What Is Domain Reputation?
Domain reputation, in this API, is a 0–100 composite score built entirely from signals already available at check time — whether the domain is a known free provider, whether it's disposable, whether DNS/MX/SPF/DMARC are healthy, and how old the domain is. It starts at a neutral 50 and moves up or down based on those factors. There's no external reputation feed or black-box blocklist involved — every point is traceable to a specific, already-explained fact about the domain.
Why this is computed, not looked up
Many "domain reputation" products are backed by an external feed or blocklist you can't inspect — a domain is "bad" because a third-party service says so, with no visibility into why. This API takes a different approach: reputation is a deterministic composite of signals it already computes for other reasons (free-provider status, disposable status, DNS health, domain age), so there's no external dependency and no unexplainable score.
The actual formula
Every domain starts at a neutral baseline of 50 — meaning "the domain resolves, nothing else is known yet." From there:
| Factor | Adjustment |
|---|---|
| Known major free provider (Gmail, Outlook, etc.) | +25 |
| Has an MX record | +10 |
| Has an SPF record | +8 |
| Has a DMARC record | +7 |
| Known disposable domain | −45 |
| Domain age: very new | −30 |
| Domain age: new | −15 |
| Domain age: recent | +3 |
| Domain age: established | +10 |
| Domain age: unknown (lookup failed/unsupported registry) | 0 — never penalized |
The result is clamped to 0–100. A domain that doesn't resolve at all short-circuits straight to a score of 0 (untrusted) — there's nothing else worth computing if the domain itself doesn't exist.
Score bands
| Score | Classification |
|---|---|
| 80–100 | trusted |
| 50–79 | neutral |
| 25–49 | suspicious |
| 0–24 | untrusted |
Only suspicious and untrusted classifications actually contribute a risk signal (low_domain_reputation) to the overall risk score — trusted and neutral domains pass through without penalty, since neutral is the expected baseline for most legitimate domains, not a red flag.
Two worked examples
A personal domain registered eight months ago, with MX and SPF but no DMARC: 50 (baseline) + 10 (MX) + 8 (SPF) + 0 (no DMARC bonus) + 3 (recent age) = 71 → neutral. No risk signal triggered.
A domain registered four days ago, with only an MX record and nothing else: 50 + 10 (MX) − 30 (very new) = 30 → suspicious. This one does trigger low_domain_reputation, contributing to the overall risk score — not because anything is confirmed malicious, but because the combination of "barely any DNS hygiene" and "registered days ago" is statistically associated with disposable-use domains.
Reputation has its own confidence value too
A reputation score computed with live DNS evidence carries confidence 0.75; one computed without any DNS evidence available (a fast-mode check with nothing cached) carries only 0.35. A domain that doesn't resolve at all gets confidence 0.9 if DNS evidence was actually available (a confident "this really doesn't exist") or 0.4 if it wasn't (an unconfirmed absence, not a confirmed one).
FAQ
It's a contributing signal, not a verdict — a very new domain applies a −30 adjustment, which alone won't push a domain below the suspicious threshold if other factors (MX, SPF, DMARC all present) are healthy.
Yes — every factor that contributed is a documented, fixed part of the formula. There's no hidden weighting or external blocklist involved.
No — reputation is one of six categories that feed into the overall risk score, alongside email quality, domain health, disposable status, provider status, and deliverability.
Known major free providers (Gmail, Outlook, and similar) get a +25 adjustment, reflecting that they're established, actively-maintained mail infrastructure — separate from the free_provider risk signal, which is a small, independent contribution to the overall risk score.