Newly Registered Domains vs. Newly Observed Domains vs. Newly Active Domains vs. Newly Observed Hostnames vs. DNS Changes: What Does "New" Mean?

This report describes Farsight Security’s telemetry products for detecting new DNS activity: Newly Observed Domains (NOD), Newly Observed Hostnames (NOH), Newly Active Domains (NAD), and the DNS Changes channel. It contrasts Farsight’s live-observation approach with “newly registered” lists, clarifies the difference between delegation points (base domains) and fully qualified domain names (FQDNs), explains how Newly Active differs from Newly Observed (10-day cache window), and summarizes what qualifies as a DNS Change (new domain, RRname, RRtype, RR, RRset) along with hierarchical relationships and typical volumes (approx. 2.5 new base domains/sec, 20–30 newly active domains/sec, ~900 DNS changes/sec).