.pl Procedure on verification of DNS Database data

Part I. General provisions

1. This Procedure ("the Procedure") is introduced by the Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy, seated in Warsaw, Poland, which maintains the .pl domain name Registry ("the Registry"). The Procedure is introduced pursuant to Article 16b of the Act of 5 July 2018 on the National Cybersecurity System (hereinafter referred to as “Act on NCS”) in conjunction with Article 28(3) of Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures to promote a high common level of cyber-security within the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972 and repealing Directive (EU) 2016/1148 (NIS Directive 2) and in accordance with the .pl Domain Name Registry Policy on Data in the DNS Database (the "Policy"). Terms not defined in the Procedure shall be understood in accordance with the Policy and the .pl Domain Name Regulations.

2. The Procedure regulates the principles concerning verification of completeness and accuracy of data concerning the .pl domain Registrants entered into the DNS Database by the Registrars, with the exception of the “.gov.pl” and “.mil.pl” zones.

3. The Registrant’s data entered into the DNS Database shall be subject to basic verification by the Registrar in accordance with Part II of the Procedure ("Basic Verification") and, where appropriate, additional verification in accordance with Part III of the Procedure ("Additional Verification"). The Registrar shall take the required actions for all domain names it handles for the same Registrant, unless otherwise indicated in the Procedure.

4. After performing the Basic Verification, the Registrar shall appropriately label the Registrant's data in the DNS Database as verified and shall ensure recording and storing evidence of its every performance. Such labeling shall take place within 48 hours from:

   1. the commencement of service of the Domain Name to the Registrant as a result of its registration or a Change of Registrant, whereby Basic Verification for the same Registrant details is only required once, regardless of the number of Domain Names serviced to it by the Registrar;
   2. the commencement of service of the Domain Name to the Registrant as a result of the Registrant's change of Registrar ("Transfer"), whereby Basic Verification is not required if the Registrar is already servicing at least one Domain Name to this Registrant and Basic Verification would be subject to the exact same data.

5. During the Transfer, the Registrant's data may not be changed and Registrant Change is prohibited. The Registrar commencing service as a result of a Transfer shall initiate a Basic Verification in respect of the Registrant's data as at the commencement of the Transfer. The Registrar shall not carry out a Transfer when the Registrant Data is not labeled as verified by the current Registrar, unless the Registrar verifies it as part of the Additional Verification. The same applies to a Registrant Change in respect of the current Registrant's data.

6. In the event of an update, addition or other change of data in the DNS Database with respect to any of the categories of data subject to Basic Verification, the Registrar shall label the data in the DNS Database as verified within 48 hours of the change being made, and if this labeling has not been changed, it shall apply to the data so entered, from the time of its entry into the DNS Database. The actions referred to in this paragraph shall not extend the time limits referred to in paragraph 4.

7. In the event of Additional Verification, the Registrar shall ensure that evidence of it is recorded and stored each time it is performed. In the event of an update, addition or other change of data in the DNS Database made as a result of Additional Verification, paragraph 6 shall apply. The rules set out in this paragraph shall apply mutatis mutandis in the cases indicated in paragraph 4 points 1-2 , in which the Registrar is not required to perform a Basic Verification. In such cases, the Registrar shall also keep data to confirm that Basic Verification was not required, in accordance with paragraph 4.1-2.

8. Any labeling of data in the DNS Database as verified, or any change to data subject to Basic Verification made without a change to that labeling, shall be tantamount to an acknowledgement that:

   1. the Registrar has verified the accuracy and completeness of the data subject to Basic Verification or Additional Verification or the data subject to change of the data subject to Basic Verification;
   2. the Registrar has ensured that evidence of the verification referred to in subsection (1) has been recorded and stored, or that data is available to confirm that Basic Verification was not required, in accordance with subsections (4)(1) to (2).

9. Failure to label data in the DNS Database as verified is not tantamount to the Registrant's data being incomplete or inaccurate, but in any case requires timely labeling of data as verified by the Registrar, as a result of either Basic Verification or Additional Verification, or the Registrar taking the appropriate action referred to in Part III, section 6 of the Procedure.

10. The labeling of data in the DNS Database may be changed at any time, including as a result of verification, update or challenge. The data verification information may be subject to publication in the Whois database, together with or in place of the data, in particular during Additional Verification.

11. To the extent that the Policy or the Procedure refers to basic requirements for data verification, the Registrar may apply higher standards, ensuring that these are appropriately balanced against the principle of avoiding undue burden on the Registrant. In particular, it may be possible for Registrars to use automated solutions or tools to support verification activities or to collect evidence of verification performed, provided, however, that these processes also require the participation of appropriate personnel.

