Cybersecurity center urges .ir domain switch in Iran over sanctions risk

Iran’s AFTA cybersecurity center, whose Persian acronym means “security of the information production and exchange space,” has urged organizations to move their websites and online services to the country’s .ir domain, warning that unilateral sanctions could abruptly cut access to international domains.

The operational warning, addressed to senior IT and cybersecurity managers, names .com, .net and .org among the domains exposed to foreign restrictions. AFTA has called for urgent, preventive action to keep digital services available.

The center’s recommendation concerns a potential loss of access. It calls for the migration work to be completed before any disruption or external restriction occurs.

The .ir suffix is Iran’s country-code top-level domain, as listed by the Internet Assigned Numbers Authority.

A five-step migration plan

AFTA’s roadmap covers the legal ownership of the new address as well as the systems needed to run services on it:

1. Register the .ir domain in the organization’s name. The domain should be registered exclusively under the organization’s legal identity and ownership, rather than in an individual’s name. AFTA says this is intended to establish legal control and reduce exposure to sudden international suspensions.
2. Move all services and test them. Organizations should bring their website services fully online on the new domain, then conduct integration tests and check that every subsystem and link remains accessible.
3. Redirect traffic from the old address. A permanent HTTP 301 redirect should send visitors from the international domain to the new address. AFTA makes this conditional on the organization retaining ownership and administrative access to the old domain.
4. Review technical and security dependencies. The review should cover DNSSEC records, TLS/SSL certificates, organizational email servers, centralized authentication tokens, APIs and external mapping mechanisms. The aim is to avoid a single point of failure that could bring down the wider system.
5. Notify users through official channels. Organizations should formally tell their audiences, stakeholders and business partners about the new web address.

Registering a domain is not enough

AFTA says organizations need to complete the full migration cycle, measure service availability against their service-level agreements and carry out recovery tests. Registering a .ir address alone does not satisfy the center’s recommendations.

The center has also asked agencies and organizations with critical infrastructure to submit progress reports and implementation results so it can monitor the work and coordinate cybersecurity protection plans.