Domains 12 min read ·
.in Domain eKYC: How to Verify (and Unsuspend) Your .in Domain
NIXI now requires eKYC for every .in domain. Who must verify, the DigiLocker steps, fixing OTP and name errors, and how to recover a .in domain on serverHold.
.in domain eKYC is the identity check that NIXI, the .in registry, requires from every registrant of a .in, .co.in or other .in-family domain, including people and companies outside India. Most Indian individuals complete it online through DigiLocker, using an OTP sent to their Aadhaar-linked mobile. If you never finish it, the registry can put the domain on serverHold, and your website and email stop working until the check is done.
What NIXI's eKYC rule is and why it exists
The National Internet Exchange of India (NIXI) runs the .in registry under the Ministry of Electronics and Information Technology. Its website says KYC is mandatory, "as per guidelines by CERT-IN under Section 70B, IT Act 2000". The aim is a real, reachable owner behind every domain, which makes anonymous .in sites for phishing or fraud harder.
eKYC is not brand new. In February 2022, NIXI wrote to registrars to introduce Aadhaar-based eKYC for new registrants. People without Aadhaar could use a PAN card, passport, voter ID or driving licence instead. The Registrar Accreditation Agreement (RAA) now published on registry.in goes further:
| Rule | What it means for you | Where it comes from |
|---|---|---|
| Mandatory eKYC | Every registrant, including foreign nationals, must prove their identity | RAA clause 4.4.12 |
| 7-day acknowledgement | Your registrar must receive your eKYC acknowledgement within 7 days of registration | RAA clause 4.4.12(b) |
| Dual authentication | Both your email address and your contact number are verified | RAA clause 4.4.13 |
| No VPNs | Registrars must stop registrations made through a VPN | RAA clause 4.4.14 |
| No disposable email | A temporary email address can get the domain rejected or suspended. NIXI's list also names encrypted services such as ProtonMail and Tutanota | RAA clause 4.4.9 and Appendix B |
| No privacy or proxy | The real owner's details must be on record | RAA clause 4.4.3 and Advisory LA 02 |
| Non-resident declaration | Registrants outside India sign a declaration of their business connection or purpose in India | RAA clause 4.4.15 and NIXI's July 2025 advisory |
These rules cover every name sold through the .in registry: .in, .co.in, .net.in, .org.in, .firm.in, .gen.in, .ind.in and newer endings such as .ai.in, .biz.in and .info.in. The agreement applies the same privacy rule to .bharat names.
Who has to verify, and when
- New registrations. Always. Under NIXI's agreement, the 7-day clock starts at registration, so verify the same day you buy the domain.
- Renewals, contact changes and transfers. Sources disagree. NIXI's 2022 letter only advised re-verifying at renewal, and one wholesale registrar says verification applies only to new registrations, while others told resellers in late 2025 that renewals and contact changes trigger it too. Expect a request whenever you renew, change the registrant details or move the domain.
- Existing domains. Some registrars are asking owners of older .in domains to verify. Deal with a genuine request promptly.
Registrar notices give different deadlines, so go by your own registrar's message. NIXI's only published deadline is the 7-day window in its agreement.
What you need before you start
- Indian individuals: an Aadhaar card whose linked mobile number still receives SMS, for the DigiLocker route. NIXI's agreement also lists a passport, voter ID, driving licence, PAN card or any other Government of India photo ID.
- Companies, firms and organisations: registrar documentation such as eNom's NIXI compliance guide asks for a certificate of incorporation or registration, a government ID for an authorised signatory, and a letterhead or similar document stating what the domain is for.
- Foreign nationals: a passport, driving licence or other government photo ID from your country, plus the signed business-connection declaration. NIXI's list also includes a letter from an Indian embassy or mission, or your last two years of income tax returns.
- A permanent email address and a mobile number on the domain's contact record. Both will be verified.
- The registrant name exactly as it appears on your ID. Check initials, middle names and spellings now, not halfway through.
Step by step: completing .in domain eKYC
Screens differ between registrars, but the help pages we checked in October 2026 describe the same pattern:
- Check the domain's contact details. In your registrar account, make sure the registrant name, email and mobile number are correct.
- Find the verification request. It may arrive by email or SMS, or as a notice in your account. If unsure, ignore any link and log in by typing your registrar's address yourself.
