As the administrator of the national domain, the security of the domain space and data protection are key priorities for us.
The .sk domain is an integral part of Slovakia’s digital infrastructure, supporting thousands of websites, email services, and other online services every day. Domain security is therefore not merely a technical matter; it has a direct impact on individuals, businesses, and organizations operating in the online space.
We have therefore decided to enhance certain security settings for the Central Registry of .sk domains. Our goal is to further strengthen the trustworthiness and resilience of the .sk domain space while creating a safer environment for all its users.
1. Mandatory two-factor authentication (2FA) for the web interface
This applies to all registrar accounts and will be implemented in stages:
- Phase 1 (immediate): It will no longer be possible to disable 2FA on an account if it is already active.
- Phase 2 (starting September 29, 2026): 2FA will be enabled for all accounts, with no option to disable it.
We strongly recommend setting up 2FA for all your accounts prior to the mandatory enforcement in Phase 2 to avoid any loss of access to our services.
2. Registry of allowed IP addresses (so-called “whitelisting”)
Starting September 29, 2026, we are tightening access controls for the EPP interface based on IP addresses to reduce the risk of unauthorized access.
- Each individual account must maintain an up-to-date list of allowed IP addresses in both IPv4 and IPv6 formats, as applicable.
- Access to the EPP will be restricted exclusively to IP addresses explicitly listed within the specific account.
Please review your current lists of registered IPv4 and IPv6 addresses (found under Settings / IP Restriction) and ensure that all relevant IP addresses are listed for each account before September 29, 2026, to avoid any loss of access to our services.
3. Discontinuation of support for outdated ciphers
As part of ongoing security enhancements (and in compliance with RFC 9325), support for all cipher algorithms that do not provide forward secrecy (so-called “non-forward-secret” ciphers) and are not of the AEAD type will be removed from our EPP TLS endpoint.
Consequently, connections using outdated ciphers (including algorithms with pure RSA key exchange and ciphers in CBC mode) will no longer be accepted after September 29, 2026. Please ensure that your EPP client uses one of the supported cipher algorithms listed below.
No longer supported:
- All suites using pure RSA key exchange (e.g., AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256)
- All ciphers in CBC mode (e.g., ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA384, DHE-RSA-AES256-SHA256, AES128-SHA, AES256-SHA)
- Camellia, ARIA, CCM_8, and 3DES variants
Remaining supported ciphers (TLS 1.2):
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-RSA-CHACHA20-POLY1305
- DHE-RSA-AES128-GCM-SHA256
- DHE-RSA-AES256-GCM-SHA384
Remaining supported ciphers (TLS 1.3):
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
- TLS_AES_128_GCM_SHA256
All major changes will take effect in the system on International Internet Day – October 29, 2026, so please review and adjust your settings to meet the new requirements by that date.
We recommend not leaving the review of your settings until the last minute.
Early preparation will help avoid unnecessary complications and ensure a smooth transition to the new security requirements without disrupting the normal operation of your services.
Thank you for your cooperation and support in implementing these changes.
If you require assistance, please contact us at hostmaster@sk-nic.sk.
