New Domain Delegations — Daily Domain Monitoring Feed

The domains that appeared in the registries' zone files since yesterday, filtered by keyword or TLD.

Entering the zone is the earliest public signal that a domain went live. It is how you catch a phishing domain the day it is set up, or a competitor's product name before the announcement.

Coverage

1,075 gTLDs, including .com, .net, .org, .info, .biz, .xyz, .top, .shop, .online, .site, .store, .app, .dev and .cloud — 255,631,856 delegated domains, counted from the zone files themselves and refreshed daily.

Coverage is real but it is not evenly spread, and you should know the shape of it before you rely on it: .com alone is 166 million of that total, and while all 1,075 TLDs are included, 481 of them hold fewer than a thousand domains each. Breadth helps you catch something in an obscure TLD; it is not 1,075 equally busy namespaces.

Not covered: .io, .ai, .co, .me, .tv, .cc and every other country-code TLD. These are not available from ICANN's zone file service at any price — they are run outside ICANN's contracts. They are also exactly the TLDs a startup expects, so we say it here rather than letting you find out from an empty result.

What a zone file does not contain, and no run will ever return: the registrant, their email, the registrar, the registration date, the expiry date, or the domain's own A, MX and TXT records. Any tool promising those needs a different source, and at scale that source is prohibited by the agreement behind this data.

Input

Every run is anchored on something you provide. There is no way to ask this Actor for the whole namespace, and that is a design decision rather than a limitation: the data agreement behind it forbids handing over a substantial portion of a zone, so the product simply has no shape that could.

See Example runs below for fifteen worked inputs.

Output

Field	Meaning
domain	The domain that entered the zone
tld	Its top-level domain
observed_on	The date of the snapshot where it first appeared
nameservers	Where it delegates
dns_provider	Who runs the DNS, inferred from the nameserver. 69.1% filled. A hosting fact, not a technology one
parked_for_sale	True when the nameserver belongs to a parking or domain-sale service. 2.0% of domains, exact when it fires

Reading the results

Entering the zone is not the same as being registered, and a substantial share of rows are re-appearances rather than new registrations. Published research puts that share at roughly 20–30%; we cite it as an outside estimate because we have not yet measured it on our own data, and we would rather say so than quote a number we cannot stand behind. A domain registered a year ago that sat on hold and has just had its nameservers restored looks identical to a brand new one from the outside. We do not hide this, and we do not query WHOIS to resolve it.

What is certain is the zone event itself: this domain was not in yesterday's snapshot and is in today's. That is 100% reliable, and for most security and monitoring uses it is the signal you actually wanted.

One snapshot a day. A domain registered and delegated this morning appears in tomorrow's run, not today's. There is no faster path: the registries publish once a day.

dns_provider says who runs the DNS, not what the site is built with. The nameserver identifies the DNS operator for 69% of domains, but a domain on Cloudflare can be running anything. Website platforms are configured with A and CNAME records, which a zone file does not contain, so we cannot see them and we do not guess.

An empty result means nothing matched your filters in that window. Widen the look-back or loosen the keyword. It only costs the $0.00001 start fee.

Example runs

1. Monitor newly delegated AI domains every day

{
  "contains": [
    "ai"
  ],
  "days": 1,
  "maxResults": 500
}

2. Daily alert for new domains containing your brand

{
  "contains": [
    "shopify"
  ],
  "days": 1,
  "maxResults": 200
}

3. Catch new phishing domains targeting a bank

{
  "contains": [
    "santander",
    "santandr"
  ],
  "days": 2,
  "maxResults": 1000
}

4. Monitor all new domains in one small TLD

{
  "tld": [
    "bank"
  ],
  "days": 7,
  "maxResults": 1000
}

5. Track new crypto domain registrations daily

{
  "contains": [
    "wallet",
    "airdrop"
  ],
  "days": 3,
  "maxResults": 2000
}

6. Watch for new domains around a product launch

{
  "contains": [
    "gpt5"
  ],
  "days": 7,
  "maxResults": 500
}

7. Monitor new domains in shop and store TLDs

{
  "tld": [
    "shop",
    "store"
  ],
  "days": 1,
  "maxResults": 5000
}

8. Typosquat watch for new domains after a rebrand

{
  "contains": [
    "northwind"
  ],
  "days": 14,
  "maxResults": 500
}

9. Weekly new domain digest for a security team

{
  "contains": [
    "login",
    "verify",
    "secure"
  ],
  "days": 7,
  "maxResults": 5000
}

10. Track new pharma domains before a trial result

{
  "contains": [
    "ozempic",
    "wegovy"
  ],
  "days": 30,
  "maxResults": 1000
}

11. Find a competitor new domains in dev and app

{
  "contains": [
    "stripe"
  ],
  "tld": [
    "dev",
    "app"
  ],
  "days": 14,
  "maxResults": 500
}

12. Monitor new domains with a city or region keyword

{
  "contains": [
    "barcelona"
  ],
  "days": 30,
  "maxResults": 1000
}

13. Watch for new domains around a merger rumour

{
  "contains": [
    "figma",
    "adobe"
  ],
  "days": 7,
  "maxResults": 200
}

14. Daily feed of all new domains in one busy TLD

{
  "tld": [
    "xyz"
  ],
  "days": 1,
  "maxResults": 5000
}

15. Quarterly report of new fintech domains

{
  "contains": [
    "fintech"
  ],
  "days": 90,
  "maxResults": 5000
}

Pricing

$0.00001 to start, then $0.002 per new delegation — about $2 per 1,000 results.

Designed to be scheduled. A daily run with a tight keyword filter usually returns a handful of rows and costs a fraction of a cent, and that is the intended shape: cheap to watch every day, and you only pay for volume on the days something actually happens.

Data source

🛡️ Sourced from the Registry Operators' own zone files, obtained through ICANN's Centralized Zone Data Service under agreement with those operators. ICANN does not endorse, sponsor or review this Actor.

Built for security research, brand protection and domain analytics. The access behind this data was granted one TLD at a time, which is why the coverage is what it is.

Support

Found a domain the Actor missed, or a row that looks wrong? Open an issue on the Actor page with the exact input you used. Zone data is refreshed once a day, so a domain delegated this morning may not appear until tomorrow's snapshot.