W System / Blog / Peppol participant lookup in 2026: SML, SMP and the new OpenPeppol zone

Peppol participant lookup in 2026: query the OpenPeppol SML, not the old EC zone

By Zifeng Wei, W System · Published · All articles

In short: to find out whether a company can receive Peppol invoices, you hash its participant id, look it up in the SML (a DNS zone) to get its SMP, and ask the SMP which document types it accepts. Since 2 September 2026 the production SML is run by OpenPeppol under participant.sml.prod.tech.peppol.org; Access Points had to switch by 31 August. Code that still queries the old European Commission zone edelivery.tech.ec.europa.eu is reading a system that is no longer the production one, and on 22 October 2026 a validating resolver (Cloudflare 1.1.1.1) refused our lookup there with a DNSSEC error. The hashing is unchanged, so the fix is one line. Below: the timeline, the lookup step by step, a 30-line Python example, and two traps (the Peppol Directory and the participant scheme).

What changed, and when

DateWhat changes
19 March 2026Migration window opens; the OpenPeppol SML starts running next to the European Commission one.
31 May 2026Deadline for SMP providers to register participants through the new OpenPeppol management API (api.sml.prod.tech.peppol.org).
31 August 2026Deadline for Access Points to switch DNS lookups to participant.sml.prod.tech.peppol.org (test: participant.sml.test.tech.peppol.org).
2 September 2026The OpenPeppol SML is the production system. The old edelivery.tech.ec.europa.eu zone is no longer part of the production chain.

OpenPeppol's own summary: the only change for service providers is the new DNS lookup domain (for Access Points) and the new registration endpoint (for SMPs); dynamic discovery itself works as before. The same applies to anyone else who does lookups: ERP and invoicing vendors checking a buyer before a send, onboarding flows, monitoring and analytics.

The lookup, step by step

  1. Participant id. Scheme code plus value, for example 0245:2020273893 (a Slovak DIČ) or 0208:0202239951 (a Belgian enterprise number). The identifier scheme is iso6523-actorid-upis.
  2. DNS name. Lowercase the id, take its SHA-256 hash, Base32-encode it and drop the = padding, then append .iso6523-actorid-upis.participant.sml.prod.tech.peppol.org. OpenPeppol's own example: 9915:test becomes eh5boavaktmbgzyh2a63dz4qov33fvp5nsdvqklucfraayoodw6a.
  3. NAPTR record. Query that name for type NAPTR. A registered participant has a U-NAPTR record with the service Meta:SMP whose regular expression holds the SMP base URL. NXDOMAIN means the id is not registered on Peppol. The older B-<md5> CNAME records were replaced by NAPTR in 2025, so don't build new code on them.
  4. SMP service group. GET <SMP URL>/iso6523-actorid-upis%3A%3A0245%3A2020273893 lists one reference per document type the participant accepts. Look for the Peppol BIS Billing 3.0 invoice and credit note ids. A 404 means the SML entry exists but the SMP doesn't publish it.
  5. Endpoint (sending only). An Access Point then reads the signed service metadata for the chosen document type to get the receiving endpoint and certificate. For a "can they receive?" check you can stop at step 4.

Example: the lookup in plain Python

No dependencies; DNS goes through DNS over HTTPS so it runs anywhere. Tested on 22 October 2026 against 0245:2020273893 (Slovak Telekom, a.s.): the SML pointed to https://sml.peppol-smp.sk and the SMP listed five document types, including Peppol BIS Billing 3.0 invoices and credit notes. In production, also guard the SMP URL before fetching it (http or https, host names only, no internal addresses), set short timeouts and cache the answers.

import base64, hashlib, json, re, urllib.parse, urllib.request

ZONE = "iso6523-actorid-upis.participant.sml.prod.tech.peppol.org"  # OpenPeppol SML since 2 Sep 2026

def sml_name(pid):  # pid like "0245:2020273893"
    h = hashlib.sha256(pid.strip().lower().encode()).digest()
    return base64.b32encode(h).decode().rstrip("=") + "." + ZONE

def smp_url(pid):
    q = urllib.parse.urlencode({"name": sml_name(pid), "type": "NAPTR"})
    req = urllib.request.Request("https://cloudflare-dns.com/dns-query?" + q, headers={"accept": "application/dns-json"})
    ans = json.load(urllib.request.urlopen(req, timeout=5))
    for a in ans.get("Answer", []):
        m = re.search(r'"Meta:SMP" "!\.\*!([^!]+)!"', a["data"])
        if m:
            return m.group(1)
    return None  # NXDOMAIN or no U-NAPTR: not registered on Peppol

pid = "0245:2020273893"
base = smp_url(pid)
print(base)
if base:
    url = base.rstrip("/") + "/" + urllib.parse.quote("iso6523-actorid-upis::" + pid, safe="")
    xml = urllib.request.urlopen(url, timeout=6).read().decode()
    refs = re.findall(r'ServiceMetadataReference[^>]*href="([^"]+)"', xml)
    print(len(refs), "document types")

