India’s banking system is undergoing a critical shift in how digital trust is established.
With the rise of phishing, impersonation fraud, and look-alike banking websites, the Reserve Bank of India (RBI) introduced a decisive measure: all banks must migrate customer-facing digital banking services to the exclusive .bank.in domain by October 31, 2025.
This move represents a foundational step toward safer digital banking — but it’s important to understand what this mandate solves, what it doesn’t, and what banks must do next to make it effective at scale.
What Is the .bank.in Mandate?
The .bank.in domain is a restricted, bank-only internet namespace designed exclusively for RBI-regulated banks.
Unlike traditional domains (.com, .in, .net), .bank.in:
- Can only be registered by verified banking institutions
- Is centrally governed and authenticated
- Creates a clear, consistent signal of legitimacy for customers
The goal is simple: make it easier for users to instantly recognize legitimate banking websites — and harder for attackers to impersonate them.
Why RBI Introduced .bank.in
The mandate is a direct response to how modern banking fraud works.
Today’s attackers don’t need to breach a bank’s internal systems. Instead, they:
- Register look-alike domains
- Clone login pages
- Exploit customer confusion
- Steal credentials and session tokens
As digital payments and online banking scale, so does the attack surface.
By standardizing banking domains under .bank.in, RBI is:
- Reducing phishing and impersonation risk
- Strengthening consumer confidence in digital banking
- Establishing a trusted digital identity at the internet layer
In short, .bank.in creates a trust anchor for India’s banking ecosystem.
What .bank.in Does Not Solve on Its Own
While .bank.in defines where trust begins, it does not guarantee how that trust is maintained.
Even under a trusted namespace, banks still face significant infrastructure risks:
- DNS misconfigurations introduced during migration
- Forgotten subdomains and shadow assets
- Dangling CNAMEs enabling domain takeover
- Certificate expirations causing outages
- Weak or quantum-vulnerable cryptography
- Look-alike domains operating outside .bank.in
- Ongoing RBI, PCI-DSS, and audit scrutiny
These are not theoretical risks — they are the most common causes of real-world banking outages, fraud, and regulatory findings.
Trust breaks at the DNS, certificate, and identity layers — not at the domain name itself.
Why the Migration Period Is the Highest-Risk Moment
Domain transitions are one of the most dangerous phases for any large organization.
During .bank.in migration, banks often:
- Run parallel domains for extended periods
- Introduce new DNS zones and records
- Decommission legacy infrastructure inconsistently
- Lose visibility into “non-critical” assets
This is where attackers look for:
- Forgotten subdomains
- Misconfigured DNS records
- Expired or mis-scoped certificates
Without continuous visibility and control, the move to .bank.in can temporarily increase risk instead of reducing it.
Operationalizing Trust Beyond .bank.in
RBI establishes the trusted namespace. DNS Posutre Management (DNSPM) ensures that trust holds — continuously, at scale.
Continuous DNS Posture Management
DNSPM discovers and monitors:
- All .bank.in zones, records, and subdomains
- Dangling CNAMEs, open zones, weak TTLs, and leaked internal DNS data
This prevents takeover and exposure risks during and after migration.
Certificate & Cryptographic Readiness
Every .bank.in service depends on certificates.
Certificate Posture Management (CPM):
- Inventories all certificates tied to .bank.in domains
- Tracks expirations, risky wildcard usage, and weak signing algorithms
- Identifies quantum-vulnerable cryptography early
This helps banks avoid outages, compliance failures, and future cryptographic risk.
Brand & Look-Alike Domain Protection
Even with .bank.in, attackers continue operating outside the official namespace.
DNSPM & Brand Protection:
- Monitor look-alike and impersonation domains globally
- Correlate DNS, hosting, and certificate signals
- Prioritize real phishing and fraud threats
This extends RBI’s intent beyond the .bank.in boundary.
Continuous Compliance & Audit Readiness
RBI expectations don’t stop at adoption.
Continuous Compliance provides:
- Continuous posture scoring mapped to RBI, PCI-DSS, ISO, and SOC frameworks
- Change tracking with audit-ready evidence
- Always-on compliance — not point-in-time validation
The Bigger Picture: From Domain Trust to Digital Trust
The .bank.in mandate is a critical milestone — but it’s not the finish line.
As banking infrastructure becomes more distributed, automated, and API-driven, trust must be:
- Continuous
- Measurable
- Enforced at the infrastructure layer
.bank.in tells customers where to trust. DNSPM ensures there’s no reason that trust should be broken.
