provider's | A role mailbox that is read every day | |
| Ownership | Nobody, because the domain “was set up back then” | A named person with a deputy and a fixed review date |
A special case concerns businesses not based in Germany - which applies to around 12.2 percent of all .de domains (DENIC). For them the terms provide an additional duty: “If the domain holder is not based in Germany, it shall, upon a corresponding request by DENIC, name within two weeks an authorised recipient of service resident in Germany” (Section 3(4)). The terms are explicit that a PO box address is not sufficient. Overlooking that request risks termination for a reason that has nothing to do with the website itself.
The emergency plan: the first few days
Once the domain is offline, the order of steps matters.
The most common mistake at that moment is to register a new address immediately and give up the old one - because between switch-off and deletion there is a window in which the address still belongs to the business. Disconnected does not mean deleted: the technical data has been removed from the name servers, but the contract continues as long as it has not been terminated and the domain has not been deleted. Fixing the cause inside that window gets the same address back, along with every link, business card and vehicle livery that carries it. Building a replacement domain instead means paying the same effort twice.
- Establish the state: is the domain merely unreachable, or gone from the registry's record?
- Go through the post of recent weeks, including what was filed - the triggering letter is almost always already in the building.
- Identify the provider that last administered the domain and dig out the access credentials.
- For a verification: assemble the four details and instruct the provider to confirm them.
- For a payment demand: either pay, or have the domain moved into the administration of a provider.
- For a TRANSIT letter: find the password, place the order, and respect the individual date.
- If the password has expired, request a new one instead of spending the deadline waiting.
- Only then decide whether a second address makes sense in addition.
Meanwhile the business carries on, and customers notice the outage first. A short message on the channels that still work is worth more at that moment than any technical explanation: give the phone number, give the hours, keep the reason brief. Anyone who has arranged in advance for an outage to be noticed at all gains days here - how that works is described in our article on downtime, monitoring and availability. Without that kind of watch, the first alert is usually a puzzled customer, and that is regularly several days too late.
The email goes down with it
Prevention: the domain inside a maintained operation
The most effective prevention is unspectacular: the holder record gets an owner and a date. Everything else follows from that.
With XICflow the domain runs inside an operation that is looked after - the link between address, certificate and publishing sits in one place, and how that is set up is documented under publishing and domains. What is included and where the limits are is set out in the overview of features. The point is not the tool but the ownership: an address for which nobody is named becomes a problem at exactly the moment when nobody is looking for it.
- Once a year, open the public domain lookup and compare the four mandatory details.
- Put the domain record on the list for every move, every change of legal form and every staff change.
- Set up a role address for registry and provider post that at least two people read.
- Document provider, contract number and access route in one place that can be found during holidays.
- Do not file post from unknown senders - pass it to the same place every time.
- After every change, check that the change has actually landed in the public record.
- Before a longer closure, decide who opens deadline letters and who may act on them.
The weeks when few people are in are the risky ones. A five-day deadline runs even when the business is closed, and a letter arriving between Christmas and New Year may well sit there until mid-January. How to prepare a closure without becoming unreachable is covered in our article on closing between Christmas and New Year. If you want to know what ongoing operation of a website with a domain covers with us, the details are on the pricing page - with term and scope, not in a footnote.
The mistakes that come up most often
- The provider is listed as the holder rather than the business - in which case the address does not legally belong to the business.
- The stored email address sits inside the very domain that is about to be switched off.
- The letter with the password is classed as advertising and filed away.
- The legal form is missing from the name, although the details have to be stored including the legal form.
- A newly registered domain is left technically unfinished - if the conditions for connection are not met within four weeks, the contract dissolves by itself.
- A new address is built immediately after the switch-off although the old one could still be saved.
- Ownership rests with a person who has left the business.
The first item deserves a remark of its own, because it gets expensive. Anyone not listed as the holder can neither move the domain nor have it verified - and has no position at all in a dispute. Which checks make sense before choosing an address is covered in our article on business name, domain and trademark law. And because an address without content is of little use, the second half of any emergency plan is the question of whether files and content can be restored - which we set out in website backup and restore. Address and content are two separate risks, and both need an answer.
What counts in the end