What Is a Domain Reputation Check? How Teams Stop Signup Fraud With Domain Risk Scores

Introduction

Every signup form asks for an email address, and every email address ends in a domain. That domain is one of the most underused fraud signals you already collect. A real customer usually signs up with a mailbox at an established provider or at a company domain that has existed for years and has proper mail records. A fraud ring creating hundreds of accounts often does something very different: it uses throwaway inboxes, forwarding services, or a domain it registered last week.

A domain reputation check turns that difference into data your systems can act on. Instead of trusting any address that passes a syntax check, you look at the domain behind it: how old it is, whether it is flagged as dangerous or disposable, and whether it has the DNS records a legitimate mail domain normally has. This guide explains what a domain reputation check measures, how to read the results, and how teams use domain risk scores to stop signup fraud without adding friction for real users. The stakes at the front door keep rising.

According to TransUnion's H2 2025 Update: Top Fraud Trends, 8.3% (or 1 in 12) of all new accounts created in H1 2025 were suspected to be fraudulent, a 28% increase over H1 2024, making account creation the riskiest step in the customer journey.

TransUnion: What Is New Account Creation Fraud and How to Combat It

Stop Fake Accounts at the Cheapest Possible Moment

Fraud gets more expensive the longer it lives inside your product. A fake account that slips through signup can claim a welcome bonus, burn free trial credits, post spam, test stolen cards, or sit quietly until it is used for a bigger attack. Every one of those outcomes costs more to clean up than a single lookup at registration.

A domain reputation check runs before the account exists. That makes it one of the cheapest controls in your stack: one request, a few milliseconds, and a clear signal about whether the email domain deserves trust.

What a Domain Reputation Check Actually Measures

Domain reputation is the trust history attached to a domain name. It answers practical questions. Is this domain known to be dangerous? Is it a disposable email service? Does it forward mail somewhere else? Was it registered recently? Does it publish the mail authentication records that real organizations set up?

Greip's Domain Lookup API returns these answers as simple true or false flags plus a creation date, so you can combine them into your own domain risk score:

• Dangerous flag. The domain is associated with risky or malicious activity.
• Disposable flag. The domain belongs to a temporary or throwaway email service.
• Forwarding flag. Mail sent to the domain is forwarded elsewhere, a common way to hide the real inbox.
• Mail authentication flags. Whether the domain publishes SPF, DMARC, DKIM, MX, and BIMI records.
• Creation date and new flag. When the domain was registered and whether it is considered newly created.

Catch Disposable and Forwarding Domains Before They Convert

Disposable email services are built for one thing: getting past a signup form without leaving a real identity behind. They are popular with people farming promo codes, abusing free trials, and creating sock puppet accounts. Forwarding domains are a quieter version of the same idea, letting someone receive your verification email while hiding where it really lands.

When the disposable flag is true, most teams either block the signup outright or require a different email. A forwarding flag on its own is weaker evidence, since some legitimate users rely on forwarding for privacy, so it works better as a reason to add a verification step.

Spot Freshly Registered Domains Used for Abuse

Attackers register domains, use them for a short campaign, then abandon them. A domain created a few days ago with no mail history is a very different risk from one that has been sending mail for a decade.

The scale of this is significant. Research submitted to ICANN found that 8,496,811 of the roughly 85 million gTLD domains created in 2025 had already been added to blocklists by May 2026, about 10% of all new registrations (Interisle letter to ICANN). The new flag and creation date give you a direct way to treat young domains with extra caution.

Use DNS and Mail Records as a Legitimacy Check

Real organizations that send and receive email almost always publish an MX record, and many also publish SPF and DMARC. Large mail providers have pushed senders toward these standards for years. A domain with no MX record is rarely set up to receive mail, which makes it a strong sign the address was invented to get through a form.

The mail authentication flags help you separate a real company domain from a hastily built one. A domain with MX, SPF, DMARC, and DKIM in place and a creation date years in the past looks like an established business. A domain with none of them, created last month, deserves a closer look.

A Technical Look at the Domain Lookup Response

The endpoint is a simple GET request to https://v2.greipapi.com/lookup/domains/{domain}. Here is the sample response from the Greip docs for a risky domain:

{
  "success": true,
  "data": {
    "name": "dangerous-domain.com",
    "is_dangerous": true,
    "is_disposable": false,
    "is_forwarding": false,
    "is_spf": false,
    "is_dmarc": false,
    "is_dkim": false,
    "is_mx": false,
    "is_bimi": false,
    "created_at": "2025-02-05",
    "is_new": true
  },
  "execution_ms": 0
}

This domain is flagged as dangerous, was created recently, and has no MX, SPF, DMARC, DKIM, or BIMI records. It is not disposable or forwarding, which shows why reading every flag matters: a check for disposable domains alone would have let it through.