- Confirm your email and phone. Expect a code or link for each, because NIXI requires both to be verified.
- Complete the DigiLocker step. You sign in to DigiLocker with your Aadhaar or mobile number, receive an OTP on your Aadhaar-linked mobile, and agree to share your verified name and address with the requester. First check that the web address ends in
.gov.in: DigiLocker's sign-in and consent pages for other websites run ondigilocker.meripehchaan.gov.in. Then finish every screen, because stopping on the consent page leaves the check incomplete. - Ask about a document route if you have no Aadhaar. Some registrars, such as eNom, accept documents from businesses, foreign registrants and people without Aadhaar; others, including GoDaddy, use only Aadhaar through DigiLocker. Ask yours which route applies. If a message asks you to email documents, confirm it first using contact details from the registrar's own website.
- Check the result. Look for a confirmation in your account, and later confirm with a WHOIS lookup that the domain isn't on hold.
If you are registering a new name, these are HostEthical's current prices for .in and .co.in. Both include a free DNS editor.
OTP not received, name mismatch and other common problems
There are often two different OTPs: one goes to the contact number on the domain, and DigiLocker's goes to the number linked to your Aadhaar. These may be different phones.
| Problem | Likely cause | What to do |
|---|---|---|
| OTP for the domain's phone never arrives | Wrong number, or a landline, in the domain contact | Correct the mobile number in your registrar account, save, then restart the verification |
| DigiLocker OTP never arrives | Your Aadhaar-linked number has changed or is inactive | Update the mobile number in Aadhaar first (see below) |
| Name doesn't match | Initials, a missing middle name, a spelling difference, or a company domain checked against a director's Aadhaar | Ask your registrar to correct the registrant name, or ask how company domains are verified. Never verify with someone else's Aadhaar. |
| Registration or verification fails without explanation | A VPN or proxy is switched on | Switch off the VPN and try again on your normal connection |
| Email address rejected | A disposable email service, or one on NIXI's list (which includes ProtonMail and Tutanota) | Use a permanent mailbox you will keep for years |
| Link has expired or is lost | An old message, or one forwarded by someone else | Request a fresh link from inside your registrar account |
Updating the mobile number on your Aadhaar
UIDAI's Aadhaar app FAQ (October 2026) says you can change your mobile number in the app if you can receive OTPs on both the old and the new number. You also need face authentication and must pay the prescribed charge. Without the old number, you must visit an Aadhaar Seva Kendra or another authorised centre. Updates can take up to 30 days, so tell your registrar and ask whether another ID document will do meanwhile.
What serverHold means and how to get a suspended .in domain back
serverHold is a status set by the registry. ICANN's guide to domain status codes explains that a domain on serverHold "is not activated in the DNS". Your website stops loading and email to your domain stops arriving, even though your DNS records haven't changed. Its cousin clientHold is set by the registrar, usually for non-payment, disputes or a pending deletion.
How to check
Run a WHOIS lookup on your domain and read the "Domain Status" lines; our WHOIS lookup guide shows how. If you see serverHold and your registrar has asked you to verify, verification is almost certainly the cause.
How to get it back
- Complete the verification, or send the requested documents through the channel your registrar confirms.
- Wait for approval. eNom says the hold is removed once NIXI approves your documents. NIXI publishes no fixed timeframe, so be wary of anyone promising one.
- Allow for DNS caches. Some visitors may see the site a little later while cached answers expire.
A domain on hold normally stays registered in your name: eNom says NIXI does not delete domains that fail verification, and that they stay on serverHold until they expire. NIXI's own terms still allow it to cancel a registration made with false details, so verify rather than wait it out. The hold doesn't stop the expiry clock, so keep renewing on time. Changing registrar won't get you round eKYC either, because every .in registrar is bound by the same NIXI agreement; see how to transfer a domain if you want to move for other reasons.
NRIs and foreign owners: what's different
.in has never been limited to Indians. In its advisory of 29 July 2025, NIXI said there have never been directions restricting registrations "only to Indian nationals", and that foreign nationals and entities can register. Non-resident registrants are asked to share their business connection or purpose in India, which NIXI calls a global practice and a procedural requirement, not a bar to registering.
Under the registrar agreement, you sign this as a declaration and the registrar keeps a copy. Without one, the registrar must put the domain on hold, and NIXI can accept or reject any foreign registration.
