The Reserve Bank of India (RBI) in its latest cyber security policy released on 7th February 2025, has mandated all banks to use .bank.in and non-banks(other financial institutions) to use .fin.in. The goal of the measures is to curb phishing attacks against citizens of India.
Figure 1: Snippet of RBI’s Cybersecurity policy
Notably, Institute for Development and Research in Banking Technology (IDRBT) will be the registrar for the parent domain names (.bank.in and .fin.in)
Technical details
In a DNS context, I am guessing IDRBT would control the parent zones .bank.in and .fin.in and delegate for example icici.bank.in to ICICI Bank authoritative nameservers.
Similarly, zerodha.fin.in would be delegated to Zerodha authoritative nameservers.
IDRBT would be able to control the namespace and delegate child zone to the respective bank or financial institution.
Figure 2: Diagrammatic representation of possible delegation of bank.in and fin.in domain namespace
Limitations of the cyber security policy
In my opinion, this is an excellent move at the policy level from a cybersecurity perspective. There will be operational challenges from the perspective of the banks or financial institutions. I will reserve them for another blog post.
However, this measure will not eliminate all types of phishing/impersonation , typo-squatting or domain shadowing attacks
Despite this, the RBI Cyber Security Policy aims to build trust in the namespace by restricting domain names for banks and non-banks to .bank.in and .fin.in, respectively. From a consumer’s perspective, this simplifies decision-making. As I mentioned earlier, this won’t eliminate all threats, but it is a good start and certainly better than the common advice banks give—checking for the padlock to ensure a website uses HTTPS!
At the time of writing, the delegation from .in at NIXI to IDRBT was not yet operational.
Figure 3: Delegation of bank.in and fin.in not yet implemented at NIXI
It is to be noted, that the RBI cyber security policy implementation will start April 2025 onwards.
Recommended reading
If you liked this blog post, you might also enjoy reading Jio VoWiFi issue – It’s always DNS! or The curious case of esic.in DNS