EPP OT&E & Testbed

OT&E and Testbed

EPP is available in a test environment (Operational Test and Evaluation – OT&E) to provide a safe ‘sandbox’ database for registrars to test their systems without fear of affecting data on the ‘live’ registry. 


Two systems are available for testing:

  • OT&E: This mirrors the production system
  • Testbed: This mirrors the production system and is used to deploy new functionality ahead of release to production. 

Each system has two services: a secure EPP service using TLS v1.2 and a plain-text server. The secure EPP service provides server authentication and data encryption but does not require SSL client authentication.

How to register for the EPP OT&E and Testbed

  • Log into the Online Services
  • Sign up for the service at Tag Settings->EPP Testbed
  • Enter a password for use in EPP login commands. This must contain at least 14 characters, to increase security
  • Specify the IP address from which you will connect to the EPP service. These details are used for both systems.
  • Connectivity to each system will be available within one hour
  • These details can be changed at any time, and will be reflected on the testbed and OT&E systems within one hour

How to connect to the EPP testbed server

  • Obtain an EPP client
  • In order to verify the identity of the secure server, you will need the ‘Verisign Class 3 Public Primary Certification Authority’ root certificate available free from www.verisign.com (the certificate is also distributed with most web browsers)
  • Connections can only be made from the IP address specified above

For the EPP OT&E Server:

  • Connect to the secure server at ote-epp.nominet.org.uk, port: 700.
  • Connect to the plain-text server at ote-epp.nominet.org.uk, port: 8700.

For the EPP Testbed Server:

  • Connect to the secure server at testbed-epp.nominet.org.uk, port: 700.
  • Connect to the plain-text server at testbed-epp.nominet.org.uk, port: 8700.


Objects existing in the live registry, such as domains and registrant accounts, are NOT replicated in the OT&E environment. Only a clone of your registrar account, and a clone of each tag which is registered to use EPP, will appear in the dataset. Aside from this, all information in the testbed will be fictional. A set of domains will be created on each tag, covering a variety of different states grouped together under a series of registrants (TAG will be replaced by your tag-name):

Simple registrant (LTD)

DomainNameservers Notes

Multiple registrant

banquo-TAG.co.ukns1.benedick-TAG.co.ukShared nameserver
beatrice-TAG.co.ukns1.benedick-TAG.co.ukMultiple nameservers
 ns1.beatrice-TAG.co.uk (IPv4) 
 ns2.beatrice-TAG.co.uk (IPv6) 

Double Registrant (SCH) – Two separate registrants with identical account details 


Suspensions registrant (IND) 


Expiry registrant (PLC) 

ganymede-TAG.net.ukns1.ganymede-TAG.net.ukExpires in 181 days
ganymede-TAG.co.ukns1.ganymede-TAG.net.ukExpires in 179 days
ganymede-TAG.plc.ukns1.ganymede-TAG.net.ukExpires in 2 days, auto-bill=3
hermione-TAG.co.ukns1.ganymede-TAG.net.ukExpires in 2 days, auto-bill=4
hermia-TAG.plc.ukns1.ganymede-TAG.net.ukExpires in 2 days, next-bill=3
horatio-TAG.co.ukns1.ganymede-TAG.net.ukExpires in 2 days, next-bill=4
lysander-TAG.co.ukns1.ganymede-TAG.net.ukExpires in 2 days, renewed within the last 24 hours
macbeth-TAG.plc.ukns1.ganymede-TAG.net.uk>2 years old, renewed
perdita-TAG.co.ukns1.ganymede-TAG.net.ukExpires in 2 years
perdita-TAG.org.ukns1.ganymede-TAG.net.ukExpires in 5 years 

DNA registrant 

macduff-TAG.co.ukns1.macduff-TAG.co.ukIn renewal period, Do Not Renew set
mercutio-TAG.co.ukns1.macduff-TAG.co.ukNot in renewal period, Do Not Cancel set 

Registration registrant 


DNSSEC registrant 


Failed validation data 

portia-TAG.co.ukns1.portia-TAG.co.ukName data failed validation
romeo-TAG.co.ukns1.romeo-TAG.co.ukAddress data failed validation
titania-TAG.co.ukns1.titania-TAG.co.ukName and address failed validation
aegeon-TAG.co.ukns1.aegeon-TAG.co.ukName and address failed validation

Expiring Domains

helena-TAG.co.ukExpiry Grace Period
lavinia-TAG.co.ukRedemption Grace Period
octavia-TAG.co.ukPending Delete Grace Period (1 day in)
rosaline-TAG.co.ukDropping @ 9am UTC
margaret-TAG.co.ukDropping @10am UTC
mariana-TAG.co.ukDropping @ 11am UTC
fabian-TAG.co.ukDropping @ 12pm UTC
francisca-TAG.co.ukDropping @1pm UTC
nerissa-TAG.co.ukDropping @ 2pm UTC
paulina-TAG.co.ukDropping @ 3pm UTC
phebe-TAG.co.ukDropping @ 4pm UTC
dolabella-TAG.co.ukDropping @ 5pm UTC
hamlet-TAG.co.ukDropping @ 6pm UTC


All tags can utilise DNSSEC.

Manual Referrals

To test create requests which are referred for manual intervention, applications made to the testbed for domain names ending “.ltd.uk” are validated automatically. 

Changing EPP login details & option fields

Your EPP password for the testbed (and the associated IP address) can be changed via the Online Services. Such changes will be reflected in the testbed after the next hourly reset cycle. 

Your EPP password must have at least 14 characters, to make it more secure.

Changes made within the testbed to your EPP password will affect only the testbed. No data in the testbed will be copied to the live register.


A WHOIS server is available for each system to assist with testing. The testbed server is at testbed-whois.nominet.org.uk and OT&E server is at ote-whois.nominet.org.uk. Usage limits of 100,000 requests per day are in force.


To generate registrar change notifications on the testbed, a clone of all tags on the testbed has been provided – all connection IP addresses are the same. This tag can be used to transfer a domain name to your tag and generate a notification. The name of the cloned tag is generated as follows:

  • If the tag name has less than 16 characters, the cloned tag is the same as the original with a trailing ‘_’. For example, if the tag is ‘EXAMPLE’, the cloned tag is ‘EXAMPLE_’.
  • If the tag name has 16 characters, the final character has been replaced with a ‘_’. For example, if the tag is ‘EXAMPLE-WITH-16C’, the cloned tag is ‘EXAMPLE-WITH-16_’.

Registrar change handshakes

When a registrar change is requested to move a domain name to another tag, a handshake may be generated. In our live system, handshakes are automatically rejected after 5 days if no action has been taken. In the test bed, this timeout is set to one hour.

Minerva House, Edmund Halley Road, Oxford Science Park, OX4 4DQ, United Kingdom