Qatar's updated .qa domain policies: what SMEs should check

Published 2026-11-03 · 4 min read · Samtaro Security & Legal

What the CRA announced

According to the CRA's announcement, carried by Qatar News Agency on 3 November 2026, the updated Qatar Domains Registry policies came into effect on 22 October 2026 alongside a new domain registry system. The announced changes cover .qa and .قطر names:

• The maximum registration period goes from five to ten years.
• Registration, renewal, transfer and recovery procedures are regulated, and domain holders' rights and responsibilities are clarified.
• Protection of registration information is strengthened.
• Eligibility requirements are clearer, which the CRA says should help reduce domain misuse, identity impersonation and phishing.

The CRA's Registrants page lists who each zone is for. For example, .com.qa is for companies and businesses registered in Qatar, and .qa and .قطر are open to all. Registration goes through a CRA-accredited registrar.

What registrars are telling customers

Accredited registrars have sent their own notices. QHost's notice to customers, for example, says existing .qa domains won't be cancelled automatically because of the change. Other registrars' notices say new registrations now need supporting eligibility documents and that changes to registrant details or nameservers on an existing domain may need extra verification. Those are the registrars' summaries, not the CRA's text, so ask your own registrar what applies to your domain.

Five checks for your business domain

1. Expiry date: look up your domain on the CRA's Whois service and make sure the renewal date is in someone's calendar. A lapsed domain takes your website and email down together.
2. Registrant details: check the domain is held in the company's name, not a former employee's or an agency's, since changing it later may now involve eligibility checks.
3. Registrar account: turn on MFA for the registrar login and confirm who at your company can sign in (see our website security checklist).
4. Plan DNS changes early: if you're moving hosting or email soon, ask the registrar how long a nameserver change takes under the new process.
5. Email authentication: clearer registry rules don't stop someone spoofing your existing domain in email. SPF, DKIM and a DMARC policy do that job (email authentication guide).

What our scan can and can't see

Our automated, passive scan checks the public signals on your website and domain, including SPF and DMARC records. It can't see your registrar account, your registration documents or your eligibility status. It is not a security audit or penetration test, it is not legal advice, and we're not connected to the CRA or any registrar.

Check the public side in under a minute with the free mini-scan.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.