A registration feed tells you a name now exists. It is the earliest possible signal, and it is also the least informative, because most newly registered domains are never used for anything.
Where the data comes from
| Source | Coverage | Latency |
|---|---|---|
| Registry zone files | Complete for the TLDs that publish them | Usually once a day |
| Commercial NRD feeds | Broad, assembled from zone files and other sources | Hours to a day |
| RDAP polling of candidate names | Only names you thought to ask about | Immediate, for that name |
Zone files are the foundation of every commercial feed, which is why they share the same cadence: a domain registered at nine in the morning may not appear until the next publication.
What a feed does not see
- TLDs that do not publish a zone file. Many ccTLDs do not, so coverage has holes that vary by country.
- Subdomains. No registration event exists for them, which is why subdomain-shaped deception is invisible here.
- Domains registered before you started watching. A feed reports changes, so an aged domain being activated produces nothing.
- Intent. The overwhelming majority of new registrations are ordinary.
Using it well
Match new registrations against the WATCHLIST, not against a substring of the brand. Then: do not alert. Add to a queue. A registration on its own is a low-priority finding. Promote it when something else happens: it resolves a certificate is issued for it an MX appears
This is the channel that produces the most volume and the fewest actionable findings. It earns its place by establishing a baseline — so that when a domain in the queue obtains a certificate three weeks later, you already know when it was registered.
Registration is a watchlist event, not an alert
Paging someone for a registration means paging them for the thousands of ordinary registrations that resemble a brand. The certificate and the MX are the alerts; the registration is the context that makes them readable.