Short answer: Before paying for any domain, check eight things: its registration history, what it used to host, who links to it, whether it sits on any security or email blacklist, whether the name is a registered trademark in your markets, whether matching social handles are free, what the word means in other languages, and whether the current registration is unlocked and far from expiry. Most of this takes half an hour with free tools, and it is the half hour that separates a clean purchase from an expensive one.
Registration history
Start with a WHOIS lookup. Since GDPR, the registrant’s name is usually redacted, but you still get the registrar, creation date, expiry date and status codes. The creation date tells you whether you are buying a name registered in 1998 or one hand-registered last spring; the former often carries age-related trust with search engines, the latter rarely does. Check that the registrar named matches what the seller told you.
Then look at historical WHOIS through a service such as DomainTools or WhoisXML (paid, but a single report is inexpensive). You are looking for how many times the name has changed hands, whether it ever dropped and was re-registered (which resets its effective age), and whether the current holder has owned it long enough to be plausibly the person selling it. A domain that changed registrant three weeks ago is not necessarily a problem, but it warrants a question.
What the domain used to host
The Wayback Machine at web.archive.org shows archived snapshots going back to the 1990s. Click through every distinct period. You want to know whether the name ever hosted anything that would embarrass your brand or taint its reputation: adult content, pharmaceutical spam, counterfeit goods, a casino affiliate, a political organisation, a competitor in your own sector, or a defunct business whose former customers will arrive expecting refunds.
Also note what it was in a different language. A Persian-market name like behiran.com may have an archived history in Farsi that an English-only check would miss; run the snapshots through a translator if you cannot read them. Absence of snapshots is not clean bill of health, merely absence of evidence, but a decade of nothing is at least reassuring.
Backlink profile and spam history
Run the domain through Ahrefs, Semrush, Moz or Majestic. Free tiers show enough. You are checking three things: how many domains link in, what anchor text they use, and whether the referring sites are real. A name with a few hundred links from legitimate sites in your sector is a modest asset. A name with ten thousand links from Chinese gambling directories with anchor text in a language you do not speak is a liability, because search engines have very likely already penalised it and you will inherit the penalty.
Look at the anchor text cloud in particular. If the top anchors are pharmaceutical brand names or “cheap replica”, the domain was part of a spam network at some point, regardless of what the archived pages show. Disavowing links is possible, but you are buying work and uncertainty rather than a clean asset.
Safe Browsing and email blacklists
Two quick checks, both free. Google’s Safe Browsing site status page (transparencyreport.google.com) tells you whether the domain is currently flagged for malware or phishing; a flag means every Chrome user sees a red warning page. Then run the domain through MXToolbox’s blacklist check, which queries several dozen email reputation lists at once. A domain on Spamhaus DBL or similar will have its outbound email dropped by most providers, which for a company that intends to send email from the name is close to fatal until delisted.
Delisting is possible but takes time and sometimes a paid review; price that into your offer if the name is otherwise right.
Trademark search
This is the check most buyers skip and most regret. A domain is not a trademark, as we have covered, and owning the .com gives you no defence if someone else holds a registered mark in the class you trade in. Search at minimum:
| Register | Covers | Where |
|---|---|---|
| USPTO (TESS / Trademark Search) | United States | uspto.gov |
| EUIPO (eSearch plus) | European Union | euipo.europa.eu |
| WIPO Global Brand Database | International registrations under Madrid, plus many national offices | wipo.int/branddb |
| UK IPO | United Kingdom (no longer covered by EUIPO) | gov.uk |
| Local offices | Any market you will trade in (UAE, Saudi, Canada, Australia and so on) | National IP office sites |
Search the exact string and obvious phonetic variants. An invented five-letter name like nefyo.com is unlikely to collide; a real-word compound is more likely to. A live registration in your Nice class in a market you care about is a reason to walk away, however good the name. A registration in an unrelated class (a brand of tractor paint when you are building accounting software) is usually fine, but ask a trademark attorney for an hour if the name matters.
Social handles, meaning, and registrar status
- Social handles. Check the exact string on Instagram, X, TikTok, LinkedIn, YouTube and GitHub, using a tool like Namechk or by hand. You will not get all of them; you want to know whether the important ones for your audience are free, taken by a dormant account, or taken by an active business. A dormant account can sometimes be reclaimed; an active one cannot.
- Meaning in other languages. Put the name through Google Translate and Urban Dictionary, and search it with “meaning” appended. Invented names are generally safe, but short strings collide with real words surprisingly often. If you sell into the MENA region, Spanish-speaking markets or East Asia, ask a native speaker; a word that is neutral in English can be rude or ridiculous elsewhere. See invented vs real-word domains.
- Registrar lock and expiry. Back in the WHOIS record, the status codes tell you whether the domain is locked (clientTransferProhibited is normal and fine; it just needs unlocking before transfer) or under a hold (serverHold, clientHold, redemptionPeriod or pendingDelete are red flags that mean the domain is suspended or expiring). Check expiry: anything under 60 days out should be renewed by the seller before you pay, and a domain that was registered or transferred within the last 60 days cannot be transferred again until that window closes under ICANN rules.
At a glance
- Historical WHOIS shows ownership changes and drops that reset a domain’s effective age.
- The Wayback Machine reveals past uses that could taint your brand; check non-English periods too.
- A spammy backlink profile means an inherited search penalty; read the anchor text cloud.
- Safe Browsing and email blacklists take two minutes to check and can take weeks to clear.
- A live trademark in your class and market outranks the domain; search USPTO, EUIPO and WIPO at minimum.
Frequently asked questions
Does a long registration history always mean a better domain?
No. Age helps only if the history is clean and the domain never dropped. A 20-year-old name that spent five of those years as a spam landing page is worse than a clean 3-year-old one. Age is a multiplier on a clean record, not a substitute for one.
What if the seller refuses to tell me where the domain is registered?
WHOIS tells you regardless, so a refusal is odd. If the seller is evasive about the registrar, the account history or the reason for selling, treat that as a finding in itself. Legitimate sellers answer these questions in a sentence.
Should I do all this for a cheap name?
Do the free checks regardless of price: Safe Browsing, blacklist, Wayback, a quick trademark search. They take fifteen minutes. The cost of discovering a trademark conflict after you have printed business cards and launched is the same whether the domain cost a little or a lot.
Buy names with the checking already done
Every name listed on brandable.forsale is screened for ownership, lock status and obvious history problems before it goes live, which means your due diligence starts from a clean baseline rather than a blank page.
