How to assess a domain before you acquire it

Buying an established domain can bring useful brand recognition, backlinks and existing email traffic. It can also transfer a hidden liability: a history of phishing, spam, malware, impersonation or poor sender behaviour. A clean-looking website does not prove that the domain has always been trustworthy.

Trusted Sender Score gives individuals, business owners and security teams a practical way to check whether a domain you are about to acquire has a history of abuse. The results can help you investigate reputation signals before paying for the domain, migrating email or connecting it to customer systems.

Start with a reputation check

Open the domain trust checker and enter the domain you are considering. Review the available reputation information, authentication status and warnings associated with the domain. Pay attention to signs of suspicious activity, spoofing exposure, failed email controls and patterns that could affect delivery or trust.

A domain with an unfamiliar history deserves extra care, even if the seller says it was used only for a legitimate project. This matters in Australia, where a small business in Brisbane, Perth or regional New South Wales may inherit a domain previously used for bulk marketing or scam campaigns without realising it.

Examine email authentication signals

Check whether the domain has valid DKIM and DMARC records, and whether its current configuration appears consistent with responsible email operations. Missing records do not automatically prove abuse, because an inactive domain may simply have been parked. However, weak or contradictory records can indicate that the domain was poorly managed or exposed to impersonation.

Use the platform’s anti-spoofing information to understand how criminals might send messages pretending to represent the domain. The anti-spoofing guidance is particularly useful when the domain will be used for invoices, account notices or staff email, where a forged message could cause financial loss.

Compare the result with the seller’s claims

Ask the seller how the domain was used, when it was last active and whether any email lists, websites or third-party services are included in the transfer. Compare those answers with the trust check. A domain described as “unused” but showing signs of extensive mail activity should be treated as a warning requiring further evidence.

For an Australian .au domain, also confirm the registrant details and transfer process through the appropriate registrar and auDA requirements. If the purchase involves a company name, trading name or customer database, check that the seller has the right to transfer each asset. A domain reputation check supports due diligence; it does not replace ownership, trademark or contractual checks.

Investigate before connecting the domain

Do not point the domain at your main website or activate mailboxes immediately after purchase. First, record the platform’s findings, inspect historical DNS information where available and search for references to the domain in scam reports, breach discussions and blocklists. Look for patterns involving fake parcel notices, investment offers or account-reset messages, which are familiar concerns for Australian organisations dealing with Scamwatch-style impersonation.

If you manage many prospective acquisitions, use bulk checking or developer tools to compare domains consistently. An agency buying several expired domains for clients, or a security team reviewing a portfolio across Sydney and Melbourne offices, can use repeatable checks instead of relying on a quick manual search. Keep dated evidence because reputation data and DNS records can change after the assessment.

Decide how much risk is acceptable

A warning does not always mean the domain must be rejected. An old campaign domain with limited negative activity may be recoverable after a careful rebrand, strict email authentication and a period of monitoring. A domain strongly associated with phishing, malware or fraudulent communications may carry lasting reputational damage and should usually be avoided, even if the name is attractive.

Before completing the purchase, document the score, detected issues, seller statements and planned safeguards. Review the platform’s legal notices so your team understands how its information should be interpreted and used. This creates a defensible record for management, clients or auditors and helps ensure that a bargain domain does not become an expensive trust problem.