Domain name security: what DNS, email and web headers reveal
Beyond content, the technical setup of a domain says a lot about its owner: signed DNS, email protected against spoofing and correct web headers are the mark of a seriously managed site. Conversely, a domain on malware or phishing lists should be ruled out, whatever its history.
Test a domain now:
DNS: DNSSEC and consistent name servers
DNSSEC cryptographically signs DNS answers and prevents them from being forged. Few sites enable it, so its presence is a bonus. Name servers also reveal the host, the country and the possible use of a CDN; a WHOIS lookup shows them.
Email: SPF, DKIM, DMARC, MTA-STS and BIMI
SPF lists the servers allowed to send email for the domain, DKIM signs messages, DMARC says what to do with messages that fail (and where to send reports). MTA-STS enforces encryption between mail servers and BIMI shows the brand logo in inboxes: two markers of mature organisations. A domain without SPF or DMARC is easily spoofed for phishing: check your SPF, DKIM and DMARC records.
Web: HTTPS, HSTS and security headers
A valid TLS certificate is the minimum. The HSTS preload list (Chrome, Firefox) guarantees that the browser will never use plain HTTP. Security headers (Content-Security-Policy, X-Frame-Options, Referrer-Policy…) are graded from A+ to F. DomaineScore uses this grade: A or B give a bonus, missing headers stay neutral.
Reputation: malware, phishing and threat intelligence
Domain and IP blocklists, malware and phishing lists, browser warnings and antivirus consensus: a confirmed listing caps the score at 45 and the costly link profile analysis is not even run, since the domain is already disqualified. For an expired domain, these lists remember the former owner's abuse: check them before you buy. See blacklisted domain name.
Frequently asked questions
Is a domain without DMARC dangerous?
Not for visitors, but it is easy to spoof: anyone can send emails pretending to be it. For a domain you run, publish at least SPF and DMARC.
What is the security headers grade?
A grade from A+ to F that assesses a site's HTTP security headers (CSP, HSTS, X-Frame-Options, cookies…). It measures the technical rigour of the operator, not how dangerous the content is.
How do I check if a domain hosts malware?
Analyse it on DomaineScore: several malware lists, browser warnings and an antivirus consensus are queried, and any malicious verdict is shown at the top of the report.