# Recently registered domain

> A domain registered weeks ago that is now sending invoices is the strongest single signal this tool can show you. Why good email security does not offset it.

Canonical: https://vetthisvendor.com/guide/recently-registered-domain
Published: 2026-08-02. Updated: 2026-08-02.
Author: Jose Pollman, VetThisVendor.

If the sending-domain check reported that a domain was **registered less than a month ago**,
that is the strongest single signal on the result page. It is not proof of anything, and
new businesses are entirely real — but it deserves the phone call before the payment.

## Why age matters more than the email records

The domain check looks at SPF, DKIM and DMARC, which answer one question: can somebody
forge mail that appears to come from this domain? For an established supplier that is a
useful answer.

For a domain registered a fortnight ago it is close to meaningless, and the reason is worth
sitting with: **whoever registers a domain controls its DNS records.** An attacker setting
up `acme-invoices.com` to impersonate `acme.com` configures SPF, DKIM and DMARC *properly*,
because they need the invoice to reach your inbox rather than your spam folder. Modern mail
providers set all three up automatically.

So the impersonator's brand-new domain often has **better** email authentication than the
real supplier's twenty-year-old one. Reading the DMARC policy alone would hand the most
professional impersonators the most reassuring result on the page. Registration age is the
field that separates them.

## The two frauds this distinguishes

**The compromised mailbox.** A real supplier's email account is broken into and the invoice
is sent from their genuine domain. Age looks fine — the domain is as old as the business.
Nothing on this page catches it; only the phone call does.

**The lookalike domain.** A domain is registered that reads almost like the supplier's, and
invoices go out from it. Everything about the email is technically valid, because it is a
real domain properly configured. The age is the tell.

A check that only reads DMARC sees these as opposite results. In truth they are both worth
the same phone call.

## What to actually do

1. **Read the domain character by character, right to left.** `rn` looks like `m` at a
   glance. `l` looks like `I` in many fonts. A hyphen added or removed is invisible when you
   already know what the word says. Compare it against an older invoice or your accounting
   system, not against memory.
2. **Check whether it matches the domain you already had.** If you have paid this supplier
   before, the domain on the old invoice is the reference. A different one — however
   plausible — is the whole finding.
3. **Phone them on a number you already had.** Not the number on this invoice, not the one
   in the signature. One from an earlier invoice or your own records.
4. **Look at the VAT registration name.** If the registry returns a company name that does
   not match the business you think you are dealing with, that is a second signal. See
   [valid VAT number, different name](/guide/vat-name-mismatch).

## When a new domain is genuinely fine

Plenty of reasons exist and most of them will apply to somebody you pay this year:

- The business is **actually new**. Someone has to be their first customer.
- A **rebrand or merger** moved them to a new domain, usually announced in advance — worth
  checking you received that announcement through a channel other than email.
- They moved from a **marketplace or platform** to their own domain.
- A **country-specific domain** was added for a market they have just entered.

None of these is undermined by a phone call, which is the only thing this result asks you to
do.

## Why the check does not simply fail the domain

The result is amber, not red, and it never becomes a "do not pay". The tool has no way to
distinguish a fraudulent new domain from a legitimate one, and pretending otherwise would
be the same mistake as issuing a single "safe to pay" verdict — see
[about](/about). What it can do is put the one fact that matters where you will see it,
rather than leaving it as a grey line under a green tick.

Between one and six months old, the check says so in the text but does not change colour.
That range is ordinary for a real business, and a warning that fires on a large share of
honest invoices is a warning people learn to click past.