How to find newly registered domains
Thousands of domain names are created every hour across hundreds of endings. There is no single public list of them, so finding new domains means combining a few sources, each with its own gaps.
The short answer
- Compare daily zone files for each top-level domain and keep the names that are new.
- Confirm creation dates with registration data lookups where needed.
- Add early signals from public certificate logs and DNS first-seen data.
- Label every new name with a category and recheck it after a week and a month.
The main sources compared
Each source answers a slightly different question. Zone files say a name is delegated, registration data says when it was created, and certificate or DNS data says someone is starting to use it.
| Source | What it tells you | Coverage | Main limit |
|---|---|---|---|
| Zone file comparison | Names delegated today that were not delegated yesterday. | Strong for generic endings | Misses names without nameservers and most country-code endings. |
| Registration data (RDAP or WHOIS) | The creation date and registrar of a known name. | Good per name | A lookup tool, not a discovery tool. Rate limits apply. |
| Certificate transparency logs | Hostnames on newly issued public TLS certificates. | Wide, all endings | Only names that get a certificate. Lots of subdomain noise. |
| DNS first-seen data | Names queried for the first time on a resolver or network. | Depends on the vantage point | Shows newly observed names, which can be old domains. |
| Registry publications | Lists or statistics some registries release. | Patchy | Different rules, formats and delays per registry. |
| Categorized feeds | New names with a category, parked flag and rechecks. | Broad, ready to use | A licence instead of a build project. |
Method 1: compare zone files day by day
A zone file lists every delegated domain under a top-level domain, with the nameservers it points to. If you keep yesterday's copy, the difference with today's copy shows names that were added and removed.
Getting access
For most generic endings, ICANN runs the Centralized Zone Data Service, where you request zone files from participating registries. Each registry approves access under its own terms, and approvals expire and need renewing.
Handling the size
Large endings produce zone files with many millions of lines. Plan for compressed storage, sorted files and a diff that runs in minutes rather than hours.
What you will miss
Names registered without nameservers never appear in the zone. Names created and deleted between two snapshots are also invisible.
Country-code endings
Most country-code registries do not share full zone files. The few that offer data do so under their own rules, so coverage of national endings stays partial.
Tip: a name that appears in the zone is not always newly registered. A domain can reappear after nameservers are fixed, so confirm the creation date for names that matter.
Method 2: confirm with registration data
Registration data services answer one question well: when was this specific domain created, and through which registrar. For generic endings this data is now served mainly through RDAP, the structured successor to WHOIS.
Good for
- Confirming the creation date of a name found elsewhere.
- Seeing the registrar and status codes of a domain.
- Telling a fresh registration from an old name that just reappeared.
- Checking expiry and transfer dates during investigations.
Not good for
- Discovering new names, because you must already know the name.
- Bulk use, because services limit how fast you can query.
- Owner details, which are mostly redacted for privacy.
- Consistent coverage of country-code endings, which vary widely.
Method 3 and 4: certificate logs and DNS first sightings
Two more sources show when a new name starts being used. They catch some names that zone files miss, especially under country-code endings, and they add timing signals.
Certificate transparency
Publicly trusted TLS certificates are recorded in open logs. A new site often gets a certificate within hours, so its hostnames show up early.
Cleaning certificate data
Logs contain many subdomains and renewals. Reduce each hostname to its registered domain and keep only names not seen before.
DNS first-seen
A resolver can record the first time any name is queried. This shows names that are new to your network, whatever their age.
Combining both
Use certificate and DNS data as early hints, then confirm creation dates before you treat a name as newly registered.
Newly registered versus newly observed
| Question | Newly registered domain | Newly observed domain |
|---|---|---|
| Definition | Created at the registry recently. | Seen for the first time on a given network or resolver. |
| Typical source | Zone files and registration data. | Resolver logs and passive DNS. |
| Can it be an old domain? | No, by definition. | Yes, often. It may be old but new to you. |
| Best used for | Brand monitoring, fraud and policy windows. | Spotting unusual destinations in your own traffic. |
How new is "new"?
