Domain Reputation API - Risk Verdict, Trust Score & Threat Intelligence
The APIFreaks Domain Reputation API assesses any domain and returns a synthesized risk verdict, a weighted trust score, DGA (Domain Generation Algorithm) detection, threat intelligence matches from external feeds, and a full email deliverability check, all from one REST call. Every score comes with the evidence behind it: which signals pushed the trust score up or down, which feed flagged a threat and when, and which nameservers or mail servers a domain shares with infrastructure already tied to abuse. When one signal can't be computed, a WHOIS server that times out, for example, the rest of the assessment still completes, and the gap is called out in the response rather than silently dropped.
It's built for teams making a trust decision about a domain they don't control: fraud teams screening a signup or checkout domain, security teams triaging a phishing report, and platforms deciding whether to allowlist a link or accept mail from an unfamiliar sender.
Features
Risk Verdict with Confidence
risk_category returns an overall verdict, safe or suspicious in practice, alongside a confidence score, a severity rating, and the primary threat type behind the call, so you get a decision, not just raw data to interpret yourself.
Use it to gate a workflow on a single field: treat verdict as your headline signal, and reach into confidence and severity only when you need to explain or override the call.
Threat Intelligence Matches
The sources array names every feed that flagged the domain, the threat type it reported, and when it first and last saw the indicator.
Use it to show a reviewer exactly which external feed is behind a flagged verdict, instead of asking them to trust a black-box score.
DGA Detection
dga_score flags domains that look algorithmically generated, a trait common to botnet and malware infrastructure, using lexical features like entropy and n-gram perplexity alongside a plain-language interpretation.
Use it to catch freshly generated command-and-control domains that haven't shown up on any threat feed yet, since DGA detection works on the name itself rather than on reputation history.
Trust Score with Evidence
trust_signals breaks the score into positive, negative, and neutral signals, each with its own weight and supporting evidence, like spf_configured or established_domain, so you can see exactly why a domain landed where it did.
Use it to set your own trust_score cutoff for automated decisions, and fall back to the individual signals when a borderline case needs a human look.
Email Deliverability with Actionable Fixes
email_deliverability verifies SPF, DKIM, DMARC, and MX setup and returns a can-receive-email verdict with a letter grade. When something's off, it doesn't stop at a flag: each entry in issues carries a plain-language recommendation, so a finding like a missing DKIM selector comes with what to actually do about it.
Use it to vet a sender domain before you accept or relay mail that claims to come from it, and hand the issues array straight to whoever owns that domain's email setup.
Graceful Degradation on Partial Data
If one signal can't be computed for a domain, a WHOIS lookup that times out, for instance, the assessment doesn't fail outright. The rest of the checks still run, related fields come back null instead of a guess, and the gap is named in errors.
Use it to trust the response even when a domain's registry data is temporarily unreachable: you still get a trust score and risk verdict built from whatever did resolve.
Built for These Use Cases
Fraud and signup screening
Score the domain behind an email address or referral link at signup or checkout, and hold or review accounts tied to a flagged verdict before you onboard them. Pair it with the Email Checker API when the fraud signal you care about is the address itself, not just its domain.Phishing and abuse triage
When a domain gets reported, get an evidence-backed verdict in one call instead of manually checking WHOIS age, blocklists, and SSL by hand. When you need the underlying registration facts behind that verdict, the Domain WHOIS Lookup API has the full record.Email security vetting
Check a sender domain's SPF, DKIM, DMARC, and MX setup before you trust it to send on your behalf, or before you accept mail that claims to come from it.Brand and content protection
Assess a domain's reputation before allowlisting it in ads, marketplaces, or user-generated content. If the domain itself looks like a lookalike of your brand rather than an unrelated risk, the Domain Typosquatting API is the better starting point.Threat intel enrichment
Attach a verdict, trust score, and the underlying IOC data to SIEM events or server logs so your team can prioritize investigation by risk instead of volume.API Endpoint
All Endpoints
| Endpoint | Description | Base Credits Cost | Reference | Playground |
|---|---|---|---|---|
| Domain Reputation | Assess any domain's risk verdict, trust score, and threat intelligence in real time. | 90 | Reference | Playground |
How-To-Guides
Check a Domain's Risk Verdict
Before you onboard a signup, accept a referral, or relay mail from an unfamiliar sender, run its domain through a single call and read risk_category.verdict first. It's the headline call; reach into trust_signals.trust_score only when you need a number to threshold against for an automated decision. See the API Reference for every request parameter, response field, and error code.