12. The Registrant shall take part in the required verification activities, including an appropriate level of Responsiveness, taking into account the content of the .pl Domain Name Regulations, the Policy, the Procedure and formal documentation connecting the Registrant with the Registrar (contracts, regulations, policies, etc.).

Part II. Basic Verification

The assessment of probability and reliability is determined based on industry best practice, taking into account the state of the art. The Registrar may use automated solutions for this purpose, including predictive algorithms, information or reports from other entities, data made available in publicly available state registers and records (including a number or other identification mark contained in public registers), etc.

1. Data relating to the Registrant entered into the DNS Database shall be subject to Basic Verification performed by the Registrar in the cases indicated in section 4 and section 6 of Part I of the Procedure.

2. Basic verification shall be carried out in accordance with the following rules and shall apply to the following categories of data:

   1. the Registrant's contact email address or the Registrant's contact telephone number ("Contact Data");

   2. the name or forename and surname of the Registrant ("Identification Data").

3. The Registrar may perform Basic Verification both before and after the data is entered into the DNS Database, taking into account the deadlines resulting from the Policy, the Procedure and the relevant legal regulations. In the event that, during the period of Basic Verification, the Registrar does not provide full service to the Registrant, e.g. does not allow the Registrant to enter the data of the servers designated for Domain Name Maintenance, the Registrar shall set out the rules related thereto in the formal documentation binding on the Registrants, including contracts, bylaws, policies or relevant procedures applied by the Registrars.

4. Contact data shall be subject to syntactic and operational verification:

   1. Syntactic validation is an activity leading to the confirmation that the data entered is correctly formatted and complies with the requirements:

      1. in the case of an e-mail address, the format should comply in particular with the IETF standard RFC 5322 Internet Message Format1 (or an appropriate standard that supersedes it)¹,

      2. for a telephone number, the format shall conform in particular to the ITU-T E 164 notation for international telephone numbers (international public telecommunications numbering plan)²;

   2. Operational verification is an action leading to the confirmation for at least one of the categories of Contact Data that the contactability and functionality of the data entered has been ensured:

      1. the e-mail address represents an existing account and is functional (i.e. e-mails are delivered),

      2. the telephone number is functional.

5. Identification data shall be verified by collecting and checking information or documents relating to the Registrant in order to confirm whether they identify the entity or natural person whose data has been indicated. Such verification shall be carried out by the Registrar at least in the case of:

   1. determine the probability, to at least a medium degree, that the Identification Data is incomplete or inaccurate;

   2. obtaining reliable information about the possibility of registering or using the domain name for infringing purposes.

6. As part of the Basic Verification, the Registrar shall obtain from Registrants, in the cases referred to in the Policy, representations regarding the absence of personal data in contact email addresses or they shall ensure that there is an appropriate legal basis for the processing of such data, including publication in the Whois database. The statements are stored by the Registrar and are recorded prior to the transfer of data resulting in their publication in the Whois database.

7. Whenever the Basic Verification does not result in the Registrant's data in the DNS Database being labeled as verified, in accordance with the time limits resulting from Part I of the Procedure, the Registrar shall initiate, as the case may be, the Additional Verification or the actions referred to in Part III, paragraph 6 of the Procedure.

Part III. Additional verification

1. The purpose of the Additional Verification shall be to confirm the accuracy and completeness of the Registrant's data (including its correctness) or to correct or complete it (including updating it) and, as a result of such actions, to label the Registrant's data as verified or to maintain such labeling. If this purpose is not achieved within the required timeframe, subject to paragraph 3, the Registrar shall take appropriate actions from among those indicated in paragraph 6.

2. Additional Verification includes Contact Data, Identification Data or other data entered into DNS Database, depending on the circumstances and the case of its application. Basic action under Additional Verification:

   1. verification of data concerning the Registrant, using reliable sources of information, including state registers, lists and records, or with the participation of entities providing professional support in this regard;

   2. undertaking the contact with the Registrant, using the contact details held or contact details established using reliable sources;

   3. verification of information and documents provided, indicated, made available or shown by the Registrant;

   4. re-contacting the Registrant if an adequate level of Responsiveness is not provided or if insufficient information or documents are obtained from the Registrant to fulfil the purpose of the Additional Verification.

3. Before the expiry of the time limits referred to in paragraph 4, the Registrar may also take other actions leading to the achievement of the purpose of the Additional Verification, including as appropriate among the actions referred to in paragraph 6.

