Trenes.com has been selling train tickets in Spain for nearly three decades, and that kind of longevity counts for a lot. Most established travel booking sites don't survive that long without being legitimate. The domain was registered in 1998, and the site now carries a clear legal disclosure page—showing the registered business name and address—which is exactly what you'd expect from a company that handles real bookings and payments.
What about safety? The site uses modern encryption, has been checked by Google Web Risk with no threats found, and isn't on any blacklists. The privacy policy and terms of service are in place, and you can find contact information and social media links easily. The only thing that stands out as unusual is that the Wayback Machine has no snapshots of the site, which is odd for a domain this old. But given the otherwise strong signals—especially the 28-year domain age and the official distributor claims for Renfe, AVE, and other operators—it's reasonable to trust trenes.com for your ticket purchases. Just keep an eye on the SSL certificate renewal; it's due in a couple of weeks.