The gap that blocklists leave open
Threat intelligence lists are built from reports: someone has to see a malicious domain in action, analyse it and publish it. That takes time. Attackers know this, so they register new domains for each campaign, use them for a short period and move on. During the first hours or days of a domain's life, it often appears on no blocklist at all, which is exactly when it does the most damage.
Filtering by domain age closes that gap. Instead of waiting to learn that a domain is bad, FirewallDNS treats very young domains as untrusted by default.
How domain age is checked
When newly registered domain filtering is enabled, FirewallDNS looks up the registration date of a requested domain using registry data such as RDAP, the modern successor to WHOIS. If the domain was registered more recently than your chosen threshold, the lookup is blocked. Results are cached so that the check does not slow down repeated lookups. [VERIFY: the threshold options available in the dashboard, e.g. 7, 14 or 30 days, and the data sources used]
What it catches
Newly registered domain filtering is particularly effective against threats that rely on fresh infrastructure.
- Phishing campaigns using brand-new lookalike domains
- Malware droppers and command-and-control domains set up for a single campaign
- Scam shops and fake support sites that are registered and abandoned quickly
- Domains generated by algorithms that malware uses to find its servers
When legitimate sites are affected
Some genuine sites are new too: a supplier's product launch, a conference microsite, a startup you are trialling or a marketing campaign domain. These will be blocked while they are younger than your threshold. In practice this happens rarely for most users, and the fix is quick: the query log shows the block reason, and adding the domain to your allowlist makes it reachable immediately.
If your organisation regularly works with new domains, choose a shorter threshold, or allowlist the domains as part of your onboarding process for new vendors or campaigns.
Some country domains cannot be checked
Not every top-level domain publishes registration dates in a way that can be queried. Several country-code domains limit or withhold this data. [VERIFY: how FirewallDNS handles domains where the registration date is unavailable — allowed, blocked or configurable] Understanding this helps explain why a young domain under certain extensions might not be caught.
Choosing a threshold
A longer threshold catches more fresh malicious domains but also blocks more legitimate new sites. A shorter threshold disrupts users less but leaves a wider window for attackers. Homes and small offices with few external partners can usually run a longer threshold comfortably. Businesses that work with many new suppliers, run frequent marketing campaigns or use many startup tools may prefer a shorter one. The query log shows how often legitimate domains are affected, so you can adjust with real data rather than guesswork.
Domain age is a signal, not a verdict
A new domain is not automatically malicious. Domain age is a strong risk signal because attackers rely on fresh infrastructure, but it is just one signal. That is why blocks by age are easy to review and override, and why it works best alongside malware and phishing lists that identify known threats. Together they cover both the domains we already know are bad and the ones too new to have a reputation.
For organisations, document any allowlisted new domains so that exceptions can be reviewed later and removed when no longer needed.
How attackers adapt
Some attackers register domains in advance and let them age before use, precisely to avoid age-based filters. That costs them time and money, and aged domains often still lack a good reputation. This is another reason to combine domain age with threat lists rather than rely on either alone.
Why we recommend it for every network
Of all the protections a DNS firewall offers, domain age filtering has one of the best ratios of protection to disruption. Very few domains that ordinary users need are only a few days old, while a meaningful share of malicious domains are. Combined with malware and phishing protection, it gives you coverage for both known and not-yet-known threats.
Enable it in the dashboard, watch the query log for the first week, and allowlist anything genuine you see blocked. Most networks then run without further adjustment.