Does DNS Posture Predict Subsequent Public-Feed Listing?
In July we told SOC teams to gate new-domain watchlists on activation: a live mail server, not a parking nameserver. We tested that advice on 29.2 million registered domains our Newly Observed Hostnames feed first saw between May and July 2026, against every later OpenPhish and URLhaus listing. A live MX did not predict a listing; parking predicted its absence; self-hosted mail was the one mail signal that did; and 84% of listings came within days, before any monthly crawl looked. Our feed saw 58.5% of OpenPhish's registered phishing domains by listing day, but only 1.3% of its free-hosting sites. For SOC teams, threat-intelligence analysts, and brand-protection researchers.