How Domain Age Can Affect Email Risk
Domain age is looked up via RDAP (the successor to WHOIS) and classified into bands — very new, new, recent, or established. A very new domain contributes a real, but moderate, risk signal, because domains registered specifically to farm signups or run short-lived scams are disproportionately brand-new. It's never treated as proof of anything on its own, and a failed lookup is always treated as unknown, never as a penalty.
How the lookup actually works
Domain age is determined via RDAP — the modern, structured successor to WHOIS — using a public bootstrap redirector that automatically routes the request to the correct registry for any domain, without needing to hard-code per-TLD server logic. The registry's response includes a registration event with a date; the number of days since that date determines the classification.
Classification bands
| Classification | What it means |
|---|---|
| very_new | Registered very recently — the strongest age-based signal |
| new | Registered recently, but past the very-new threshold |
| recent | Registered somewhat recently — a mild positive adjustment to reputation, not a risk signal |
| established | Registered well in the past — a positive reputation factor |
| unknown | RDAP lookup failed or the registry doesn't support RDAP — never treated as risky |
Only very_new and new contribute an actual risk signal (new_domain) to the overall score. recent and established only ever help a domain's reputation — they're not risk-neutral, they're mildly positive, since a domain with any track record at all is statistically less associated with throwaway use than one registered days ago.
Why "unknown" specifically is never penalized
RDAP coverage varies by registry — some country-code TLDs return a bare 404 with no usable data, and lookups can simply time out. Treating a failed lookup the same as "very new" would punish domains purely for having a registry that doesn't cooperate with RDAP, which has nothing to do with actual risk. So unknown gets a zero adjustment in the reputation formula and never triggers the new_domain risk signal — an absence of evidence isn't evidence of anything.
Why domain age correlates with certain kinds of abuse
It's not that new domains are inherently untrustworthy — plenty of legitimate businesses launch on brand-new domains. The correlation runs the other way: domains registered specifically to support short-lived signup farming, phishing infrastructure, or scam campaigns are disproportionately brand-new, because they're often registered and used within days, then abandoned. An established domain with years of DNS history has, by definition, not been used purely for a short-lived abuse campaign — that's a meaningfully different population than "any domain younger than X days," even though age alone can't distinguish a new legitimate business from a new abuse domain.
Caching and fast mode
Domain age lookups are cached, since a domain's registration date obviously doesn't change between checks. Fast mode never performs a live RDAP lookup at all — it only reads from cache, returning unknown for anything not already cached, which keeps fast mode genuinely fast at the cost of some coverage on domains it hasn't seen before.
FAQ
No — it's one moderate contributing signal among many. A brand-new domain with otherwise clean DNS configuration and a confirmed mailbox can still land in the allow band.
It's classified as unknown and never penalized in either the reputation score or the risk score — a failed or unsupported lookup is treated as missing evidence, not negative evidence.
No — this uses RDAP, WHOIS's structured, machine-readable successor, via a public bootstrap service that resolves the correct registry automatically.
It's cached with a TTL and re-verified after expiry — the registration date itself never changes, but caching still avoids redundant lookups against the registry on repeat checks of the same domain.