Calculator inputs
Example data table
| Domain | Age (days) | Mail controls | Hosting | Score | Risk |
|---|---|---|---|---|---|
| examplebank-support.com | 12 | SPF none, DKIM none, DMARC none | Poor reputation | 86 | Critical |
| brand-login.net | 45 | SPF fail, DKIM none, DMARC none | Average reputation | 62 | High |
| product-news.org | 260 | SPF pass, DKIM pass, DMARC quarantine | Good reputation | 28 | Moderate |
| company.com | 3650 | SPF pass, DKIM pass, DMARC reject | Good reputation | 9 | Low |
These examples are illustrative and should not replace investigation.
Formula used
The calculator assigns points to each signal and sums them to produce a baseline risk score:
FinalScore = min(100, max(0, RawPoints × AppetiteMultiplier))
- Age adds up to 12 points for very new domains.
- Identity controls (SPF, DKIM, DMARC) add up to 23 points.
- Infrastructure (hosting, TLS, DNSSEC) adds up to 24 points.
- Threat indicators (blacklists, redirects, impersonation) add up to 69 points.
- The score is capped at 100 for consistent interpretation.
How to use this calculator
- Gather observable signals from DNS, mail checks, and hosting data.
- Enter values for each factor using consistent internal criteria.
- Click Calculate Risk to view score and breakdown.
- Review the top contributors and apply the recommended actions.
- Download CSV or PDF to share findings with your team.
Threat landscape for domain abuse
Domain abuse commonly clusters around rapid registration, hidden ownership, and disposable hosting. This calculator turns those signals into a comparable score so teams can triage faster. It focuses on measurable controls like mail authentication, certificate hygiene, and observable threat indicators, rather than subjective reputation alone. Use the output to prioritize verification steps before login pages, email campaigns, or third-party integrations go live.
How the score is constructed
The model assigns points per factor and sums them into RawPoints, then applies a risk appetite multiplier. Domain age contributes 0, 6, or 12 points. Blacklist indicators range 0–10 and add up to 30 points. Redirect count ranges 0–10 and adds up to 15 points. Appetite tuning uses 0.90 (aggressive), 1.00 (balanced), or 1.10 (conservative), with the final score capped at 100.
Understanding risk bands
Scores map to four operational bands: 0–24 Low, 25–49 Moderate, 50–74 High, and 75–100 Critical. Moderate results often indicate configuration gaps like weaker DMARC enforcement or missing DNSSEC. High and Critical results typically involve multiple strong indicators together, such as suspicious content signals plus infrastructure risk, or multiple blacklist hits combined with weak mail controls.
Operational use in reviews
Use the breakdown table to identify the top five point contributors and assign owners to each remediation item. For example, DMARC set to “none” can add 8 points, while weak hosting reputation can add 12. Teams can standardize an approval workflow: Low can proceed with routine monitoring; Moderate requires verification; High triggers additional controls; Critical blocks deployment until investigation completes.
Store exported reports per domain and compare month over month. A decreasing score after fixes becomes a KPI, while sudden increases can indicate DNS drift, hijacking, or new blacklist hits in telemetry.
Targeted remediation priorities
Reduce score efficiently by fixing the highest-weight issues first. Start with mail identity: align SPF, enable DKIM, and enforce DMARC “reject” where feasible. Improve infrastructure posture by enabling DNSSEC, maintaining a valid TLS certificate, and moving away from high-abuse hosting networks. If the domain resembles a brand, tighten access controls and require stronger proof of legitimacy. Recalculate after each change to confirm risk reduction.
FAQs
1) What inputs should I collect before scoring a domain?
Collect domain age, WHOIS privacy status, registrar and hosting reputation, DNSSEC state, SPF/DKIM/DMARC results, certificate status, redirect count, blacklist indicators, and any brand similarity findings.
2) Does WHOIS privacy always mean the domain is malicious?
No. Privacy can be legitimate, but it reduces attribution confidence. Treat it as one signal among many, and rely on the full breakdown and your verification workflow.
3) When should I choose the conservative risk appetite?
Use conservative appetite when false negatives are costly, such as authentication portals, finance, or executive communications. It increases sensitivity by applying a 1.10 multiplier to raw points.
4) How should I interpret a High or Critical score?
High (50–74) and Critical (75–100) indicate multiple strong abuse indicators. Require additional validation, restrict risky actions, and investigate infrastructure and content signals before trusting the domain.
5) If a domain has no MX record, is it safer?
It may reduce email-based phishing capability, but it does not reduce web-based abuse. Treat missing MX as a minor signal and continue evaluating hosting, TLS, redirects, and content indicators.
6) How often should I rescore a domain?
Rescore after meaningful changes: DNS updates, hosting moves, certificate renewal, mail policy changes, or new threat intelligence. For high-exposure domains, schedule periodic rescoring alongside monitoring and incident reviews.