Ability to filter based on domain registration date

[agnosticlines]

Hey there,

I love dnscrypt-proxy and use it daily, I noticed when evaluating a solution for some friends that NextDNS has an option to block newly registered domains (domains registered within the last 30 days) which based on a lot of threat reports, would block a lot of new C2/malware infrastructure.

It’d be awesome if we could optionally filter on newly registered domains and block them, or log them, there’s a few issues with it, such as how we’d get the date, how we’d cache the domain registration date, when would we invalidate that block, etc.

I think it’d be a big net positive for security though, they also block typosquatting attempts which is quite cool, but that can all be generated statically so isn’t a big deal.

[dapphp]

If you can find or download a regularly updated "newly registered domains" list, import those domains into the blocklist and you have what you're asking for. It would be too slow to WHOIS a domain on resolution and DNSCrypt proxy is not the place for this. NextDNS probably has lists of new domains that they filter.

[agnosticlines]

Yeah so that’s what I’m doing currently but it does miss a lot of things, and NextDNS so far has missed none, so I just assumed they’re resolving and caching it, but thanks for replying. :-)

[agnosticlines]

While I have you here do you think there’s any value in adding support for blocking typosquatted domains, or is that something else you’d recommend just doing externally with a list.

[jedisct1]

Such a function would be so much better implemented as a browser extension.

"You're visiting this website for the first time, would you like to continue? (or some indicator in the navigation bar)"