WHOISDomain Risk Check
A technical risk-indicator tool. It identifies specific, named technical signals — it does not accuse a domain of anything.
What is a domain risk check?
A domain risk check looks for specific technical signals that are worth knowing before you trust a domain, such as a very recent registration, an invalid SSL certificate or missing email protection. Each signal is named, explained and given a level, so you can judge it for yourself.
It is important to be clear about what this tool does not do. It never says a domain is malicious, compromised or safe. A domain with several indicators can be completely legitimate, for example a business that launched last week, and a domain with none is not certified safe. Treat the result as one input among several.
How the domain risk check works
The tool runs a fixed set of technical lookups and reports only what it actually observed. When a check cannot be completed, the result says so as Unknown instead of treating it as a finding.
Factors checked
- Domain age: very new registrations appear more often in abuse data, though this says nothing about any particular domain.
- Expiry: an expired or nearly expired domain could lapse and pass to an unrelated owner.
- DNS: whether the domain resolves at all.
- DNSSEC: a weak, low-level signal only, since many legitimate domains do not use it.
- SSL: an invalid, expired or mismatched certificate.
- Reputation data: whether the domain's IP appears on a small set of DNS-based block lists.
- Email configuration: missing SPF or DMARC, which makes the domain easier for others to spoof.
- Website configuration: whether the site responds to a standard request.
How to use the domain risk check
- Enter the domain you want to look into, for example the domain in a link or an email address.
- Run the check and wait a few seconds for every factor to be tested.
- Read each indicator, its level and its explanation.
- Combine the result with common sense: does the domain match the organisation it claims to be?
How to read the domain risk results
Indicators are listed one per row with their factor, level and message. A higher level means a stronger signal, not proof of wrongdoing. Unknown rows mean the check could not be completed this time and are not findings. If every check that could run found nothing, the result says so plainly.
Other ways to judge a domain
Technical signals are only part of the picture. Check that the domain is spelled exactly like the organisation's real website, because lookalike domains often swap or add a single letter. Contact the organisation through a phone number or address you already trust, not one given in the message. And never enter a password or payment details on a page you reached through an unexpected link.
Common uses
- Checking the domain behind a suspicious email or link before clicking.
- Reviewing a new supplier or shop before paying.
- Seeing how your own domain looks from the outside, for example whether SPF and DMARC are missing.
- Giving staff a simple, neutral way to look at a domain before reporting it.
Common problems and fixes
My own domain shows indicators. Most are easy to fix: renew an expiring domain, replace an invalid certificate, and publish SPF and DMARC records.
A reputation listing appears. Check the IP address in our IP Blacklist Checker to see which list is involved and follow that list's removal process.
Several checks are Unknown. A lookup may have timed out. Run the check again a little later.
Related tools
- Domain Age Checker shows the exact registration age.
- IP Blacklist Checker explains block-list results.
- Email Health Checker gives a scored review of SPF, DMARC and mail servers.
- Domain Health Check gives a weighted technical score instead.
Frequently asked questions
Does the domain risk check tell me if a site is a scam?
No. It reports specific technical signals, such as a very new registration, an invalid SSL certificate or missing email protection, and explains each one. It never labels a domain as a scam or as safe. Use the signals together with other checks, such as whether the domain matches the company it claims to be.
Why is a new domain listed as a risk indicator?
Recently registered domains appear more often in phishing and fraud data, so domain age is a useful signal. It is only a signal: every legitimate website was new once. A new domain claiming a long trading history is the kind of mismatch worth investigating further.
What does it mean if a domain is on a block list?
The domain's IP address appears on at least one DNS-based block list that tracks spam or abuse. Shared hosting means an innocent site can share an IP with a bad one, so a listing is not proof about this specific domain. Our IP Blacklist Checker shows which lists are involved.
Why does missing SPF or DMARC count as a risk?
Without SPF and DMARC, it is easier for someone else to send email that pretends to come from this domain. That is mainly a risk to people receiving such fake emails, and a sign the domain owner could improve their email security. It does not mean the owner is sending anything harmful.
Is a domain with no indicators safe?
Not necessarily. No indicators means none of the checked technical signals were found. A domain can pass every technical check and still be used for something harmful, so keep using judgement, especially when a page or email asks for payment, passwords or personal details, or creates a sense of urgency.
What does Unknown mean in the risk check?
It means that check could not be completed, for example because a lookup timed out or a registry does not publish the information. Unknown is not a finding in either direction and does not make a domain look better or worse. Running the check again a little later often completes it.
How can I remove risk indicators from my own domain?
Renew the domain well before it expires, make sure DNS resolves, install a valid SSL certificate, and publish SPF and DMARC records. If your IP appears on a block list, find the cause, fix it and follow that list's removal process. The age indicator disappears on its own over time.