New Requirements for Domain Administrator Identification

Dear colleagues,

We would like to draw your attention to the upcoming implementation of several significant changes in the management of domains in the .ru, .рф, and .su zones, which require proactive action from domain administrators in the very near future.

Failure to comply with the relevant procedures carries the risk of losing control over the domain and the inability to re-register or renew registration rights.

Nature of the Changes and Legal Basis

Federal Law No. 569-FZ of December 29, 2025, mandates that from September 1, 2026, all domain name administrators in the Russian national domain zones .ru, .рф, and .su must undergo mandatory identification through the Unified Identification and Authentication System (rus. ЕСИА), i.e., the Gosuslugi (State Services) portal.

The new procedure applies to all domain administrators without exception, regardless of their status, citizenship, or location.

Key Parameters of the Innovation:

• The requirement applies to both new and existing administrators;
• It is mandatory for both individuals and companies of all legal forms;
• Requires a verified (not simplified) Gosuslugi account;
• Applies only to domains in the .ru, .рф, and .su zones;
• From September 1, identification becomes a mandatory condition for any domain management.

According to comments from representatives of the Russian Ministry of Digital Development, the legislative initiative is aimed at enhancing information security, countering fraudulent schemes and phishing attacks, and eliminating the possibility of using fictitious registration data.

In 2025, according to the Coordination Center for National Domains, more than 42,000 phishing sites and over 10,000 resources distributing malicious software were blocked.

The new identification system is designed to screen out potential violators at the domain registration stage itself, since verified identification and the recording of data in the state system significantly increase risks for unscrupulous market participants.

It is important to understand that the obligation to provide accurate information about the administrator existed before; however, until now, verification mechanisms did not exclude the possibility of providing false data.

The introduction of mandatory identification requirement moves this process from manual to automatic mode. All necessary information, with the administrator's consent, is automatically transmitted to the registrar's system, without the need to fill in passport details or send scanned documents.

Identification Mechanism and Account Requirements

Technically, the identification procedure works as follows:

• When registering a new domain or renewing an existing one, the administrator authorizes through the Gosuslugi portal;
• The registrar receives confirmation of the data's authenticity from the state system.

The procedure itself is generally the same for all types of administrators (individuals and legal entities), but there are some nuances.

For individuals and individual entrepreneurs, a verified Gosuslugi account is required – a simplified account created using a phone number or email address only is not suitable for identification purposes.

If not yet the case the account can be verified at "My Documents" centers (MFCs), bank branches, or through mobile applications of credit institutions.

For legal entities, the procedure requires preliminary verification that the company is registered in Gosuslugi and that the employee responsible for managing the domain portfolio is linked to the account.

In most cases, this employee is the head of the organization or another authorized person.

For non-residents, the situation deserves special attention.

For foreign citizens who are individuals, it is possible to create a verified account on the Gosuslugi portal if they have a Russian SNILS (pension insurance number), which requires personal visit to the territory of Russia.

For foreign companies that do not have such access, some registrars offer a specialized solution – a "Trusted Administrator" service (see, for example, 1, 2), where the domain is registered to an accredited Russian registrar that has already undergone identification, while actual management remains with the client through a personal account.

Consequences of Failing Identification

Without undergoing identification, the administrator loses the ability not only to register a new domain but also to renew an existing one, as well as to change the administrator to another person or modify DNS server settings.

It is important to understand: the domain will not be disabled instantly on September 1, 2026 – it will continue to operate until the end of its current registration period.

However, immediately after that date, it will become impossible to manage it, and when the registration period expires, the domain will enter a renewal grace period, after which it will be released and become available for registration by third parties.

Thus, the key risks of inaction are as follows:

• Inability to renew existing domains after their registration period expires;
• Inability to register new domains in Russian zones;
• Blocking of any configuration changes and transfers of rights;
• Loss of the domain as an asset, with it becoming available for open sale to third parties.

For companies, this means a direct risk of losing a recognizable brand, customer traffic, investments in search engine optimization, and email services tied to the domain. Regaining control over a released domain after it has been acquired by another owner is practically impossible.

High-Risk Areas for companies

An analysis of the new regulatory norm allows us to identify certain situations that may create elevated risks for corporate clients.

The domain is registered to a former employee or contractor.

The most common problem is when a domain is registered to a former employee or contractor. This often happens when a website was created by hired specialists, and for the sake of speed, the domain was registered in their name. After such an employee leaves or the contract with the contractor is terminated, the domain continues to renew automatically.

However, after September 1, without the involvement of that person and their verified Gosuslugi account, it will be impossible to renew the domain or transfer it to the company. In some cases, a domain actually used by one person or company formally belongs to another (the so-called nominal holder).

It is important to remember that from September 1, the identification will be performed by the person listed as the administrator. If that person is not ready or unable to verify their account, the domain will become unmanageable.

The company's domain is registered to an individual.

A frequent situation: domain registration in the name of an individual, while the actual owner and user is a legal entity.

This often occurs in the early stages of business development, when the founder or director registers domains in their own name to simplify the procedure. From September 1, identification will have to be performed by the individual on whom the domain is registered.

If for some reason the individual cannot verify the account, the company's domain will be in a "suspended" state.

Restoring control after September 1 in such a situation will be much more difficult: it will be necessary to prove rights to the domain through additional procedures.

The domain is registered to fictitious data.

Previously, when registering, one could specify any first and last name – the system did not verify the accuracy of the information. Some users intentionally provided false data to maintain anonymity.

After September 1, such domains cannot be identified, since there will be nothing to reconcile the data from Gosuslugi with – the administrator with the specified name and identification data simply does not exist.

The administrator's data does not match the Gosuslugi data.

Some domains were registered many years ago. During this time, an individual's passport details may have changed; a company may have changed its management, legal address, or other significant details.

There are also frequent cases of errors or typos in the data entered during domain registration. In these cases, the system will not be able to automatically match the domain data with the Gosuslugi system, and additional procedures with the registrar will be required.

Registrar Readiness

The main providers offering support for domain identification are Ru-Center and Reg.ru. Both registrars provide services for individuals and individual entrepreneurs; for legal entities, integration was launched in spring-summer 2026.

If the current registrar where the domain is hosted is not among the companies with active integration for identification purposes, it is necessary to consider transferring the domains.

It is important to remember that changing registrars after September 1 will involve the same restrictions – without undergoing identification, it will become impossible.

What to Do?

Given that only a few weeks remain before the law comes into effect, it is recommended to begin the identification procedure as soon as possible. If any of the risk factors described above are identified, it is crucial to promptly take all necessary actions to eliminate them.

Necessary Steps at the Preparation Stage:

• Conduct a full inventory of all domain names in the .ru, .рф, and .su zones belonging to the business or its affiliates.
• Check which registrar services each domain and who is listed as its administrator.
• Verify the administrator's data with the registrar to ensure it matches the information in Gosuslugi. Any discrepancies, even minor ones, must be addressed immediately.
• Administrators themselves should check the content hosted on the domains, as the real data of the administrator becomes easily accessible to regulatory authorities. If a domain is registered to a company or a specific individual but is actually used by third parties, the risks also fall on the administrator listed in the registry.

It is important not to postpone resolving these issues, as technical failures and queues in registrar support services may occur in the final days before the deadline.

Please do not hesitate to contact us in case of any questions.