- Foreign individuals and companies can't normally use DigiLocker, because it needs an Aadhaar. Expect the document route: a passport or other government photo ID, company registration papers for a business, and the signed declaration.
- NRIs can verify with Indian documents such as an Indian passport, PAN or Aadhaar. But NIXI's rules cover anyone residing outside India, so if you live abroad, expect to sign the business-connection declaration as well.
- Registrar policies vary. At least one large registrar group told its resellers in November 2025 that it would block .in orders with a registrant contact outside India. If your contact address is outside India and you want a .in at HostEthical, contact us before you order so we can confirm the registration will go through.
If you have no real link to India, a generic extension will serve you better; our .com vs .in comparison covers the trade-offs.
Why .in has no WHOIS privacy, and how to protect your contact details
For most .com names you can switch on WHOIS privacy, which replaces your details with a proxy service's. NIXI's agreement bans privacy and proxy services for .in and .bharat names, and its Advisory LA 02 warns that inaccurate or proxy registrations can be suspended or deleted. The registrant terms go further: if your data is masked by a proxy service, you are not recognised as the domain's owner.
That doesn't mean all your details are public. In lookups we ran on the .in registry's WHOIS server on 15 October 2026, the registrant's name, street address, city, postcode and phone showed as "REDACTED FOR PRIVACY" and the email was withheld (the record points you to the registrar instead), but the organisation, state and country were visible. So:
- Treat the Organisation field as public. Fill it in accurately for a business. If you register as an individual, put nothing there you wouldn't print on a visiting card.
- Use a permanent email address you control, such as a role mailbox on your own domain. You will need it for renewal notices and future verifications.
- Review your contact details regularly. The registry's FAQ suggests checking them twice a year.
Choosing between the two main Indian endings? Our .co.in vs .in guide covers the differences. The eKYC rules are the same for both.
eKYC scam emails: telling a real request from phishing
A real rule with a real penalty makes perfect bait. Fake "verify now or lose your domain" emails are a long-running scam: one documented in June 2026 claimed ICANN rules required email verification within three days, and linked to a fake login page that stole email passwords. Expect .in eKYC versions of the same trick.
Treat a message as suspicious if it:
- asks you to send a photo of your Aadhaar, PAN or passport by email, WhatsApp or reply;
- asks for an OTP over the phone, or for your email or registrar password;
- demands a "KYC fee", "reactivation charge" or any payment by UPI to an individual;
- comes from a registrar you don't use, or about a domain you don't own;
- leads to a login page that isn't on your registrar's real website, or a "DigiLocker" page whose web address doesn't end in
.gov.in; - threatens suspension within hours and pushes you to act before you can check.
Don't click. Log in to your registrar by typing its address yourself and see whether your account shows a verification request. If you entered a password on a suspicious page, change it at once and turn on two-factor authentication. If you lost money, report it straight away on the national helpline 1930 or at the National Cybercrime Reporting Portal.
If your .in domain is with HostEthical and you aren't sure whether a message is genuine, contact us before you act, and don't attach any identity documents to your message.
Frequently asked questions
Is eKYC mandatory for .in domains?
Yes. NIXI's registrar agreement requires every registrant of a .in-family domain, including foreign nationals, to complete electronic KYC, and registrars must receive the acknowledgement within 7 days of registration. Some registrars also ask you to verify again at renewal or after a contact change.
What happens if I don't complete .in domain eKYC?
The registry can put the domain on serverHold, which takes it out of the DNS, so your website and email stop working. eNom's documentation says such domains are normally not deleted but stay on hold until verification is approved or the domain expires. NIXI's own terms still allow it to cancel a registration made with false details, so verify rather than wait it out.
Can a foreigner or NRI register a .in domain in 2026?
Yes. NIXI's July 2025 advisory says .in is not restricted to Indian nationals, but under NIXI's registrar agreement anyone living outside India must sign a declaration of their business connection or purpose in India and complete eKYC with documents such as a passport. NRIs can verify with Indian documents but should expect to sign the declaration too if they live abroad, and because at least one registrar group blocks .in orders with a contact address outside India, check with your registrar before you order.
How long does .in domain verification take?
The online DigiLocker step is quick if the OTPs reach your Aadhaar-linked mobile. NIXI publishes no fixed timeframe for document checks or for lifting a serverHold, so verify as soon as you are asked rather than waiting for a deadline.