Teams use different windows depending on the decision. Keep the creation date on every record so you can change the window without rebuilding anything.
Building your own pipeline, step by step
If you want to collect new domains yourself, this is the usual shape. It is a real engineering project, with daily jobs, storage and access renewals to look after.
Request zone data
Apply for zone file access for the endings you care about and track each approval and its expiry date.
Download on a schedule
Fetch each zone once a day, keep yesterday's copy, and log failures so a missed day is visible.
Diff and normalize
Sort, compare and lower-case names. Store additions and removals with the date you saw them.
Add extra signals
Merge certificate log and DNS first-seen names, and confirm creation dates for the names you plan to act on.
Work out what each site is
A bare name tells you little. Add a category, a parked flag, language and country so the list can drive decisions.
Look again later
Many new sites are empty on day one. Check again after a week and a month, because purpose often appears later.
Feed the tools that use it
Export daily files to DNS filters, email security, brand monitoring and data warehouses in the formats they accept.
What a new domain looks like in its first month
Most new names change a lot in their first weeks. That is why one look on the day of registration is rarely enough to decide what a domain is.
Day one: often empty
No website, a hosting placeholder or a registrar parking page. Category is often missing at this stage.
First week: under construction
Some sites go live with a template or coming soon page. Others stay parked or are listed for sale.
First month: purpose appears
Real businesses publish content, shops add products, and campaign domains show what they were built for.
Short lived names
Some names are used for a few days and dropped. Fast capture and labelling matter most for these.
Our approach: about 300,000 newly registered domains are categorized every day and delivered as daily delta files. Each is checked again after a week and after a month, then joins the monthly refresh of the full database of over 120 million domains.
Who needs newly registered domains, and why
The same daily list serves very different goals. Knowing your goal tells you which fields to add and how wide the time window should be.
Security teams
Restrict or watch fresh names, which are popular for phishing and malware because they have no reputation yet.
Brand protection
Catch lookalikes of brand names early. See our guide to lookalike and typosquat domain detection.
Fraud and payments
Flag merchant applications or transactions that point to a site registered days ago.
Sales and marketing
Spot new businesses as they launch, filtered by category and country.
Advertising quality
Review new sites before they enter allow lists, and keep parked names out of inventory.
Researchers
Measure how many new sites appear per category and country over time.
Common mistakes
These come up again and again when teams first build a new domain workflow. Each one is easy to avoid once you know about it.
| Mistake | What goes wrong | Better approach |
|---|---|---|
| Blocking all new names forever | Legitimate new customers and partners are blocked too. | Use a time window and release names that gain an ordinary category. |
| Treating newly observed as new | Old domains get flagged just because they are new to you. | Confirm creation dates before applying new domain rules. |
| Looking only once | Empty names on day one turn into shops or scams later. | Recheck after a week and a month. |
| Ignoring country-code endings | Local scams and brand abuse go unnoticed. | Add certificate and DNS signals, or a broader feed. |
| Keeping only names | Analysts must open every site to learn what it is. | Store category, parked flag, language and country with each name. |
| No monitoring of the pipeline | Expired zone access silently stops data for an ending. | Alert on missing days and falling counts per ending. |
Fields worth storing for every new domain
A name and a date are the minimum. The fields below make the same daily list useful to security, brand, fraud and sales teams without extra lookups later.
| Field | Example | Why keep it |
|---|---|---|
| Registered domain | greenmile.example | The key that joins every other data set. |
| Top-level domain | .example | Lets you compare endings and spot unusual spikes. |
| First seen date | 2026-10-18 | Drives time windows for policy and alerts. |
| Source of discovery | Zone, certificate or DNS | Explains gaps and helps judge confidence. |
| Primary category | Business | Tells you what the site is without opening it. |
| Parked flag | Yes or no | Removes placeholder names from most lists. |
| Language and country | English, United Kingdom | Targets the markets you care about. |
| Last recheck date | Day 7 or day 30 | Shows whether the label reflects the site today. |
Quality checks on a new domain list
Daily data fails quietly. A few simple checks catch most problems before they reach the tools and people who rely on the list.
