Before you buy a .sg domain: what to know (and how to avoid the "Connection Is Not Private" warning)

What you are signing up for with a .sg domain

A .sg domain comes with six rules that a .com domain does not have:

• Singapore administrative contact: You must name a contact in Singapore. This can be a person with an NRIC or FIN, or an organisation with a UEN, and they need a Singapore postal address.
• Singpass or Corppass check: That contact logs in to SGNIC's VerifiedID@SG portal and clicks "Verify Identity". It takes under 5 minutes.
• 21-day deadline: The check must be done within 21 calendar days of registration. If it isn't, the domain is suspended. The deadline can be extended once, by 7 days.
• Consent email: Shortly after you order, a consent email goes to the registrant's email address, and it must be accepted.
• Exact details: A company name must match its UEN record exactly. Personalised Singpass IDs are not accepted, only NRIC or FIN format.
• Repeat checks: If the owner's details or the administrative contact change later, the check must be done again. The domain can't be renewed until it is.

Not based in Singapore? You can still own a .sg domain, but you need a Singapore-based agent to act as your administrative contact.

Buying a .com.sg instead? It is for Singapore-registered companies, or businesses with a local presence or agent in Singapore.

Rules are from the SGNIC VerifiedID@SG FAQ and Namecheap's .sg requirements.

Why a new .sg site can show "This Connection Is Not Private"

The warning means the site's security certificate is not active yet. It does not mean the site was hacked.

Every website needs a security certificate (also called SSL). It puts the padlock in the browser and tells visitors the site is safe. A certificate can only be issued once the domain is fully active and pointing to your website.

With a .sg domain, the extra steps above can hold that up:

1. You buy the domain.
2. The consent email or the Singpass check is still waiting.
3. The domain is not fully active, so the certificate cannot be issued.
4. Visitors see the warning until the steps are finished.

Once the steps are done and the certificate is issued, the warning goes away by itself and the padlock appears. Your content is safe the whole time.

Checklist before you pay

If you can tick all five, a .sg domain is a safe choice.

• I have, or can appoint, a contact in Singapore with a Singpass or Corppass account.
• That person knows they must verify within 21 days and has agreed to do it.
• The email addresses I will use for the owner and the contact are ones we check daily.
• My company name is written exactly as it appears on my UEN record.
• I am fine with my site launch waiting until verification is complete.

Getting a .sg domain live on OhhWells

Plan for the identity check first, then launch. The order matters.

1. Decide who your Singapore administrative contact will be, and get their NRIC, FIN or UEN details.
2. Buy the domain and enter the owner and contact details exactly as they appear on official records.
3. Accept the consent email sent to the owner's email address.
4. Ask your administrative contact to complete the Singpass check. SGNIC emails them a link, or they can go straight to verifiedid.sgnic.sg.
5. Connect the domain to your OhhWells site. The security certificate is then set up for you.
6. Open your site and look for the padlock before you announce it.

To check progress at any time, search your domain on sgnic.sg. "VerifiedID@SG-OK" means verified. "VerifiedID@SG-Pending" means the check is still waiting.

Domain fees are paid to the registry, so they may not be refundable if you change your mind.

Frequently asked questions

Do I need Singpass to register a .sg domain?

Yes. The administrative contact must verify with Singpass (for a person) or Corppass (for a business) within 21 calendar days of registration.

Can a foreigner or overseas company own a .sg domain?

Yes, but you must appoint an administrative contact with a local presence and a Singapore postal address. Most overseas owners use a Singapore-based agent.

What happens if I miss the 21-day verification deadline?

SGNIC suspends the domain. Your website and emails stop working until the check is done. You can ask for one 7-day extension before the deadline.

Why does my new .sg website say "This Connection Is Not Private"?

The security certificate has not been issued yet, often because a .sg setup step is still waiting. Your site has not been hacked. The warning clears once the certificate is active.

How long does .sg verification take?

The Singpass check itself takes under 5 minutes. Delays almost always come from the contact not seeing the email or not having a Singpass account.

Is a .com domain easier than a .sg domain?

Yes. A .com has no local contact rule and no identity check. Pick .sg when a Singapore identity matters to your customers and you can meet the rules above.

Do I have to verify again later?

Only if the owner's details or the administrative contact change. Until the new check is done, the domain cannot be renewed.