Domain names and DNS records now fall within the scope of NIS2, and a lot of security teams in the EU only find this out when an auditor asks who controls the registrar account. This article explains which NIS2 obligations apply to domain name infrastructure, who carries them, and how to turn the directive’s wording into specific controls for your zones, registrars and subdomains. If your organization is classified as an essential or important entity, or you buy DNS services from a provider that is, this affects your work directly.
Where DNS Shows Up in the Directive
Directive (EU) 2022/2555 came into force in January 2023. Member states had until 17 October 2024 to transpose it, and many missed the deadline. Some countries passed their national laws in 2025, and a few were still finishing in 2026. Domain infrastructure appears in two quite different ways.
The first is direct. TLD name registries and DNS service providers are classed as essential entities regardless of size. That also applies to a two-person company running a public recursive resolver. Article 28 adds separate duties for registries and registrars on registration data. They must collect accurate and complete registration data, publish the non-personal parts without undue delay, and answer lawful access requests within 72 hours.
The second is indirect, and it covers far more organizations. Under Article 21, every essential and important entity has to manage risk across its network and information systems. Your authoritative zones, registrar accounts, mail authentication records and hundreds of subdomains are part of those systems. Nothing in the text treats DNS as optional.
Myth: “We Run Our Own DNS, So We’re a DNS Service Provider”
This misunderstanding pushes compliance teams in two wrong directions. NIS2 defines a DNS service provider as an entity offering publicly available recursive resolution to end users, or authoritative resolution as a service for third parties. Root name servers are excluded.
A retailer running BIND or PowerDNS for its own domains is therefore not a DNS service provider in the regulatory sense. A hosting company serving authoritative DNS for 4,000 customer zones is one. The opposite mistake is just as common. Teams decide that DNS is “not their NIS2 problem” because they aren’t a provider, and they leave it out of their Article 21 scope completely.
The Commission Implementing Regulation (EU) 2024/2690 adds detailed technical requirements and incident thresholds for DNS providers, registries, cloud providers and similar entities. If you rely on one of these providers, its obligations help you, but you remain responsible for your own risk.
Mapping NIS2 Obligations to DNS Controls
An experienced GRC lead reads Article 21 as a list of control families and maps each one to DNS. The mapping works like this:
Asset management means a full subdomain inventory, including records created by marketing, partners and old projects. Supply chain security covers your registrar, managed DNS provider and any CDN or SaaS platform your CNAMEs point to. Access control and MFA apply to registrar portals, DNS provider consoles and the API tokens used in Terraform pipelines. Incident handling requires the ability to detect a hijacked delegation or an unauthorized record change within hours, not weeks. Cryptography policy takes in DNSSEC decisions, DKIM key lengths and rotation schedules.
Auditors in Germany, Belgium and the Nordics are starting to ask for evidence, not just policy documents. That means change logs, inventory exports and records showing who approved a zone change. Material on how DNS monitoring supports compliance and audit requirements covers what that evidence usually looks like.
A Realistic Scenario: The Important Entity That Found 212 Subdomains
Here is a typical case. A mid-sized manufacturer with 600 employees is classified as an important entity. Its security team starts gap analysis in spring and assumes its DNS estate is around 40 records. Certificate transparency logs and passive DNS data show 212 subdomains spread across two DNS providers. One provider was taken over in a 2019 acquisition and nobody in IT currently has a login.
The registrar account is registered to the personal Gmail address of a former network engineer. Three marketing subdomains still have CNAMEs pointing to Azure App Service instances that were deleted in 2022. Each of those is a subdomain takeover waiting for someone to claim the name. SPF on two sending domains exceeds the 10-lookup limit, so the policy fails quietly.
None of these problems was new. NIS2 simply made them a management liability. Article 20 makes management bodies personally accountable for approving and overseeing risk measures. The fix took about six weeks. The account recovery took the longest, because the registrar required notarized proof of company ownership. The steps for that kind of recovery are covered in registrar lock settings and emergency domain recovery.
Incident Reporting When DNS Is the Attack Vector
Article 23 sets three deadlines for significant incidents. An early warning is due within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. DNS incidents make “becoming aware” difficult to pin down.
Take a hijacked NS delegation that sends your customer portal to a phishing site for nine hours. If nobody notices until a customer complains on day three, the 24-hour clock started late. Regulators will ask why detection took so long. Continuous checks on delegation, record values and SOA serials are about both detection and defensibility.
There is an edge case: not every DNS problem counts as reportable. A takeover of an unused demo subdomain that serves no content and has no user traffic may fall below national significance thresholds. Document why you decided not to report. Auditors accept a reasoned decision far more readily than silence.
Common Mistakes Practitioners Make
The most frequent mistake is treating the registrar as a commodity rather than a supplier. Teams carry out full vendor assessments for their CRM but never ask whether the registrar supports registry lock, enforces hardware-key MFA or logs account changes. Under the supply chain provisions in Article 21(2)(d), the registrar is one of your most critical suppliers.
The second mistake is building the inventory once. A subdomain spreadsheet made for the audit is out of date within a quarter. Developers create preview environments and marketing launches campaign pages. The inventory has to update itself, or it will fail the next review.
The third is trusting the DNS provider’s dashboard as the only source of truth. If an attacker changes records using a stolen API token, the provider’s console will show the malicious values as legitimate. Outside resolution checks against a known-good baseline catch changes the console will never flag.
Exceptions and Constraints Worth Knowing
Entities with fewer than 50 employees and under €10 million turnover are generally outside scope unless they are in a category covered regardless of size. That includes DNS providers and TLD registries. Public administration entities are covered differently from country to country. Some member states have brought in municipalities, and others have not.
Air-gapped or internal-only DNS for operational technology still falls under Article 21 as part of your systems. Public-facing monitoring tools won’t see it, though. Those zones need internal checks and their own documentation, which is explained in how to document your DNS infrastructure for security reviews.
FAQ
Does NIS2 require DNSSEC?
No, the directive does not mandate DNSSEC for ordinary essential or important entities. It does require a documented cryptography policy. If you choose not to sign your zones, record that decision and the reasons for it.
Are domain registrars directly regulated under NIS2?
Yes, for registration data. Article 28 requires registrars to keep accurate registration data, publish non-personal data and answer legitimate access requests within 72 hours. Whether their broader risk-management duties apply depends on national transposition.
What fines apply if DNS weaknesses lead to a breach?
Essential entities face fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. For important entities the maximum is €7 million or 1.4%. Management bodies can also be held personally accountable.
Summary
NIS2 puts direct obligations on registries, registrars and DNS service providers. Through Article 21, it also covers the DNS estate of every essential and important entity. The most useful first step is the least glamorous one: confirm who controls each registrar account, list every subdomain, and compare the result against what your provider dashboards show. Most of the gap analysis comes from that comparison.