| Internet-Draft | Verifying Contacts in RDAP | February 2026 |
| Loffredo, et al. | Expires 27 August 2026 | [Page] |
This document describes an extension to the Registration Data Access Protocol (RDAP) that allows the inclusion of verification status information for contact fields such as email addresses and phone numbers. The goal is to improve data quality and trustworthiness of RDAP responses by indicating which pieces of contact data have been verified and how.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 27 August 2026.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The Registration Data Access Protocol (RDAP) provides access to registration data for domain names, IP addresses, and autonomous system numbers. However, RDAP responses do not currently include explicit information about whether contact information such as email addresses or phone numbers has been verified.¶
This document defines a simple extension that enables RDAP providers to include verification status for contact fields. This is useful in contexts where contact verification may be legally required or strongly recommended.¶
In particular, Article 28 of Directive (EU) 2022/2555 ([NIS2]) requires top-level domain (TLD) name registries and domain name registrars to collect and maintain accurate and complete domain name registration data. Assuring accuracy and completeness of registration data may involve verification of contact details and, in some cases, publishing their verification status—either in a publicly accessible RDAP service or in a closed RDAP service requiring prior authorization for legitimate access seekers or authorities. The extension defined in this document can support compliance with these obligations by enabling the inclusion of verification status for contact fields in RDAP responses in a standardized way.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
Servers implementing this extension MUST include the string "verifiedContacts" in the "rdapConformance" ([RFC9083]) array of all relevant RDAP responses. The registration of the "verifiedContacts" extension identifier is described in Section 8.¶
The verification information is conveyed via a new top-level object member named "verifiedContacts_data" within the entity objects.¶
{
"objectClassName": "entity",
"handle": "ABC123-EXAMPLE",
"rdapConformance": ["rdap_level_0", "verifiedContacts"],
...
"verifiedContacts_data":
{
[
"claims": ["name", "address"],
"verificationDate": "2025-03-15T12:00:00Z",
"trustFramework": "eidas",
"verifierId": "Registro.it",
"verificationId": "verif-20250315-0001",
"evidence": "idcard",
"method": "auth"
],
[
"claims": ["email"],
"verificationDate": "2025-03-10T09:30:00Z",
"trustFramework": "registro.it",
"verifierId": "Registro.it",
"verificationId": "verif-20250310-0001",
"method": "reachability",
"remarks" :
[
{
"description" :
[
"E-mail verification embedded
in onboarding process."
]
}
]
]
...
}
}
The "verifiedContacts_data" member is an array if objects containing:¶
(OPTIONAL) An array of strings indicating which parts of the data has been verified in a given process.¶
The list of allowed values is specified by entries of a type "verified contact claim" in "RDAP JSON Values Registry" and is extendible.¶
This specification defines the following set of values based on [OpenID]:¶
(OPTIONAL) A string determining the trust framework governing the identity verification process.¶
The list of allowed values is specified by entries of a type "verified contact trust framework" in "RDAP JSON Values Registry" and is extendible.¶
If the verification is conducted according to the policy framework of server operator, this value SHOULD be specific to this operator unless external policy has been adopted.¶
This specification defines the following set of values:¶
(OPTIONAL) A string indicating a verification method.¶
The list of allowed values is specified by entries of a type "verified contact method" in "RDAP JSON Values Registry" and is extendible.¶
This specification defines the following set of values, based on Check Methods defined in [IDA-Predefined-Values] referred from [IDA-verified-claims]:¶
(OPTIONAL) A string indicating an evidence used in the verification.¶
The list of allowed values is specified by entries of a type "verified contact evidence" in "RDAP JSON Values Registry" and is extendible.¶
This specification defines the following set of values, based on Documents, Electronic records and Vouches defined in [IDA-Predefined-Values] referred from [IDA-verified-claims]:¶
(OPTIONAL) property, which is an array of remarks (see Section 4.3 of [RFC9083]).¶
(OPTIONAL) property, which is a map of objects.¶
The list of allowed values is specified by entries of a type "verified contact extension" in "RDAP JSON Values Registry" and is extendible.¶
This specification does not specify any entries to this registry leaving it open for other specificiations.¶
In most common cases a verification of data consists of comparison against some authoritative source or document (evidence) using one of the allowed methods (method) within a defined trust framework. The same evidence may be verified using different methods, just as the same method may be applied to different evidences. Therefore, a description of the verification process typically specifies the values in a combination.¶
Real life examples of such combinations:¶
Email verification¶
{
...
"verifiedContacts_data":
{
[
"claims": ["email"],
"method": "reachability",
"evidence": "email ver transaction log",
"remarks" :
[
{
"description" :
[
"Sending a confirmation link to
the specified email address and
requiring user interaction (e.g.,
clicking the link) to confirm
ownership."
]
}
]
]
...
}
}
¶
Address Verification¶
{
...
"verifiedContacts_data":
{
[
"claims": ["address"],
"method": "data",
"evidence": "address database",
"remarks" :
[
{
"description" :
[
"Verification of the postal address using
a geolocation or address validation service
(e.g., Google Maps API, OpenStreetMap,
postal databases)."
]
}
]
]
...
}
}
¶
Manual review¶
{
...
"verifiedContacts_data":
{
[
"claims": ["name", "address"],
"method": "pvr",
"evidence": "idcard",
"remarks" :
[
{
"description" :
[
"Manual review of contact data by a human operator
(e.g., calling the phone number, making a live
video call, inspecting submitted documentation)."
]
}
]
]
...
}
}
¶
This extension supports the following versioning types as defined in [I-D.ietf-regext-rdap-versioning]:¶
IANA is requested to register the following value in the RDAP Extensions Registry:¶
Section 10.2 of [RFC9083] defines the RDAP JSON Values Registry with pre-defined Type field values and the use of the "Expert Review" policy defined in [RFC8126]. This specification defines new RDAP JSON Values Registry Type field values that can be used to register pre-defined "verified contact claim", "verified contact method", "verified contact trust framework", "verified contact evidence" and "verified contact extension" values. IANA is requested to update the RDAP JSON Values Registry to accept these additional type field values as follows:¶
IANA is requested to register the following in the RDAP JSON Values Registry, described in [RFC9083]:¶
Contact verification data may have privacy implications. Servers MUST ensure that disclosure of this information complies with applicable data protection laws and policies.¶
The authors wish to thank the following persons for their feedback and suggestions: Scott Hollenbeck.¶