Run Your First Domain Reputation Check in Minutes

API v2 accepts your key only in the Authorization header as a Bearer token, never in the query string. Use mode=test while you build so you can simulate the integration before going live:

curl -s "https://v2.greipapi.com/lookup/domains/example.com?mode=test" \
  -H "Authorization: Bearer YOUR_API_KEY"

In a Node.js backend, you can extract the domain from the submitted email and turn the response into a signup decision:

async function checkEmailDomain(email, userId) {
  const domain = email.split("@").pop().trim().toLowerCase();
  const url = `https://v2.greipapi.com/lookup/domains/${encodeURIComponent(domain)}?mode=test&user_id=${encodeURIComponent(userId)}`;
  const res = await fetch(url, {
    headers: { Authorization: `Bearer ${process.env.GREIP_API_KEY}` },
  });
  const json = await res.json();
  if (!json.success) {
    // Decide whether to fail open or closed for your risk tolerance
    return { decision: "review", reason: json.description };
  }
  const d = json.data;
  const reasons = [];
  if (d.is_dangerous) reasons.push("dangerous");
  if (d.is_disposable) reasons.push("disposable");
  if (d.is_mx === false) reasons.push("no_mx");
  if (d.is_new) reasons.push("new_domain");
  if (d.is_forwarding) reasons.push("forwarding");
  if (d.is_dangerous || d.is_disposable || d.is_mx === false) {
    return { decision: "reject", reasons };
  }
  if (d.is_new || d.is_forwarding) {
    return { decision: "review", reasons };
  }
  return { decision: "accept", reasons };
}

Passing a user identifier with each request lets you find that user's lookups on the Events page in your Greip dashboard, which helps when support needs to explain why a signup was challenged.

Build a Domain Risk Score That Fits Your Product

The API gives you clean flags, and you decide how much each one is worth. A simple weighted model is easy to explain and tune:

1. Hard blocks. Dangerous or disposable domains, and domains with no MX record.
2. Strong friction. Newly created domains, especially combined with missing SPF or DMARC.
3. Light friction. Forwarding domains or domains missing only one authentication record.
4. Accept. Established domains with complete mail records.

Log the individual flags along with the final decision. That makes it easy to audit why a user was challenged and to adjust weights later without guessing.

Protect Revenue Without Punishing Real Customers

The goal is not to block as many signups as possible. It is to block the right ones. Overly strict rules cost you customers who use small business domains, privacy-focused mail services, or brand new company domains.

Use the middle tier generously. Email confirmation, SMS verification, or a short delay before a welcome bonus is released will stop most automated abuse while letting real users continue. Reserve hard blocks for domains where several strong signals agree.

Layer Domain Checks With Email, Phone, and IP Signals

A domain reputation check tells you about the domain. It cannot tell you whether a specific mailbox on a popular free provider is fake, because those domains are legitimate. That is where mailbox level checks come in.

Greip's data scoring and validation service adds email and phone scoring on top of domain data, so you can catch risky addresses on trusted providers too. Teams fighting bulk registrations often combine all of these signals as part of a broader fake account prevention strategy, adding IP and phone checks so a fraudster has to defeat several independent signals at once.

Check Suspicious Domains by Hand Before You Automate

Before writing rules, it helps to see real data. Greip's free domain scoring tool lets you look up any domain and see its risk signals instantly. Pull a sample of recent signups that later turned out to be fraudulent, run their domains through the tool, and look for patterns. You will often find a small set of disposable services or freshly registered domains behind a large share of abuse. Those findings become your first automated rules.

Where Domain Reputation Checks Are Heading

Generative AI makes it cheaper to build convincing fake sites and mail domains, and attackers keep cycling through new registrations faster than static blocklists can follow. That pushes domain reputation away from simple lists and toward live signals checked on every request: age, mail infrastructure, and known abuse combined in real time. Expect more teams to run a domain check on every email they accept, not just at signup, including password resets, invoice contacts, and partner onboarding.

Frequently Asked Questions

What is a domain reputation check?

A domain reputation check looks up a domain name and returns signals about how trustworthy it is, such as whether it is dangerous or disposable, whether it forwards mail, when it was registered, and whether it publishes SPF, DMARC, DKIM, MX, and BIMI records.

How do I check email domain reputation with Greip?

Extract the domain from the email address and send a GET request to https://v2.greipapi.com/lookup/domains/{domain} with your API key in the Authorization header as a Bearer token. Use mode=test while building, and run the call from your server.

Which signals indicate a risky domain?

The strongest signals are a dangerous or disposable flag and a missing MX record. A recent creation date, mail forwarding, and missing SPF or DMARC records are weaker signals that work best combined with other checks.

Should I block every newly registered domain?

No. New businesses register domains every day. Use domain age to add friction such as email or SMS verification, and block only when several strong signals agree.

What happens if a domain is not in Greip's database yet?

The Domain Lookup endpoint is in beta. Unknown domains return null values and are collected in the background, typically within 24 hours of the first request. Treat null values as unknown rather than safe or risky.

Is a domain reputation check enough to stop signup fraud?

It is a strong first layer, but it cannot judge individual mailboxes on trusted free providers. Combine it with email, phone, and IP scoring for a more reliable signup decision.

Which Greip plan includes the Domain Lookup API?

The Domain Lookup endpoint is available on Standard plans and above. You can also try individual lookups with the free domain scoring tool.

Conclusion

A domain reputation check is one of the fastest and cheapest ways to improve signup quality. With a single lookup you learn whether an email domain is dangerous, disposable, forwarding, newly registered, or missing the mail records real organizations publish. Turn those flags into a simple domain risk score, map it to accept, review, and reject actions, log every decision, and layer it with email, phone, and IP scoring as your program grows. Start by testing a few suspicious domains in the free domain scoring tool, then follow the Domain Lookup docs to make your first call with Greip.