Search... ⌘ K
Get Started Contact Sales

.INSURANCE Domains

Last updated

.INSURANCE domains are only for regulated insurance organizations, and the registry, fTLD, verifies every registrant before the domain is registered. At DNSimple, .INSURANCE registration is available only on Enterprise plans, and the account must enforce multi-factor authentication.

.INSURANCE is a highly-regulated TLD, so the requirements for highly-regulated TLDs in the Domain Registration Agreement also apply.

Who can register a .INSURANCE domain?

Your organization must meet fTLD’s eligibility requirements, and the domain names you choose must correspond to your organization’s legal name or branding. Eligible organizations are government-regulated insurance entities, such as insurance companies, agents and agencies, brokers and brokerages, and insurance regulators. Review the Organization Eligibility and Domain Name Eligibility guidelines before you apply.

Holding and parent companies of insurance companies, agents, and brokers are also eligible if a government regulator supervises them. The full rules are in fTLD’s .INSURANCE Registrant Eligibility Policy (PDF).

How do I register a .INSURANCE domain?

fTLD verifies your organization before the domain can be registered.

Register a .INSURANCE domain
  1. Apply to fTLD at register.insurance/get-started and complete their verification.
  2. When fTLD approves your application, you receive an fTLD registration token.
  3. Contact support with the domain name and the registration token. We will complete the registration for you.

What does DNSimple require for .INSURANCE domains?

  • Multi-factor authentication: the account must enforce multi-factor authentication for all its users. .INSURANCE management is also turned on per account: if the account shows “Managing MFA regulated domains isn’t enabled on your account”, contact support.
  • API access: API requests for the account are blocked by default, so that integrations cannot bypass multi-factor authentication. To enable API access, contact support.
  • DomainPinLock: the registry locks every .INSURANCE domain with DomainPinLock, and it cannot be turned off. Any change to the domain needs a token that is emailed to the registrant.

What security requirements does fTLD set?

fTLD monitors every .INSURANCE domain against its security requirements:

  • Name servers: the authoritative name servers must have host names within the .INSURANCE domain.
  • DNSSEC: the domain must be signed with DNSSEC using strong cryptographic algorithms.
  • HTTPS: websites must use HTTPS with a valid certificate.
  • TLS: servers must use TLS 1.2 or higher.
  • Email authentication: the domain must publish DMARC and SPF records. DKIM is recommended alongside them.
  • Vendors: web and email hosting providers must meet the same requirements.

How does DNSimple help you meet the requirements?

  • Vanity name servers: you can use your own .INSURANCE domain for your name server host names, such as ns1.example.insurance through ns4.example.insurance, answered by DNSimple. Learn how to set up vanity name servers.
  • DNSSEC: DNSimple signs your zone with RSA/SHA-256 (algorithm 8) and rotates the keys automatically. For domains registered with DNSimple, the DS record at the registry is updated for you. Learn more in DNSSEC at DNSimple.
  • SSL certificates: Let’s Encrypt certificates are available at no additional charge and DNSimple renews them automatically. They are valid for 90 days, so install the renewed certificate on your web servers each time.
  • URL redirects: the DNSimple URL redirector accepts HTTPS connections only over TLS 1.2 or higher.
  • Email authentication: you can add DMARC, SPF, and DKIM records to your zone. Learn more in DNS records.

TLS settings on your own web servers are up to you to configure.

How often does fTLD re-verify .INSURANCE domains?

fTLD re-verifies .INSURANCE registrants at least every two years, or at renewal, whichever comes first. Any change to the registrant’s organization name also starts a full re-verification.

To keep re-verification smooth, keep the registrant contact and organization details in your DNSimple account accurate, including the telephone number and physical address.

Have more questions?

If you have any questions or need assistance with registering domains with DNSimple, contact support, and we will be happy to help. You can also read more about TLDs available at DNSimple.