| Check | Finding | Source |
|---|---|---|
| Registration | Registered 1995-09-08 (11,370 days ago) through MarkMonitor Inc. | RDAP |
| Email records | MX present (2 records). SPF present. DMARC present, policy reject. | Cloudflare DNS |
| First snapshot | 1997-04-15 | Wayback Machine |
Check a vendor’s email domain before you change their bank details
For anyone who gets an email asking to update a supplier’s bank account. Pyxmark reads the sending domain’s registration date, its MX, SPF and DMARC email records and its first Wayback Machine snapshot, and screens the vendor’s name. It can’t confirm a bank account, and it can’t tell you whether the vendor’s real mailbox was taken over.
Before you change any bank details:
- Find the domain after the @ in the email that asked for the change.
- Compare it letter by letter with the domain on earlier invoices from this vendor.
- Run it through the free check with the vendor’s name.
- Call the vendor on a phone number you already had on file. Don’t use a number from the email asking for the change.
- Change the details only after that call confirms them.
A domain check catches the lookalike: a domain registered last month shows its date in the report, and under 30 days old the verdict is hold. A real vendor domain that has been around for years looks clean even when someone else is sending from it. That’s why the phone call on a number you already had is the step that protects you.
45% of organizations were targeted by vendor-impostor fraud in 2024, up from 34% the year before (AFP 2025 Payments Fraud and Control Survey).
What it reads and what it can’t
Pyxmark reads the domain’s registration date and registrar, whether it has MX, SPF and DMARC records, and the date the Wayback Machine first archived it. With a name, it also screens the vendor against the OFAC, UN, EU and UK sanctions lists and looks for an SEC record. The registration date comes from the domain’s registry, and if that lookup fails, Pyxmark falls back to rdap.org and then to the registry’s WHOIS server.
It can’t tell you who owns a bank account, see into a mailbox, or tell a taken over real account from the vendor. It checks the domain you give it, so comparing that with the vendor’s real domain is up to you. Email records on a domain don’t show whether this particular message passed them.
A real domain check
The domain_age tool on fastenal.com, a domain registered in 1995:
domain_age
{ "domain": "fastenal.com" }Real output, shortened, run Oct 25, 2026 (6:11 pm Pacific time).
How the signals count
domain_age reports facts. due_diligence_report, which the web form runs, turns them into a verdict with these rules:
| Signal | Verdict |
|---|---|
| Domain registered less than 30 days ago | Hold |
| Domain under 6 months old | Review |
| No MX, SPF or DMARC record | Review |
| Vendor name matches a sanctions listing | Hold at 0.95 or higher, review below |
| First Wayback snapshot under 90 days old, or a registration years older than the first snapshot | A note for you to weigh, not a flag |
| Domain age couldn’t be found | Reported as unknown; the verdict doesn’t change |
Full rules: report verdict in the docs.
Step by step
-
Find the sending domain
It’s the part after the @ in the address that sent the request. Read the address itself, not only the name shown beside it.
-
Run the check
On the web form, put the vendor’s name under Company or person and the sending domain under Website or email domain. In an AI assistant, ask for a due diligence report, or have it call
domain_agefor the domain alone:due_diligence_report { "name": "Acme Supply Co.", "domain": "acmesupply.com" }Is it free? Yes, 25 checks a day per IP address, with no account. Pyxmark doesn’t save the names you search or the reports it returns. Domain registration and DNS results are cached for up to 6 hours by domain name, with nothing about who asked (privacy policy).
-
Compare it with what you already have
If the domain differs from the one on earlier invoices, even by one letter, treat the request as suspect whatever the report says. Pyxmark doesn’t know which domain your vendor really uses.
-
Call the vendor
Use a number from your own records or an earlier contract, not one in the email or its signature, and ask them to confirm the change. A clean report doesn’t replace this call.
-
Keep the record
File the dated report with the change request and a note of the call.
Limits
- Pyxmark doesn’t verify bank accounts or who holds them.
- It can’t detect a real vendor mailbox that someone else has taken over.
- Results are informational, not a compliance determination or legal advice.
When you don’t need this
If the request came from the same domain you’ve emailed with this vendor for years, the domain check won’t tell you much: an old, well set up domain looks the same whether or not the mailbox was taken over. Go straight to the phone call.
If bank changes only happen through a supplier portal that confirms them its own way, or you already confirm every change by phone on a number you had on file, you’re doing the part that matters. For a vendor you’re paying for the first time, see checking a new vendor before you pay.