Daily volume per ending
Track counts for each top-level domain. A sudden drop to zero usually means a failed download or expired access, not a quiet day.
Duplicates
The same name can arrive from zone, certificate and DNS sources. Merge them on the registered domain and keep the earliest date.
Date sanity
Spot check creation dates on a small sample each week, so old names do not slip in as new.
Label coverage
Measure the share of names with a category at day 0, day 7 and day 30. It should rise as sites add content.
Terms of use: zone file access comes with conditions set by each registry, and registration data has privacy rules. Read the terms before you store, share or resell anything built from these sources.
Building it yourself versus licensing a feed
Both paths work. The choice usually comes down to how much engineering time you want to spend on collection, compared with using the data.
Build it yourself
- Full control over sources and timing.
- Zone access requests and renewals for every ending.
- Storage, daily jobs and monitoring to maintain.
- Categorization, parked detection and rechecks still to solve.
License a categorized feed
- New names arrive with categories and a parked flag.
- Rechecks after a week and a month are already done.
- Daily files that run inside your own systems.
- Your team spends its time on decisions, not collection.
For details of what a daily categorized feed contains, see the related page on our newly registered domains list. For file layouts, read domain list download formats.
Turning new names into decisions
Once you have the names, a few simple rules make them useful. These examples assume each new domain carries a category from our taxonomy.
| Category on the new domain | Security view | Business view |
|---|---|---|
| Malware / Phishing / Suspicious | Block at once. | Exclude from every list. |
| Parked / For-Sale Domains | Watch for a change. | Exclude from leads and ad inventory. More in parked domain detection. |
| No category yet | Warn or isolate during the window. | Wait for the week one recheck. |
| Shopping, Business, Food & Drink and similar | Release after the window. | Possible new business lead. |
| Financial Services or Cryptocurrency | Review if the name resembles a known brand. | Check before onboarding as a merchant. |
Quick glossary
The terms in this guide, in plain words. They help when you explain a new domain workflow to colleagues in legal, fraud or procurement.
Zone file
The registry's list of delegated domains under one ending, with their nameservers.
Delegation
The step that points a domain to nameservers so it can resolve on the internet.
RDAP
Registration Data Access Protocol, the structured way to look up registration details for a domain.
Certificate transparency
Public, append-only logs of issued TLS certificates that anyone can read.
Registered domain
The part of a hostname bought from a registrar, such as example.com in shop.example.com.
Delta file
A daily file with only new and changed domains, so systems stay current without full reloads.
Frequently asked questions
How do I find newly registered domains?
Compare today's zone file of a top-level domain with yesterday's and keep the new names. Registration data confirms creation dates, and certificate logs and DNS first-seen data add early signals.
Where can I get zone files for generic top-level domains?
For most generic endings, ICANN runs the Centralized Zone Data Service. Each registry approves requests under its own terms, and access has to be renewed.
Can I get newly registered domains for country-code endings?
It is harder. Most country-code registries do not publish full zone files, so certificate logs and DNS data only fill part of the gap.
What is the difference between newly registered and newly observed domains?
A newly registered domain was created recently at a registry. A newly observed domain is one your network has not seen before, which can include old domains.
How new is a newly registered domain?
There is no single rule. Policies often use 7, 30 or 90 days after registration, so keep the date and choose the window per decision.
Is a list of new domain names enough?
Usually not, so most teams add a category, a parked flag and later rechecks, because many new sites add content days or weeks after registration. See domain categorization for cybersecurity for security uses.
Skip the collection work
About 300,000 new domains categorized every day, rechecked after a week and a month, on top of over 120 million categorized domains. Delivered as files that run in your own systems.