Trap 1: the Peppol Directory is not the register

The public Peppol Directory is the easy way to search by name or id, but a business card there is optional, so a company can be fully reachable on Peppol and still be missing from it. Slovak Telekom above is one: the Directory had no card for either of its likely ids on 22 October 2026, while the SML and its SMP showed it can receive BIS 3 invoices. A good order is: Directory first (it gives a name and country), then SML and SMP when the Directory has nothing. The Directory's REST API also states a limit of 2 queries per second.

Trap 2: look up the scheme companies actually use

A company registers under one participant id, and it is often not the VAT-based scheme. In the Directory, most Slovak companies use 0245 with the DIČ rather than 9950:SK…, French companies 0225 with the SIREN, Belgian ones 0208 with the enterprise number, and Dutch and Estonian ones often their registry codes (0106 KvK, 0191). Code that derives one id from the VAT number and stops there will report "not on Peppol" for companies that are. Try the likely schemes for the buyer's country, and ask the buyer to confirm the id before the first live send.

Checklist

If you'd rather call one endpoint

Disclosure: W System, which publishes this page, makes the API in this section. GET https://api.wsystem.dev/einvoice/route?id=SK2020273893 takes a VAT number, checks it in VIES, tries the participant ids used in that country (with a registry-code lookup for NL, EE and LT), searches the Peppol Directory and then the OpenPeppol SML and SMP, and says which schemes it tried and where it found the company. It also returns the country's e-invoicing mandate. No key needed for a few calls a day. Real response from the live API on 22 October 2026 (shortened):

{
 "query": "SK2020273893",
 "vat": {
  "status": "valid",
  "name": "Slovak Telekom, a.s."
 },
 "peppol": {
  "participant_id": "iso6523-actorid-upis::0245:2020273893",
  "registered": true,
  "source": "smp",
  "smp_host": "sml.peppol-smp.sk",
  "supports_peppol_bis3_invoice": true,
  "supports_peppol_bis3_creditnote": true,
  "ids_detail": [
   {
    "id": "iso6523-actorid-upis::0245:2020273893",
    "directory": false,
    "smp": true
   },
   {
    "id": "iso6523-actorid-upis::9950:sk2020273893",
    "directory": false,
    "smp": false
   }
  ],
  "note": "Registered on Peppol (found in the SML/SMP), but no business card is published in the Peppol Directory, so the name is not shown. Document types come from the participant's SMP."
 }
}

It checks only the ids it tries; a company registered under some other scheme can still be missed. More on the e-invoicing API page.

Questions and answers

Which DNS zone do I use for Peppol participant lookups now?

Production: iso6523-actorid-upis.participant.sml.prod.tech.peppol.org. Test: iso6523-actorid-upis.participant.sml.test.tech.peppol.org. OpenPeppol made these mandatory for Access Point lookups from 31 August 2026; the old European Commission zone edelivery.tech.ec.europa.eu is no longer the production SML.

Did the hashing of the participant id change?

No. The DNS label is still the Base32 encoding (padding removed) of the SHA-256 hash of the lowercased participant id, for example 9915:test, followed by the scheme and the SML zone, and the answer is a U-NAPTR record with the service Meta:SMP that holds the SMP base URL. Only the zone changed.

Is the Peppol Directory enough to tell whether a company can receive Peppol invoices?

No. Publishing a business card in the Peppol Directory is up to the service provider, so a registered participant can be missing from it. The SML and the participant's SMP are what Access Points actually use; check them when the Directory has no card.

Which participant id should I look up for a company?

The one the company is registered under, which is often not the VAT-based scheme: most Slovak companies use 0245 with the DIČ, French companies 0225 with the SIREN, Belgian ones 0208 with the enterprise number, Dutch ones often 0106 with the KvK number and Estonian ones 0191 with the registry code. Try the likely schemes for the country, not one.

Do I need an Access Point to do these lookups?

No. The SML is public DNS and SMPs answer public HTTP GET requests. You only need an Access Point to send the invoice itself.

Sources

Related

Checked against the OpenPeppol and AgID pages and with live DNS and SMP lookups on 22 October 2026.

Facts checked 2026-10-22. W System is the maker of this product. Not affiliated with the European Commission. Not legal or tax advice.