How to block newly registered domains
Most phishing and scam domains do their damage in their first days online, long before many blocklists list them. A rule on domain age is one of the most effective single controls an IT team can add.
This guide is for IT admins, MSPs, school IT teams and vendors who want an age based policy that blocks threats without blocking the business.
What "newly registered" actually means
Products and feeds use the term in slightly different ways. Know which one your tool uses before you write the policy.
Days since registration
Based on the registration date in registry or registrar data. The most common definition, and the most meaningful for phishing risk.
Days since first observed
Based on when a domain first appears in DNS traffic or other observations. Useful when registration data is missing or hidden.
How long "new" lasts
Common windows are 24 hours, 7 days and 30 days. Thirty days is the most common default for a newly registered domains category.
Why organisations block newly registered domains
The case for an age rule is about timing. Threat lists react after a domain is reported; an age rule acts before.
What an age rule stops
- Phishing pages for banks, cloud apps and delivery services, set up and used within days.
- Lookalike domains that imitate your own brand or a supplier's for invoice fraud.
- Short lived scam shops and fake support sites.
- Malware download and command servers on fresh domains.
- New proxy, mirror and unblocker sites that students share, see how to block proxy sites.
What it can get wrong
- Product launches and rebrands that move to a new domain.
- Event, conference and campaign microsites.
- New suppliers, customers and start-ups your staff need to reach.
- Links in newsletters that point to freshly created landing pages.
- These are why category and warn pages matter, as shown below.
Four policy options for new domains
You do not have to choose between blocking everything and doing nothing. Most organisations use different options for different user groups.
Block
All new domains are refused until they age out or are allowlisted.
Best for: students, kiosks, servers, high risk rolesWarn
A page explains the site is new and asks the user to confirm.
Best for: general staffIsolate
The site opens in remote browser isolation or read only mode, with no downloads or form input.
Best for: finance and executives who still need accessLog and alert
Allowed, but logged and sent to security for review.
Best for: a first week trial before enforcementChoosing the age window
| Window | What it catches | False positive risk | Good fit |
|---|---|---|---|
| 24 hours | The fastest phishing kits and scam pages | Low | Business networks that cannot tolerate disruption |
| 7 days | Most short lived phishing and scam campaigns | Moderate | A balanced default with warn pages |
| 30 days | Slower campaigns and domains that wait before use | Higher | Schools, high security groups, server networks |
| 30 days plus uncategorised | New domains and older domains with no known content | Highest | Locked down environments and student devices |
Whatever window you pick, write it in the policy and review it after a month of logs. The right window is the one your help desk can live with. Many teams start at 7 days with warn pages, then tighten to 30 days for groups that rarely hit exceptions.
Combine age with category for fewer mistakes
Age alone treats a new bakery website the same as a new bank lookalike. Adding the category of the new domain lets you be strict where it matters and relaxed where it does not.
A new domain claiming to be a bank is a classic phishing sign, which is why the matrix treats new financial sites strictly for high risk roles. Our phishing category and malware category pages explain what each covers.
Methods: DNS, firewall, Intune, Google Admin and MDM
DNS filter or resolver
- Enable the newly registered domains option or category if your DNS filter has one.
- On your own resolvers, load a daily new domain feed as a DNS RPZ zone that returns a block answer.
- Set the window and add a warn page if the product supports it.
- Lock DNS so clients cannot use other resolvers or DoH.
Firewall
- Many firewalls offer a newly registered or newly observed domain category in their URL filter. Check your vendor's current category list.
- Otherwise, import a daily domain list as an external dynamic list and block it in the outbound policy.
- Apply stricter rules to server and kiosk segments, which rarely need new sites.
Microsoft Intune
- Use Intune to push a DNS or filter agent configuration to managed Windows devices.
- Apply the new domain rule per device group, with stricter settings for kiosks and shared machines.
- Report on devices where the filter agent is missing or turned off.
Google Admin console
- The Chrome URL blocklist works on names, not domain age.
- For managed Chromebooks, use a DNS or extension based filter that understands domain age, and apply it per organisational unit.
- Keep Safe Browsing on, and set DNS over HTTPS to off or to your resolver.
Mobile MDM
- Push a DNS or filtering profile that includes the new domain rule.
- Phones receive many phishing links by text message, so this is where an age rule pays off.
- Apply the same window as on laptops for consistent behaviour.
Router
- Most routers cannot evaluate domain age themselves.
- Point DHCP at a filtering DNS resolver that does, and block other resolvers.
- For small offices this is often the simplest complete option.
Email security
- Score links to new domains higher in email filtering.
- Rewrite or re-check links at click time, because a domain can be activated after delivery.
- Quarantine invoices or payment requests that link to new domains.
Lookalikes of your own brand: block them before they are used
Invoice fraud and credential phishing often use a new domain that looks like yours or a key supplier's. You can watch for those registrations and block them pre-emptively.
List your names
Write down your main domains, brand names and the domains of banks and suppliers that staff pay or sign in to.
Scan new registrations
Compare each day's new domains against the list for swapped letters, extra words such as "login" or "invoice", and other endings.
Block and record
Add strong matches to your block policy at once, record them, and pass serious cases to your legal or brand team.
A daily file of new domains with categories makes this a simple scheduled job, rather than a manual search. Parked lookalikes are worth blocking too, because they can switch to a phishing page overnight.