4. Basic cases of Additional Verification and deadlines for achieving its purpose:

   1. Basic Verification that did not result in the Registrant's data being labeled in the DNS Database as verified within the time limit under Part I of the Procedure;

      Deadline: 21 days from the expiry of the relevant deadline under Part I of the Procedure;

   2. communications received by the Registrar from relevant authorities or bodies, as a result of actions taken under the relevant provisions of law;

      Deadline: according to the deadline resulting from the communication received or directly from the provisions of law;

   3. communications to the Registrar from a third party concerning a breach of law or other irregularity, or a determination directly by the Registrar, including as a result of automated actions, of the possibility of such a situation;

      Deadline: in accordance with the deadline resulting from the relevant formal documentation of the Registrar, taking into account that the deadlines set for the Registrant to carry out actions to ensure that the purpose of the Additional Verification is achieved should make it possible to achieve such purpose within one month;

   4. Notification received from the Registry;

      Deadline: in accordance with the deadline resulting from the notification, but no shorter than 3 working days, unless a shorter deadline results from a deadline laid down by the provisions of law or from a deadline set by an authority or body acting under the provisions of law.

5. Where the verification is being carried out in respect of more than one of the cases referred to in paragraph 4 at the same time, the shortest time limit shall apply. Where the verification is carried out in relation to a case other than those referred to in paragraph 4, the time limit resulting from the Registrar's formal documentation shall apply, unless a shorter time limit should apply, in particular where it results from applicable provisions of law.

6. Actions to be taken by the Registrar if the basic actions do not achieve the purpose of the Additional Verification within the required timeframe:

   1. withdrawing of the provision of services concerning the .pl domain name or the functionalities related to it, in particular, preventing the Registrant from entering the data of the servers intended for the Maintenance of the Domain Name or changing such data to those entered by the Registrar;

   2. stopping the Transfer, change of the Registrant, change of the Registrant's data or taking action to render these actions ineffective;

   3. deleting of the Domain Name from the Registry;

   4. other actions to comply with the requirements of the provisions of law or the Policy.

7. The Registrar shall set out the detailed rules relating to Additional Verification, including the actions referred to in paragraph 6, in the formal documentation binding on Registrants, in particular in the contracts, regulations, policies or relevant procedures used by the Registrar.

Part IV. Additional Verification as a result of the Registry's activities

1. The Registry may initiate Additional Verification of the Registrant's data in justified cases and through the Registrar.

2. The actions referred to in paragraph 1 may result in particular from:

   1. communications received by the Registry from relevant authorities or bodies, as a result of actions taken on the basis of the relevant provisions of law or .pl Domain Name Registry Policy on the prevention of the abuse of .pl domain names;

   2. communications received by the Registry from a third party concerning a breach of the law or other irregularity;

   3. identification by the Registry directly of the possibility of irregularities in the Registrant’s data.

3. The Registry may, in particular, carry out automated actions on data entered into DNS Database, including periodic data verifications and related predictions, independently of such actions carried out by Registrars.

4. In the cases referred to in paragraph 2, the Registry shall provide the Registrar with the notification referred to in Part III, paragraph 4(4). The Registry may indicate in the notification whether verification of Identification Data is required.

Part V. Final provisions

1. This Procedure shall come into force upon publication on NASK's website intended exclusively for Registrars (the so-called Registrar Panel), with effect as of 3 April 2027. Until that date, the Procedure shall only have the status of a good practice recommendation concerning its subject matter.

2. With respect to data entered into the DNS Database prior to the entering of the Procedure into force, the rules set out in the Procedure shall apply from the date referred to in paragraph 1, provided, however, that:

   1. the labeling of the data in the DNS Database as verified shall be made by the Registrar no later than the date provided for in the Procedure for the commencement of the service of the Domain Name to the Registrant as a result of its registration, this date being in each case counted from the date referred to in paragraph 1, and the provisions of Part II, paragraphs 6-7 shall apply accordingly;

   2. the confirmation referred to in Part I, paragraph 8(2) shall also apply to evidence of the performance of the Basic Verification, the recording of which was ensured by the Registrar prior to the date referred to in paragraph 1, insofar as it confirms the completion of actions that meet the standards of the Basic Verification as described in the Procedure;

   3. Basic Verification for the same data of the Registrant served by the Registrar shall be required only once, also when done in accordance with this paragraph.

3. In the cases referred to in point 13 of the .pl Domain Name Regulations, the Registry shall perform the necessary actions until the Registrant designates a Registrar.

4. Polish law shall apply to the Procedure and the subject matter thereof, and any disputes that may arise shall be settled by the common courts having jurisdiction over the registered office of the Registry.

5. Any changes to the Procedure shall be implemented by publishing an updated version of the Procedure on the Registry’s website, and, prior to such publication - on the NASK’s website intended exclusively for Registrars (the so-called Registrar Panel), and shall take effect from the date of publication, unless otherwise specified.

---

1. https://datatracker.ietf.org/doc/html/rfc5322

2. https://www.itu.int/rec/T-REC-E.164/