Indian BFSI DMARC Mandates: Compliance and Adoption 2026

Ecosystem NewsSecurity Insights

The importance of Domain-based Message Authentication, Reporting, and Conformance (DMARC) in the global cybersecurity landscape is no small topic; it becomes more apparent each month with new breaches and attacks helmed by AI, phishing, SPF abuse campaigns, and other avenues. Email remains the number one attack vector in the world, and new guidelines and mandates out of India are looking to improve the region. As of 2023, India is the most populous country in the world, surpassing China with nearly one and a half billion people.

Understanding India’s Evolving Mandates and Recommendations

Some of India’s most notable industries are financial technology (known colloquially as fintech) and banking, together creating a firm reputation of importance in the world economy. In early 2025, new recommendations came to the Payment Card Industry regarding DMARC, and the ecosystem is taking its next steps forward in 2026 with requirements for other financial institutions. 

The Reserve Bank of India’s 2026 DMARC Mandate

On July 31, 2026, the Reserve Bank of India published a directions document titled “Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026.” Credit Information Companies, or CICs as the Reserve calls them, include organizations such as credit bureaus, reporting institutions, and other financial bodies. The RBI (Reserve Bank of India) speaks on DMARC in their directions, stating the following:

• “The CIC shall implement Domain-based Message Authentication, Reporting, and Conformance (DMARC) solution for the email domains. The CIC shall impress upon its vendors, partners, and other relevant third parties, to implement similar solution securing their mail systems to mitigate email spoofing.”

Action beyond mandating applicable companies is a strong nod in favor of DMARC. Security matters at every point in the ecosystem, especially when it comes to personal data such as finances. Encouraging those connected to CICs to also implement DMARC helps keep everyone safe in India and worldwide. You can read the mandate in full on the Reserve Bank of India’s webpage.

Insurance Regulatory and Development Authority of India’s Guidelines

In April 2026, version two of the “Information and Cyber Security Guidelines” was published by the Insurance Regulatory and Development Authority of India (IRDAI), covering risk management, digital trust, and other key cybersecurity topics. Regulated Entities use this information to create their Information & Cyber Security Policies under the guidance of the IRDAI. Under policy 2.21 Email Security, IRDAI requires the following:

• “Organization shall lower the chance of spoofed or modified emails from valid domains, implement Domain-based Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by implementing the Sender Policy Framework (SPF) and the Domain Keys Identified Mail (DKIM) standards.”

With these two mandates in mind, we have decided to dig into India’s top banks and fintech organizations to see how well they are using DMARC to protect their domains. We’ve selected the top 100 from each list by estimated annual revenue.

DMARC Status of the Top 100 Banks in India

Our survey captured India’s top 100 banks (by estimated revenue) to see how they’ve managed with the presence of the RBI mandate in the last few months.

An excellent 84% of surveyed domains have DMARC records of some kind established, starting them on their way to better email security. Unfortunately, nearly a quarter of the surveyed domains have suboptimal records or those with mistakes. Out of the remaining 60% of domains, 55 of them are at a policy of p=quarantine or better, closing potential attack vectors for safer delivery to inboxes.

Independently, among issues identified by our survey, the lack of RUA tags stands out as the most common problem, comprising 30% of logged errors. Aggregate reporting can be difficult to parse, and we break down the differences between RUA and RUF tags in our companion article.

The RBI’s directive will take time to implement across India; however, it is imperative that these banking institutions begin their journey to p=reject as soon as possible as a preventative measure against email fraud. In April 2024, The Times of India reported that India is the third most targeted country in the world for phishing attacks, with banks being clear targets for financial scams.

DMARC Status of India’s Top 100 FinTech Companies 

Broadening our scope to cover all of fintech in India, we once again surveyed the top 100 companies by estimated revenue. Fintech, short for financial technology, covers a wide array of businesses and organizations, including but not limited to insurance, software, digital services, and payment services.

Compared to our top 100 bank survey, the results are night and day. While a quarter of domains continue to show issues with their DMARC records, a staggering 41% do not have records at all. This most likely means they have yet to begin their journey to p=reject. 

Looking closer at domains that do have records, only 9% have an enforcement policy of p=reject, ensuring that malicious emails never reach the inbox. 15% of domains at p=quarantine help lighten the blow of online attacks, cordoning off malicious content, but not guaranteeing protection.

While lack of RUA tags continues to be a trend in the errors shown within the domains we surveyed, a new error is commonplace within the fintech survey: lack of an SPF record. DMARC works off of the backs of DKIM and SPF, and with one piece of the puzzle missing, DMARC falls short of achieving its goal.

The Importance of Partners in India

With the highest population on Earth, it should come as no surprise that India is a major hub for business worldwide. As a cybersecurity business focusing on bringing DMARC to everywhere and everyone possible, dmarcian supports and believes in the power of partnerships to elevate business relationships and help broaden the scope of security coverage.

Our mission is DMARC everywhere, which means making DMARC accessible to organizations in every market. We recognize how many domains there are in India and how important they are to that mission. Every market has its own challenges, and we are always learning and improving how we serve each one. For organizations in India, that means a clear path to DMARC and a partner that understands the challenges they face.

—Tass Kalfoglou, Director of dmarcian APAC Business Unit

With ever-expanding mandates across India and the world coupled with the rise of AI as a player in threat actor schemes, it has never been more important to protect your email and your domains.

---

Want to continue the conversation? Head over to the dmarcian Forum.