/guides · /guides/icann-verification-email
Is that domain verification email real?
The verification email looks like phishing because it has every feature of phishing: an unfamiliar sender, a link, and a deadline. Binning it takes your domain offline fifteen days later.
Why you are getting it at all
For a generic ending — .com, .net, .org and the rest — the registrar must verify the registrant's email address on a new registration, and again whenever that address changes. It comes from the Whois Accuracy Program in the 2013 registrar accreditation agreement, so the registrar is not being cautious or upselling you; it has no discretion about it. Country-code endings sit outside ICANN's agreements and each registry sets its own rule, which is why the same purchase can trigger this for a .com and not for a .de.
That obligation has teeth. If no reply arrives within fifteen days the registrar has two permitted routes: verify the details by hand, or suspend the domain. Most suspend, because verifying by hand does not scale. Suspension does not cancel the registration or put the name up for sale — it sets the status clientHold, which pulls the name out of the DNS entirely. The registration is still yours and still paid for. It just stops resolving, so the website goes dark and the mail bounces.
The thirty-second test
A genuine verification notice asks you to confirm an address. That is all. It never asks for a payment, never asks for a password, and never asks you to log in to see what is wrong. If the message wants money or credentials, it is not this.
It also comes from your registrar, not from ICANN. ICANN does not email registrants directly about verification, so a message signed "ICANN" is already suspicious. The registrar on record is public: run a WHOIS / RDAP lookup on your own domain and compare the registrar name there with the sender. A mismatch is the end of the conversation.
The safest move, whatever the message looks like, is not to click it. Log in to your registrar directly — by typing the address yourself — and look for a pending verification there. A real request will be visible in the account. A fake one will not exist.
If the domain has already gone dark
Run a WHOIS / RDAP lookup. If the status includes clientHold — RDAP prints it as client hold, in lower case with a space — that is almost certainly why. The lookup will show the status and the nameservers; it will not show the registrant address, because registrant details are redacted by default, so the address the notice went to is visible only inside your registrar account.
The hold is reversible and nothing has been lost. Verify the address and the registrar lifts it, usually within minutes to a few hours. The domain comes back exactly as it was.
When the mailbox is dead
This is the case the registrar help pages skip, and it is the one people actually get stuck on. If the registrant address is an old mailbox you cannot open, the link can never be clicked, and resending the notice just sends it to the same dead address again.
The fix has to start somewhere else: change the registrant email in the account first, which triggers a fresh verification to the new address, and answer that one. If you cannot get into the account either, the registrar's own account-recovery process is the only route — there is no way around identity here, and nobody should offer you one. Keeping the registrant address independent of the domain it is attached to is the lesson, and it is the same one behind renewal reminders: an address that lives on the domain stops working at exactly the moment you need it.
What a reseller can and cannot do
Worth saying plainly, because it is where support conversations stall. If you bought your domain through a reseller, the verification is still run by the registrar of record behind it, and a reseller cannot verify on your behalf or lift the hold. That is not a policy choice. The obligation sits with the accredited registrar and the confirmation has to come from the registrant.
What a reseller can do is tell you which registrar is behind your domain, confirm whether a notice you received matches one it knows about, and pass your case on. Ours says who it files through in the terms, and you can check it yourself in any WHOIS record.