Why a new domain is worth a closer look

Registration data is served through the Registration Data Access Protocol. ICANN describes RDAP as the replacement for the WHOIS protocol, delivering WHOIS-like registration data in standardized query and response formats ¹. A domain query has the form /domain/XXXX, where XXXX is a fully qualified domain name ².

The response is a JSON domain object, and its events array carries the dates. Each event has an eventAction and an eventDate. The registered action values include registration, meaning the object was initially registered, last changed, and expiration ³. The age of a domain is the time since its registration event.

There is no single RDAP server for the whole internet. Clients ask IANA's bootstrap file which server answers for each top-level domain. The file is a JSON object with a services list that pairs TLD labels with RDAP base URLs, and its entry for com points to the Verisign registry service ⁴. A client matches the TLD label by label, from right to left, and appends the domain path to the base URL ⁵.

Two practical consequences follow. A TLD that is missing from the bootstrap file has no RDAP service to ask, so you cannot read an age for it. And a name below the registered domain, such as a mail subdomain, must be reduced to the registered domain before you query.

The domain-age product runs that lookup for you. It reads the IANA bootstrap file, queries the registry's RDAP server, and returns the registration date, the age in whole days, the last-changed and expiry dates, the registrar, the status values and the server it used. If the registry says the domain does not exist, the answer is not_found; if the registry is rate limited or unreachable, the answer is unavailable, never not_found, so an outage is not mistaken for an unregistered domain. A name that is not a registered domain, or a TLD without an RDAP service, also comes back as not_found with a reason.

1curl -X POST https://YOUR_API_HOST/v1/domain-age \
2  -H "Authorization: Bearer $LOOKVALID_API_KEY" \
3  -H "Content-Type: application/json" \
4  -d '{"domain":"example.com"}'

1{
2  "domain": "example.com",
3  "registered": true,
4  "created_at": "1995-08-14T04:00:00.000Z",
5  "age_days": 11387,
6  "expires_at": "2027-08-13T04:00:00.000Z",
7  "rdap_server": "https://rdap.verisign.com/com/v1/"
8}

age_days is the number of whole days from created_at to the moment the answer was computed. A cached answer is not recomputed, so the figure can lag by the length of the cache.

The bands below are our suggested starting policy. Tune the cut-offs on your own data, where you can see how often each band later turns out to be a problem.

• Never block on age alone: new businesses and new projects register new domains every day.
• An old domain is not a clean one. A long-registered domain can be compromised or sold.
• Combine age with the email domain check and the link safety check for a fuller picture.

1. Extract the domain from the email address or URL you are scoring.
2. Call domain-age and read age_days.
3. Map the value to a band and add it to your risk score.
4. Treat unavailable as "try again", not as "new".

You can try a single lookup in the free domain age checker, then add the check to your own pipeline from the domain age product page.