Starting points by organisation type
| Organisation | Window | Default action | Notes |
|---|---|---|---|
| K-12 school | 30 days | Block for students, warn for staff | Catches new proxy and game mirror sites. See K-12 web filtering. |
| Small business | 7 days | Warn for everyone, block for finance | Simple to run through a filtering DNS resolver |
| Bank or insurer | 30 days | Block, isolate on request | Pair with lookalike monitoring of your own brand |
| MSP tenants | 7 or 30 days per tenant | Warn by default | Log exceptions per tenant. See MSP web filtering. |
| Servers and OT networks | 30 days or longer | Block | Servers rarely need new websites; outbound traffic should be tightly limited anyway |
| Guest Wi-Fi | 24 hours | Block phishing and parked only | Keep guest experience smooth, protect your network reputation |
An exception workflow that keeps the rule alive
Age rules get switched off when legitimate sites stay blocked for days. A fast, simple exception process is what keeps them on.
The block or warn page has a "request access" link that captures the domain and the reason.
IT looks up the domain's category and registration details in a domain lookup.
Allow if the category is clean and the business reason is clear; otherwise isolate or refuse.
Exceptions can lapse once the domain ages out of the window, since the age rule no longer applies.
Track exception volume monthly. A rising count means the window or the user group rules need adjusting.
Limits and bypass risks to be honest about
An age rule is strong, not complete. Attackers know about it, and some adjust.
Aged and expired domains
Some attackers buy older domains or re-register expired ones to look established. Category and reputation checks handle these better than age.
Compromised legitimate sites
A hacked old website has no age signal at all. Malware and phishing categories at host and URL level are the defence.
Free subdomains
Pages on free hosting or website builder subdomains inherit the parent domain's age. Categorize at host name level where your filter supports it.
Hidden registration data
Privacy services and some registries limit what is visible. First seen data fills the gap.
Encrypted DNS
A browser using its own DNS skips a DNS based age rule. Lock DoH by policy.
VPNs and proxies
Tunnels skip every network rule. Pair this guide with blocking VPN apps.
How to test your new domain policy
The cleanest test is a domain you control. Register a cheap test domain, put a harmless page on it, and use it for the checks below in its first days.
- Open the test domain from a student or locked down device: it should be blocked.
- Open it from a staff device: the warn page should appear and allow you to continue.
- Open it from a finance device: it should open isolated or be blocked, per your matrix.
- Check the filter logs show the reason as domain age, not a generic block.
- Request an exception through the block page and time how long approval takes.
- Repeat on a managed phone over mobile data with the MDM profile active.
- Confirm that well known older domains are not affected.
- After the window passes, confirm the test domain is now treated by its category alone.
For vendors: adding domain age to your product
Customers of firewalls, DNS filters and gateways increasingly expect a newly registered domains option. These are the design choices that decide whether it works in practice.
Configurable window
Let admins pick 24 hours, 7 days or 30 days per policy, rather than one fixed value.
Age plus category
Expose both signals so admins can build a matrix like the one above, not just an on and off switch.
Clear block reasons
Show "new domain" as the reason on block pages and in logs, so help desks know which rule fired.
Fast data updates
A new domain rule needs new domain data every day. Weekly updates leave the most dangerous days uncovered.
Re-checks
A domain that was empty on day one may host a phishing kit on day five. Re-categorizing after a week and a month matters.
Offline operation
Appliances in air-gapped or bandwidth limited sites need the data as local files, not only as cloud lookups.
Read how licences work for embedded use on our OEM licensing page.
Category-based blocking with our database
An age rule is only as good as the speed at which new domains are seen and understood. Our database is built for that: new domains are categorized the day they appear and then checked again as their content develops.
That means you can do more than block by age. You can block new domains that are already known to be phishing or parked, warn on the uncategorised ones, and allow new domains whose content is clearly ordinary business. Our phishing and malware domain feed explains how the daily threat data is delivered.
Related categories worth enabling together: botnets, spam, Parked / For-Sale Domains and VPN / Proxy / Anonymizers.
What licensees receive
- About 300,000 newly registered domains categorized every day.
- Each one checked again after a week and after a month.
- Daily delta files; all other domains refreshed monthly.
- 120 million categorized domains in 59 categories overall.
- CSV, Parquet or JSON, plus exports as DNS RPZ, hosts files and firewall external dynamic lists, see blocklist formats.
- A lookup API included with licences for click time checks.
Newly registered domains FAQ
What is a newly registered domain?
A domain whose registration happened recently, usually within the last 30 days, although some policies use 7 days or even 24 hours. Some products also treat a domain as new when it is first seen in traffic, which is not always the same as its registration date.
Why block newly registered domains?
Many phishing, scam and malware domains are used within days of registration and abandoned soon after. A rule on domain age stops a large share of them before any blocklist has caught up, at the cost of occasionally blocking a legitimate new site.
Will blocking newly registered domains break legitimate sites?
Sometimes. Product launches, event sites, marketing campaigns and new suppliers all use new domains. Combine age with category, use warn pages for staff, and keep a quick allowlist process.
How long should a domain count as new?
Thirty days is a common default and is the window many filters use for a newly registered domains category. Shorter windows reduce false positives; longer ones catch more slow starting threats.
How does your database handle new domains?
About 300,000 newly registered domains are categorized every day and delivered as daily delta files. Each is checked again after a week and after a month, because many sites add content after launch.
Know what every new domain is on day one
License daily categorized new domain data alongside 120 million categorized domains, delivered as files for your own platform. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Microsoft, Windows and Intune are trademarks of Microsoft Corporation. Google, Chrome and Chromebook are trademarks of Google LLC. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.