.nl domain names

What .nl is

.nl is the country-code top-level domain (ccTLD) of the Netherlands - the European part of the Kingdom, since the Caribbean territories have their own extensions. The zone was delegated on 25 April 1986 and the first domain, cwi.nl, was registered six days later. The careful formulation used by both the registry and CWI is that .nl became the first active country-code domain outside the United States; .us, .uk and .il were delegated earlier. The registry is SIDN, a foundation based in Arnhem, founded on 31 January 1996 by CWI, SURFnet and NLnet.

The register held 6,063,462 domains on 1 April 2026, with 65.08% domestic market share, and SIDN describes .nl as the world's fourth-largest ccTLD. It is also widely reported to have one of the highest rates of domain adoption per head of population anywhere; no registry publishes an authoritative per-capita ranking, so treat that as a reasonable inference from a six-million-name register in a country of the Netherlands' size rather than as a measured figure. One change is imminent: .nl migrates to the Hello Registry platform on 1 September 2026, a joint venture with CIRA, the .ca operator, so documentation of .nl's mechanics written before that date may not survive it.

Who can register .nl

.nl is genuinely open. Article 1.1 of SIDN's General Terms and Conditions states that anyone, living or based anywhere in the world, may apply through a registrar to register a .nl domain name. There is no residency, nationality or Dutch-nexus test and no trustee requirement, which makes .nl markedly more accessible than .eu, .fr or .it. Registration opened to private individuals in June 2003.

Three qualifications apply. SIDN reserves a latent power to impose additional conditions on persons based outside the European Union, though none is currently published. Registrants not based in the Netherlands must accept that SIDN's own office address may be used for service of documents by bailiff - a jurisdictional hook rather than an eligibility bar. And a real physical address is mandatory: PO boxes are explicitly refused. The registrant must also be the effective controller and actual user of the domain, not a registrar, reseller or privacy provider. Names run from two to 63 characters, and .nl is pre-delegation checked, so working nameservers are a precondition of registration - at least two, redundant, on separate networks, each on a unique IP address.

What .nl costs to own

Wholesale has two components: a per-domain registry fee quoted on an annual basis, and a separate registrar account fee charged monthly as a flat platform charge independent of volume. That second component is part of why small and large registrars price .nl differently. SIDN publishes its fee changes as percentages: the registry fee rose 10% in 2024, then 2.5% in 2025, then 2.9% in 2026 - one substantial correction followed by small inflation-tracking adjustments. There is no ICANN-style six-months-notice or ten-year price-lock mechanic.

No premium-name policy or registry price tier has been found; .nl appears to run flat uniform pricing with first-come, first-served allocation. Because there is no fixed term at registry level, the first-year-versus-renewal distinction that dominates gTLD pricing is purely a retail construct, and a promotional first year tells you nothing about year two. One registry charge is worth knowing in advance: reinstating a domain from quarantine incurs a charge to the registrar, normally passed on. SIDN also pays registrars rebates for adopting security standards - a cost that never appears on an invoice, but which is why .nl's security baseline looks the way it does.

Registration terms, renewals, and transfers

.nl has no registration term. Article 15.1 of the General Terms and Conditions states that the period of registration is indefinite. There is no expiry date at registry level and no renewal event to miss. The registrant may cancel unilaterally at any time through their registrar; if SIDN terminates, it gives thirty days' written notice. SIDN has historically offered one-month and three-month registration periods alongside annual ones and is withdrawing both before the September 2026 migration - so .nl is an indefinite contract with an annual billing cycle, and the date that can cost you a domain is your registrar's cancellation deadline.

Transfers use a transfer token, the verhuistoken. You request it from your current registrar and pass it to the new one, which submits it to SIDN, and the domain transfers immediately - no pending window, no acknowledge-or-reject cycle, and no documented post-transfer lock of the kind ICANN imposes. The key protection is that the losing registrar is obliged to supply the token within five days if asked. Issuing it is a duty, not a discretion, and SIDN publishes a formal reminder letter template for registrants to send to a non-compliant registrar.

Changing the registrant is a distinct operation with distinct legal effect: under Article 9 a conveyance is the cancellation of the existing registration contract and the formation of a new one - a novation, not an assignment. Where a sale involves both a new owner and a new registrar, SIDN requires the two operations to be sequenced, and the order chosen determines which party must obtain the token. On cancellation a name enters a 40-day quarantine during which only the former registrant may recover it, through any registrar, after which it is released at a random moment within a one-hour window following the published UTC end time.

WHOIS, RDAP, and privacy

.nl's privacy model predates GDPR: SIDN restricted private registrants' data on 1 March 2016, more than two years before the Regulation applied. The current position is a split keyed to registrant type. For a private registrant - a natural person not acting in a professional or commercial capacity - the name and address are hidden. For a business or legal entity the name is published, with the address hidden by default and visible only if the registrant opts in. Neither category has registrant email or telephone published; administrative and technical contacts appear as an email address only.

