Skip to main content

Newly registered domains: check email domain age at signup

· 5 min read
Signitize
Signitize
Email checks for signup forms

support@quick-mail-hub.xyz passes every basic check. The domain exists, it has mail servers, it isn't on any disposable list. It was also registered on Tuesday, and on Wednesday it opened forty accounts on your free tier.

Domain age is one of the most useful signals you can add to a signup check. It is also one of the easiest to misuse, because the founder who registered acme-labs.io last week looks exactly the same.

Why new domains show up in abuse​

  • Throwaway mail services rotate domains. Once their domains land on blocklists, they register fresh ones. A domain that is days old has had no time to be listed anywhere (why blocklists fall behind).
  • Catch-all domains are cheap. Some TLDs cost a dollar or two for the first year. Point the MX at a catch-all inbox and every address on the domain works: a@, b@, c@, unlimited accounts, no aliases to normalize.
  • Phishing and spam campaigns use new domains for the same reason: no history, no reputation, no blocklist entry.

Why you shouldn't block them​

New domains are also how every new business starts. A startup signs up for your developer tool the week it registers its domain. An agency spins up a domain per client. A freelancer moves to their own domain. Block "domains younger than 30 days" and you turn away customers in their most valuable moment: when they are choosing their stack.

So domain age is a signal, not a verdict. Use it to decide how much to give a new account before it proves itself, the same way you'd treat a privacy relay.

How to look up a domain's registration date​

The old way is WHOIS: a free-text protocol with a different format per registry and aggressive rate limits. The modern replacement is RDAP, which returns JSON over HTTPS. Most generic TLDs (.com, .net, .org, .xyz and hundreds of others) must support it.

Each TLD has its own RDAP server, listed in IANA's bootstrap file. The public redirector at rdap.org forwards you to the right one:

async function domainRegistered(domain) {
    const response = await fetch(`https://rdap.org/domain/${encodeURIComponent(domain)}`, {
        headers: { Accept: 'application/rdap+json' },
        signal: AbortSignal.timeout(3000),
    })
    if (!response.ok) return null
    const data = await response.json()
    const event = data.events?.find((e) => e.eventAction === 'registration')
    return event ? event.eventDate.slice(0, 10) : null
}

await domainRegistered('example.com') // '1995-08-14'

What the simple version doesn't handle:

  • Some registries publish no date. Several country-code registries don't expose a creation date at all, or don't run RDAP yet. null has to mean "unknown", never "new".
  • Rate limits. RDAP servers throttle repeated lookups. Cache every answer: a registration date never changes, so one lookup per domain is enough.
  • Latency. A lookup can take a second or more. Don't make the signup wait for it. Look it up in the background and use it when it's ready.
  • Big providers. Don't look up gmail.com or outlook.com on every signup. Their age tells you nothing about the person.
  • Subdomains. Look up the registered domain (acme.co.uk), not mail.acme.co.uk.

Using it in your signup​

Combine age with other signals and change what the account gets, not whether it exists:

const DAY = 86400000

function isNewDomain(registration) {
    return registration !== null && Date.now() - Date.parse(registration) < 30 * DAY
}

const result = await checkEmail(email)
if (result.disposable || !result.deliverable) return reject(/* ... */)

const user = await createUser({ email, emailCanonical: result.email })

if (isNewDomain(result.registration)) {
    // a real account, but the free credits wait for verification and a second signal
    await flagForReview(user, 'domain registered recently')
}

Good second signals: the verification email clicked, a payment method on file, a few days of normal activity, a domain with a working website. A week-old domain plus a dozen signups from it in an hour is a very different story from one signup with a company website behind it.

Doing it with Signitize​

Signitize returns the domain's registration date in the same call as the disposable, deliverability and duplicate checks:

{
    "email": "support@quick-mail-hub.xyz",
    "disposable": false,
    "deliverable": true,
    "relay": false,
    "provider": null,
    "found": 0,
    "registration": "2026-11-03",
    "alias": []
}

It handles the RDAP bootstrap and caching for you, and never makes your signup wait: the first time a domain is seen, the date is looked up in the background and registration is null for that one check. It is also null for the big mailbox providers and relays, and when the registry publishes no date. Details in Check an email.

Summary​

  • A domain registered days ago is a strong abuse signal, especially for catch-all and throwaway domains.
  • It is also how every new business looks, so never block on age alone.
  • Look up the date with RDAP, cache it forever, and treat null as unknown.
  • Use it to hold back free perks until a second signal arrives.

Get a free API key and see registration for your own domain in the Quickstart.