email.young_domain
The address's domain was registered less than 30 days ago.
What it looks at#
An RDAP lookup of the domain’s registration date, the same lookup domain.rdap makes
(one round trip per request). Fires when the domain is younger than 30 days. Public mailbox
providers (Gmail, Outlook, Proton and the rest of the free-provider list) are skipped before
any lookup.
If the registry has no RDAP service for the TLD, answers without a registration date, or
times out, this check stays silent or lands in checks_skipped. An unknown age is never a
finding.
Why it matters#
Abusive signups lean on freshly registered domains: they are cheap, unlisted, and not yet on any reputation feed. The same is true of every new startup and personal domain, which is why this is low severity.
What to do#
Low severity: a nudge, not an accusation. Weigh it with other signals (disposable
infrastructure, a role account, a hosting-provider IP) rather than blocking on it. /v1/signups
reports the same fact through domain.newly_registered instead, so the two never appear
together.