Free Domain Age Checker — how old is any domain? Exact date, days, buckets & Wayback history.

A single lookup surfaces six independent age signals — registration event, precise age, expiry runway, lock posture, DNSSEC state, and Wayback Machine timeline — then adds an AI interpretation layer. Every field comes from the authoritative registry or the Internet Archive; nothing is scraped or cached beyond the standard 24h.

You cannot fake old. Every other signal on a domain — SSL, DMARC, redirect chains, even backlinks — can be provisioned in an afternoon. Registration date is the one field an attacker cannot backdate. That's why every serious threat-intel pipeline weights age heavily:

• Roughly 74% of phishing lives on sub-90-day domains. Threat teams (Cisco Talos, Netcraft, APWG) publish quarterly data showing the overwhelming majority of active phishing infrastructure sits on domains registered in the last quarter. Blocking under-90-day domains alone catches most opportunistic campaigns.
• Google's ranking systems weight the trust accrued with age, not age itself. John Mueller has said publicly that domain age alone isn't a Google ranking factor. What actually ranks is the topical authority, backlink profile, and content history that compound while a domain is live — which correlates strongly with, but is not caused by, age.
• Registration date ≠ site launch date. The Wayback Machine's first snapshot can be years after registration. Domain squatters register early and only build later; new operators sometimes buy old domains to inherit their trust. Both timelines matter — this tool surfaces them side by side.
• Expiring domains are a hijack vector. The 30 days before and after expiration are when transfer-locks weaken and social-engineering attempts peak. Days-until-expiry is not just a renewal reminder — it's an active-window indicator.

A single request fans out to the authoritative registry, ICANN's RDAP endpoint, and the Internet Archive. Total wall-clock is bounded by the slowest single call — typically under 800ms — and returns a normalised view.

• Stage 1 — Resolve the authoritative RDAP endpoint IANA's bootstrap registry maps each TLD to its authoritative RDAP server (`rdap.verisign.com` for `.com`, `rdap.publicinterestregistry.org` for `.org`, etc.). We query the registry directly, not a middleman.
• Stage 2 — Fetch registration events RDAP returns structured JSON — creation, last-update, transfer, and expiration events, each with an ISO 8601 timestamp. For the ~5% of TLDs that don't yet support RDAP, we fall back to port-43 WHOIS and normalise.
• Stage 3 — Compute age + bucket Age in years / months / days, total-day count, and one of seven pre-classified buckets. Bucket boundaries are calibrated against phishing / trust research — they're not arbitrary.
• Stage 4 — Query the Wayback Machine The Internet Archive's CDX API returns the first observed snapshot for the domain. Snapshot count is a proxy for how heavily the site has been indexed by third parties — a strong sign that the domain has been operationally live, not just registered.
• Stage 5 — AI interpretation Prism reads the composite record and emits a short human-readable paragraph. The prompt is deliberately conservative: it points out red flags, not verdicts.

Seven buckets calibrated against phishing / trust research. Boundaries are conservative — a domain crossing a threshold is a soft signal, not a verdict.

• Fresh · <30 days Registered within the last month. The single strongest phishing indicator in isolation. Almost never a legitimate business address — most orgs plan launches 60–90 days out. Proceed with caution.
• Very New · 30–89 days Still inside the sub-90-day risk band. Legitimate for pre-launch marketing sites and greenfield startups; overrepresented in short-lived phishing kits. Weight other signals heavily.
• New · 90 days – 1 year Past the acute-risk window. Trust starts accumulating from here — SSL renewals, backlinks, and content history begin to matter. Typical for one-year-old businesses.
• Young · 1–3 years Domain is settling. Reputation profile is measurable, but still short of the compounding trust older domains inherit.
• Established · 3–7 years Old enough that the ‘shell’ argument no longer applies. Nearly all sub-7-year phishing domains have already been taken down; the survivors are usually legitimate.
• Aged · 7–15 years Long-lived. Backlink profile and content history are deep. Google's ranking systems reward what has accumulated here.
• Ancient · 15+ years Industry veteran. `microsoft.com` (registered 1991) sits here alongside most Fortune-1000 domains and the majority of well-established open-source project sites.

The 'domain age is a ranking factor' claim is misunderstood on both sides. Here's the calibrated read, aligned with public statements from Google's Search Advocates and independent SEO studies:

• Age alone is not a Google ranking factor. John Mueller has said this on record multiple times. The algorithm does not multiply a score by years-registered. There is no 'age bonus'.
• What DOES rank correlates with age. Topical authority, backlink profile, indexed page count, historical crawl signal — all of these compound over time. An older domain has had longer to accumulate them, so on average older domains rank better. But that's a correlation, not a cause.
• The 'sandbox' — real, but not what people think. Very new domains show volatile ranking until Google's systems have enough signal to trust them. This is usually attributed to weeks-to-months of variance, not years. Content quality shortens the window; low quality lengthens it.
• Buying an aged domain: sometimes worth it, sometimes not. The trust accrued to a domain travels with it AS LONG AS the topic remains coherent. Repurposing a 15-year-old plumbing domain into a SaaS site typically resets most of the accumulated equity — the backlinks stop matching the new content.
• Newer competitor outranking you? It's rarely age. Nearly always it's better content, better internal linking, better technical SEO, or a stronger backlink profile. Age is the last variable to blame — check the first four.

