Search... ⌘ K
Get Started Contact Sales

.BANK Domains

Last updated

.BANK domains are only for regulated banks and related organizations, and the registry, fTLD, verifies every registrant before the domain is registered. At DNSimple, .BANK registration is available only on Enterprise plans, and the account must enforce multi-factor authentication.

.BANK is a highly-regulated TLD, so the requirements for highly-regulated TLDs in the Domain Registration Agreement also apply.

Who can register a .BANK domain?

Your organization must meet fTLD’s eligibility requirements, and the domain names you choose must correspond to your organization’s legal name or branding. Eligible organizations include banks and savings associations that are chartered and supervised by a government regulatory authority, and associations of them. Review the Organization Eligibility and Domain Name Eligibility guidelines before you apply.

Holding and parent companies of retail banks and savings associations are also eligible if a government regulator supervises them. Offshore banks, development banks, cryptocurrency companies, peer-to-peer payment providers, electronic money institutions, and non-bank financial companies such as fintechs and payday lenders are not eligible. The full rules are in fTLD’s .BANK Registrant Eligibility Policy (PDF).

How do I register a .BANK domain?

fTLD verifies your organization before the domain can be registered.

Register a .BANK domain
  1. Apply to fTLD at register.bank/get-started and complete their verification.
  2. When fTLD approves your application, you receive an fTLD registration token.
  3. Contact support with the domain name and the registration token. We will complete the registration for you.

What does DNSimple require for .BANK domains?

  • Multi-factor authentication: the account must enforce multi-factor authentication for all its users. .BANK management is also turned on per account: if the account shows “Managing MFA regulated domains isn’t enabled on your account”, contact support.
  • API access: API requests for the account are blocked by default, so that integrations cannot bypass multi-factor authentication. To enable API access, contact support.
  • DomainPinLock: the registry locks every .BANK domain with DomainPinLock, and it cannot be turned off. Any change to the domain needs a token that is emailed to the registrant.

What security requirements does fTLD set?

fTLD monitors every .BANK domain against its security requirements:

  • Name servers: the authoritative name servers must have host names within the .BANK domain.
  • DNSSEC: the domain must be signed with DNSSEC using strong cryptographic algorithms.
  • HTTPS: websites must use HTTPS with a valid certificate.
  • TLS: servers must use TLS 1.2 or higher.
  • Email authentication: the domain must publish DMARC and SPF records. DKIM is recommended alongside them.
  • Vendors: web and email hosting providers must meet the same requirements.

How does DNSimple help you meet the requirements?

  • Vanity name servers: you can use your own .BANK domain for your name server host names, such as ns1.example.bank through ns4.example.bank, answered by DNSimple. Learn how to set up vanity name servers.
  • DNSSEC: DNSimple signs your zone with RSA/SHA-256 (algorithm 8) and rotates the keys automatically. For domains registered with DNSimple, the DS record at the registry is updated for you. Learn more in DNSSEC at DNSimple.
  • SSL certificates: Let’s Encrypt certificates are available at no additional charge and DNSimple renews them automatically. They are valid for 90 days, so install the renewed certificate on your web servers each time.
  • URL redirects: the DNSimple URL redirector accepts HTTPS connections only over TLS 1.2 or higher.
  • Email authentication: you can add DMARC, SPF, and DKIM records to your zone. Learn more in DNS records.

TLS settings on your own web servers are up to you to configure.

How often does fTLD re-verify .BANK domains?

fTLD re-verifies .BANK registrants at least every two years, or at renewal, whichever comes first. Any change to the registrant’s organization name also starts a full re-verification.

To keep re-verification smooth, keep the registrant contact and organization details in your DNSimple account accurate, including the telephone number and physical address.

Have more questions?

If you have any questions or need assistance with registering domains with DNSimple, contact support, and we will be happy to help. You can also read more about TLDs available at DNSimple.