curl -X GET "https://api.apifreaks.com/v1.0/domain/reputation?domainName=apple.com&apiKey=API-KEY"
# Response
{
"input": {
"domain": "apple.com"
},
"assessed_at": "2026-09-08T08:36:23.820181075Z",
"version": "1.0.0",
"processing_time_ms": 1739,
"risk_category": {
"verdict": "safe",
"confidence": 0.8,
"primary_threat": null,
"severity": "none",
"threat_types": [],
"sources": [],
"pivot_matches": []
},
"dga_score": {
"score": 0,
"is_dga": false,
"model": "deterministic_features_v1",
"features": {
"domain_length": 5,
"vowel_consonant_ratio": 0.6666666666666666,
"ngram_perplexity": -8.83,
"shannon_entropy": 1.9219280948873623,
"digit_letter_ratio": 0,
"consonant_streak_max": 3,
"tld_in_known_dga_set": false
},
"interpretation": "human_readable"
},
"trust_signals": {
"trust_score": 72,
"trust_band": "high",
"indicators": {
"is_newly_registered": false,
"has_privacy_whois": true,
"ssl_age_days": 26,
"has_dmarc": true,
"has_spf": true,
"redirects_externally": true,
"domain_age_days": 14446,
"registrar": "NOM-IQ Ltd dba Com Laude"
}
},
"email_deliverability": {
"score": 95,
"grade": "excellent",
"can_receive_email": true,
"issues": [
{
"code": "spf_softfail",
"severity": "low",
"message": "The SPF policy '~all' only soft-fails unauthorized senders",
"recommendation": "Move to '-all' once all legitimate sending sources are listed"
}
]
},
"intelligence": {
"ioc_type": "domain",
"ioc_value": "apple.com",
"stix_pattern": "[domain-name:value = 'apple.com' OR ipv4-addr:value = '17.253.144.10']",
"recommended_action": "allow"
},
"evidence_summary": {
"why_flagged": []
},
"errors": []
}
Read a response when a signal is unavailable
Not every domain resolves cleanly. Here, a WHOIS lookup timed out for apifreaks.com, so the registrar and domain-age fields come back null and errors names the gap, but the rest of the assessment, email security, SSL, and the resulting trust score, still completed.
# Response
{
"trust_signals": {
"trust_score": 70,
"trust_band": "high",
"indicators": {
"is_newly_registered": null,
"has_privacy_whois": null,
"domain_age_days": null,
"registrar": null
}
},
"errors": [
"WHOIS lookup failed"
]
}
Check errors alongside the verdict whenever a null field matters to your decision, an empty array means every signal resolved; a populated one tells you which didn't.
Screen a sender domain before you trust its mail
Read email_deliverability alongside the risk verdict. A domain can come back low-risk overall and still carry an issues entry, like the SPF softfail above, that matters if you're deciding whether to accept or relay mail that claims to be from it.
Frequently Asked Questions
is_dga gives you a fast boolean cutoff, while dga_score.score lets you set your own threshold. Because DGA detection works on the name itself, it can flag a domain before any threat feed has caught up to it.trust_signals.signals, things like SSL validity, domain age, and DMARC configuration. Each signal carries its own weight and supporting evidence, so the score is never a black box, and it can diverge from risk_category.verdict: a domain can come back safe and still carry negative trust signals that never triggered a threat-feed match.registrar, domain_age_days, is_newly_registered, come back null, and errors names the specific failure. Every other signal, email security, SSL, DGA, still resolves normally and feeds into the trust score.email_deliverability flags the problem and tells you how to resolve it: each entry in issues carries a code, a severity, and a recommendation describing the exact fix. An SPF policy set to soft-fail, for example, comes back with the recommendation to tighten it to -all, not just a warning code you have to interpret yourself.intelligence.stix_pattern returns the domain and its resolved IPs as a STIX 2.1 pattern expression, ready to wrap into an Indicator object for ingestion into any STIX 2.1-compatible platform, Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security, Palo Alto XSOAR, MISP, and OpenCTI included.Pricing
To use the Domain Reputation API, you will need API credits. We only charge for successful queries, defined by a 2xx status code. If your request results in a 4xx or 5xx status code, no credits will be charged, and any deducted credits will be returned.
For each successful request, 90 credits are charged.
Utilize the Credits Usage API to efficiently monitor your recent consumption of both one-off and subscription credits. This API provides a streamlined way to track and manage your credit usage, ensuring you stay informed about your remaining balance and can optimize your resource allocation effectively.