Domain age check: what a registration date tells you about email risk

Domain age is counted from the day the domain was registered. For an address on that domain it is one risk signal among several: a mailbox on a domain created the day before yesterday is more likely to be disposable or fraudulent than one on a domain that has been around for twenty years.

It is useful, though not enough on its own. Honest startups launch on new domains, and old ones can be bought. This piece covers where to get the date, what research says about new domains, and when an age check gets it wrong.

Why new domains get less trust

Domains are cheap and reputation takes years. Someone running spam or fake signups finds it easier to drop a burned domain and register another than to repair the old one. Disposable mail services go through the same cycle: their domains land on temp-mail blocklists, so operators register fresh ones.

Unit 42, the threat research team at Palo Alto Networks, put numbers on this in a 2019 report. More than 70% of the newly registered domains they looked at were malicious, suspicious or not safe for work, almost ten times the rate among the most popular sites. The malicious ones were mostly short-lived, some up for a few hours or a couple of days, occasionally gone before any security vendor had flagged them.

How to look up domain age

The date lives with the registry, and two protocols expose it. WHOIS, the older one, returns free text in a format that varies by zone. ICANN calls RDAP its replacement: responses are JSON, and the registration date sits in the events array under the action registration, as RFC 9083 describes. Since 28 January 2025 gTLD registries and registrars must run RDAP, while WHOIS is no longer required for most of them.

In practice, Verisign's RDAP server returns a registration event dated 1995-08-14 for example.com. For a .ru domain the WHOIS server whois.tcinet.ru answers with a line like created: 1997-09-23T09:45:07Z for yandex.ru: a different format with the same information.

Registrars often redact owner details, more so since GDPR, but the creation date usually stays visible. Bulk lookups are where it gets awkward: country-code zones have their own formats and query limits, and each needs its own parsing.

What counts as a new domain

There is no standard cutoff. Unit 42 treats a domain as new if it was registered or changed owner in the last 32 days, the window in which, by their data, such domains are most often caught doing something malicious. For corporate web filtering they recommend blocking new domains, or at least alerting on them. On a signup form that is too blunt, because a false block there costs you a real person.

The signal also fails the other way. A creation date records when the domain was registered, not when it changed hands. A domain bought on the aftermarket keeps its old date and passes an age check, even though someone else now controls it. And when a domain expires and is registered again, the date resets, so it looks brand new despite its history.

Domain age next to other signals

That is why age gets read together with everything else. A new domain with MX records, SPF, DMARC and a working website is most likely just a new company. A new domain with no MX and no site, and an address like test123@, is worth a second look. You can see a domain's mail records with the email domain health check.

• On a signup form, it is usually better not to reject a young domain outright and to send that user through double opt-in or an extra check instead.
• In an existing list, a cluster of addresses on domains created a few days before signup points to bots or deliberate list poisoning far more clearly than any single address does.

uChecker does not check domain age. It looks at what is closer to delivery: whether the domain has mail servers, whether they respond, whether the mailbox exists, and whether the domain is on disposable lists. If you need the age itself, any RDAP client will give it to you, and combining the signals happens on your side.