Registration date is when the domain was born. Wayback's first snapshot is when the site actually went live. The gap between the two is often the most interesting number on the report.

• Gap of 0–7 days → live launch Domain registered and site published in the same week. Common for legitimate product launches and fast-turn phishing kits — the age bucket disambiguates which.
• Gap of 30–180 days → planned launch Registered ahead of time, then launched. Typical of well-organised businesses. Also the fingerprint of some 'aged sandbox exit' SEO plays.
• Gap of 1+ years → dormant → activated Domain sat undeveloped for a long time before coming online. Could be a squatter selling into a use-case, an acquirer repurposing an aged domain, or a legitimate long-term registration finally being used.
• No Wayback captures at all Either genuinely brand-new (registration date will confirm) or the site actively blocks Internet Archive via `robots.txt`. Blocked archives on a domain that claims to be old is itself a signal.

Five patterns we see most often across free and API users:

Every field on this page is available as JSON via the DomainScan API. Rate-limited for anonymous use; API keys available for bulk / continuous monitoring.

curl 'https://api.domainscan.in/api/v1/domain/age?domain=cloudflare.com'

const res = await fetch(
  'https://api.domainscan.in/api/v1/domain/age?domain=cloudflare.com'
);
const {data} = await res.json();

console.log(data.creationDate);          // '2009-02-17T22:07:54Z'
console.log(data.age);                    // {years: 16, months: 4, days: 28}
console.log(data.totalDaysRegistered);   // 5966
console.log(data.bucket);                 // {key: 'ancient', label: 'Ancient'}
console.log(data.daysToExpiry);           // 2681
console.log(data.wayback.firstSnapshot);  // '2000-06-15'

{
  "domain":              "cloudflare.com",
  "creationDate":        "ISO 8601",
  "updatedDate":         "ISO 8601 | null",
  "expiryDate":          "ISO 8601",
  "age": {
    "years":             "number",
    "months":            "number",
    "days":              "number"
  },
  "totalDaysRegistered": "number",
  "daysToExpiry":        "number",
  "bucket": {
    "key":               "fresh | very-new | new | young | established | aged | ancient",
    "label":             "string",
    "tone":              "red | orange | amber | yellow | emerald | teal | blue",
    "headline":          "string"
  },
  "registrar": {
    "name":              "string",
    "ianaId":            "string",
    "abuseEmail":        "string",
    "country":           "string"
  },
  "status":              ["EPP status code"],
  "dnssec":              "signed | unsigned | NA",
  "wayback": {
    "firstSnapshot":     "YYYY-MM-DD | null",
    "totalSnapshots":    "number",
    "lastSnapshot":      "YYYY-MM-DD | null"
  },
  "AiAnalysis": {
    "summary":           "string",
    "redFlags":          ["string"]
  }
}

• Is domain age a Google ranking factor? Not directly. Google's own Search Advocates have repeatedly confirmed there is no age multiplier in the ranking algorithm. What ranks is topical authority, backlink profile, and content history — all of which correlate with age but are not caused by it. A 6-month-old site with excellent content and links will regularly outrank a 15-year-old dormant domain.
• How accurate is the registration date? Exact to the second — RDAP returns registry-authoritative timestamps. The one edge case: a small number of TLDs (`.io` for a period, some ccTLDs) went through registry migrations that rewrote historical creation dates. We surface those cases with a note in the AI analysis when detected.
• Why does my creation date look different from other tools? Some tools display the WHOIS record's local date. We display UTC to keep every domain in the same timezone. For domains near a day boundary, the two can differ by 24h.
• Wayback says my site is old but registration says new — which is right? Both. The Wayback Machine indexes CONTENT, not domain events. If you took over an existing domain from a previous owner, Wayback's timeline reflects THAT owner's history. Registration date is the domain's identity anchor.
• How do I tell if a domain is worth buying based on age? Three checks: (1) exact registration date via WHOIS, (2) Wayback timeline to confirm the site was actually developed, (3) topical coherence between historical content and your planned use. A 20-year-old domain with matching-topic historical content is a genuine SEO asset. A 20-year-old domain that was a parking page for 18 of those years is mostly a URL.
• Is age a good phishing filter? Excellent for high-volume filtering, weak for targeted attacks. Blocking sub-90-day domains at the perimeter catches most opportunistic phishing; sophisticated attackers pre-register domains months ahead. Pair with reverse IP, blacklist status, and DMARC alignment for defense-in-depth.
• How is this different from a WHOIS lookup? This tool distills WHOIS + RDAP into an age-focused view: precise duration, bucket, expiry runway, Wayback timeline, plain-English trust framing. A raw WHOIS/RDAP lookup gives you everything the registry knows; this gives you only the age-related answer. If you need registrar contact + status codes + DNSSEC keys, run `/domain/lookup` instead.

Age is one of many signals. Drill deeper on any of these: