Domain Risk Score

Calculate a comprehensive risk score for any domain based on its age, DNS configuration, and security headers.

Evidence ASSESSED

Checked against: Composite of Safe Browsing, DNSBL, WHOIS age and DNS signals

RED TEAM 0 findings BLUE TEAM control did not hold

Risk Scoring Methodology

Our risk score is calculated by analyzing several technical and historical parameters:

Domain Age: Younger domains (less than 3 months old) are statistically more likely to be used for spam or malicious purposes.
DNS Health: Domains with missing basic records or misconfigured nameservers receive a higher risk weighting.
Safety Status: Integration with threat databases to check for current active flags.
Security Implementations: Absence of HTTPS, DNSSEC, or common security headers increases the overall risk profile.

Our Domain Risk Score combines multiple independent signals — registration age, blacklist listings, threat intelligence, email authentication posture and infrastructure characteristics — into a single assessment of how much a domain should be trusted.

What is a Domain Risk Score?

A domain risk score aggregates several weak indicators into a composite judgement. No individual signal is conclusive, but together they form a reasonably reliable picture.

The inputs fall into a few groups. Registration data contributes age and registrar reputation. Threat intelligence contributes blacklist and malware listings. Configuration contributes email authentication posture and certificate quality. Infrastructure contributes hosting characteristics and whether the domain shares addresses with known-bad neighbours.

The result is a triage aid rather than a verdict. It is useful for deciding what deserves closer examination, not for making automated block decisions — a legitimate new business scores poorly for entirely innocent reasons, and a compromised established domain scores well until the compromise is detected.

Combines registration, intelligence, configuration and infrastructure signals
No single input is conclusive on its own
Designed for triage rather than automated blocking
New legitimate domains score poorly for innocent reasons
Compromised established domains score well until detection catches up

Why Domain Risk Assessment Matters

Most decisions about unfamiliar domains are made with almost no information — whether to click a link, whether to accept mail, whether to onboard a vendor. A composite score puts several relevant facts in front of the person making that decision in one step.

It is particularly useful where volume makes individual investigation impractical. Assessing every domain appearing in mail logs or every counterparty in an onboarding queue is not feasible manually, but scoring them and investigating the outliers is.

Puts several relevant signals in front of a decision in one step
Makes triage practical where volume prevents individual investigation
Surfaces domains worth closer examination
Useful in vendor onboarding and counterparty checks
Helps prioritise which mail sources to investigate

How This Domain Risk Score Works

The tool gathers signals from several independent sources and combines them.

Validates the domain input against format and SSRF safety checks
Retrieves registration data including age and registrar
Checks threat intelligence and blacklist sources
Assesses email authentication and certificate configuration
Combines the signals into a weighted overall score with the contributing factors listed

How to Use the Domain Risk Score

Enter the domain you want to assess
Run the assessment to gather the signals
Read the individual factors rather than only the headline score
Investigate further where specific signals stand out
Treat the result as triage input, not as an automated decision

Understanding Your Domain Risk Results

The score is built from several contributing factors:

Field / Value	Meaning
`Domain age`	Time since registration. Very new domains carry elevated risk because attacker infrastructure is disposable, though legitimate new businesses are affected equally.
`Blacklist listings`	Whether the domain appears on spam or malware blocklists. A strong negative signal, particularly when several independent lists agree.
`Threat intelligence`	Detections in phishing or malware feeds. Among the strongest signals available, though intelligence lags new campaigns.
`Email authentication`	Whether SPF, DKIM and DMARC are configured. Absence suggests either a domain not used for mail, or one where basic hygiene has been neglected.
`Certificate quality`	Whether HTTPS is properly configured. Note that a valid certificate is not a positive trust signal, since attackers obtain them freely.
`Hosting profile`	Whether the domain sits on hosting associated with abuse, or shares addresses with known-bad neighbours.
`Overall score`	The weighted combination. Useful for ranking and triage, but the individual factors are more informative than the number itself.

Common Problems & How to Fix Them

Age is weighted heavily because attacker infrastructure is disposable, so any newly registered domain scores badly regardless of intent.

Read the other factors. A new domain with no blacklist listings, correct email authentication and ordinary hosting is very different from a new domain with detections. Score improves naturally with age and established configuration.

Age and history are weighted positively, so a long-established domain continues to score well until a compromise is detected and reflected in intelligence feeds.

This is the main structural limitation of reputation scoring. Combine it with content-level checks such as malware and phishing scanning, which assess what the site is serving now rather than what its history suggests.

Identify which factors are contributing. The most commonly missing ones are email authentication and a clean blacklist record.

Publish SPF, DKIM and DMARC correctly, resolve any blacklist listings at the source, and ensure HTTPS is properly configured. These are worth fixing regardless of how they affect a score.

Different providers weight signals differently and draw on different intelligence, so disagreement is expected rather than anomalous.

Look at where they diverge and why. Consistent agreement across independent sources is a much stronger signal than any single score, and the specific factor causing disagreement is usually the interesting part.

Best Practices

Read the contributing factors rather than only the headline score
Combine reputation scoring with content-level malware and phishing checks
Use scores for triage and prioritisation, not automated blocking
Allow for legitimate new domains scoring poorly on age alone
Check several independent sources where the decision matters
Maintain your own domain hygiene so it scores accurately
Re-assess periodically, since reputation changes over time

Security Recommendations

Never block automatically on a composite score alone, since legitimate new businesses are indistinguishable from new attacker infrastructure by that measure
Remember a good score does not rule out an active compromise that has not yet been detected
Weight recent threat intelligence detections more heavily than historical reputation
Use scoring to prioritise investigation rather than to replace it
Monitor your own domain score so a compromise affecting your reputation is noticed early
Treat sudden score deterioration on your own domain as a possible compromise indicator

Frequently Asked Questions

A composite assessment combining registration age, blacklist listings, threat intelligence, email authentication and hosting characteristics into a single figure indicating how much a domain should be trusted.

Age is weighted heavily because attacker infrastructure is typically registered days before use. A new legitimate domain is indistinguishable from new attacker infrastructure on that measure alone. The score improves as the domain ages and establishes a record.

No. Established domains score well until a compromise is detected, and detection lags. Combine reputation scoring with content-level checks that assess what a site is serving right now.

Configure SPF, DKIM and DMARC correctly, resolve any blacklist listings at their source, ensure HTTPS is properly set up, and allow the domain to age. Each of these is worth doing on its own merits.

Providers weight signals differently and draw on different intelligence sources. Disagreement is normal. Consistent agreement across independent sources is a far stronger signal than any single score.

Not automatically. Use the score to prioritise investigation and to trigger additional verification. Blocking on score alone will exclude legitimate new businesses while missing compromised established domains.

Reputation changes as domains age, get compromised, or get cleaned up. For counterparties and vendors, re-checking periodically is sensible. For your own domain, continuous monitoring catches a compromise-driven decline early.