Privacy and proxy services are prohibited. Since 1 October 2023 SIDN has not allowed third parties to act as nominal registrants of .nl domains, and the ban explicitly covers registrars and resellers as well as commercial privacy providers. Its reasons are that the service is obsolete for individuals whose data has been withheld since 2016, that registrant data must be correct, that domains used dishonestly are disproportionately registered through proxies, and that it must be able to identify the effective controller. Business registrants who need anonymity have one narrow route: the discretionary opt-out under Article 23.4, requiring the applicant to demonstrate a material interest in anonymity outweighing the public interest in disclosure, decided within three weeks and appealable to an independent board. It is typically refused where the motivation is spam or a grudge.

SIDN operates an RDAP service registered with IANA at rdap.sidn.nl, so autodiscovery works for .nl unlike several of its neighbours, though field-level behaviour has not been independently confirmed. The WHOIS conditions of use are restrictive in their own right: four permitted purposes only, with marketing use, screen-scraping and automated lookups prohibited outright and a limit of 500 lookups per IP address per 24 hours. .nl does not support internationalised domain names at all - letters, digits and hyphens only.

Who .nl suits, and who should avoid it

.nl suits any business selling into the Netherlands, where it holds roughly 65% domestic market share, and non-Dutch companies and individuals unusually well for a major European ccTLD, since there is genuinely no local presence requirement and no trustee cost. It suits security-conscious operators, because DNSSEC signing is a well-supported default across the Dutch registrar ecosystem and around 60% of Dutch users sit behind validating resolvers. And it suits long-term holders: an indefinite term plus a 40-day quarantine with owner-only reinstatement makes accidental loss unusually hard.

It suits businesses that need WHOIS privacy badly. Business registrant names are public by default, privacy services are banned, and the opt-out is discretionary and routinely refused for ordinary spam concerns. It is unsuitable for anyone needing non-ASCII characters. Speculators should note there is no registry premium tier and that the zone contracted through 2024 and 2025 before returning to growth. And businesses wanting meaningful recourse should read Article 25.1 first: SIDN's liability is capped at roughly twice one year's wholesale fee.

Common mistakes with .nl

Confusing a transfer with a change of registrant, and sequencing them wrongly. Buyers routinely assume that moving a .nl into their own registrar account makes them the owner. It does not: a transfer changes only the registrar, and the registrant of record remains the only party who can later move, sell or reinstate the name. Because the order of operations determines which party must fetch the token, a mis-sequenced purchase can leave a buyer paying for a domain the seller still legally controls.

Applying gTLD expiry assumptions. There is no expiry date, so registrants used to renewal reminders get caught out by a registrar-side cancellation instead. Those who do cancel often assume the name is instantly gone or instantly available; it is neither. For 40 days only the former registrant can recover it, and it is then released at a random moment within a one-hour window, so back-orderers who compute a precise drop time lose the name.

Registering with a PO box, a stale registrant, or through a proxy. PO boxes are refused outright, and third-party nominal registrants have been prohibited since 1 October 2023. And because only the registrant of record can transfer, reinstate or convey a name, a domain registered under a former employee or a dissolved company becomes very difficult to move.

How a registry raises the security of an entire namespace

Most registries treat security as something that happens further down the chain: sign the zone, publish a policy, leave adoption to registrars and hosting providers. SIDN took the opposite view, and .nl is the clearest working demonstration of what a registry can change when it decides the baseline is its own problem.

The headline result is DNSSEC - the extension that cryptographically signs DNS responses so a resolver can detect tampering. It became available for .nl in August 2012, and adoption then went where no other large namespace has gone: about 1.5 million signed domains by May 2013, 2,499,811 or 44.5% of the zone by April 2016, roughly 3.2 million by July 2019, and by the start of 2026 roughly 3.8 million, which SIDN describes as more than 60 per cent of the zone. In absolute terms that is one of the highest signed-domain counts of any TLD on earth.

The mechanism was not persuasion. SIDN paid for it. Its Registrar Scorecard offered registrars a direct rebate on DNSSEC-signed domains, turning signing from a cost centre into a margin item, and it has since broadened to reward email security, IPv6 support and active use. SIDN is honest about the limits: progress has slowed to one or two percentage points a year, because the domains still unsigned sit with registrars who have never automated signing, and no rebate reaches an organisation that has not built the pipeline.

Signing alone would be theatre if nobody validated. Roughly 60% of queries reaching .nl's authoritative nameservers come from validating resolvers, and around 59 to 60% of Dutch internet users sit behind one, against roughly 30% globally and over 40% across Europe. Signatures on a .nl name are actually checked, which is not true everywhere.

The same instinct shows up elsewhere. .nl withheld private registrants' data from March 2016, years before GDPR compelled anything; it refuses to delegate a name until at least two redundant nameservers on separate networks answer correctly; it banned third-party nominal registrants in 2023 on the reasoning that proxy registration is over-represented in abuse; and it cut the average time a phishing site stayed online to 20 hours in 2025 from 23 the year before. The general point applies to every namespace. A registry cannot write secure software for its registrants, but it controls three levers that reach every name in the zone: what it pays for, what it checks before delegation, and what it prohibits. SIDN pulled all three, and the result is a namespace whose security floor is set by policy rather than by whichever registrar a buyer happened to click on.