MDI Spam Sheriff (for GravityForms)

Description

Every Email-type field on every enabled Gravity Forms form is checked on submit: the domain’s registration date is looked up via RDAP (the free, keyless, standardized successor to WHOIS). If it’s younger than your configured threshold (default 160 days), the submission is blocked with a configurable message.

If the RDAP lookup itself is inconclusive (timeout, unsupported TLD), the plugin falls back to a basic MX/A/AAAA record check – if the domain has no mail-capable DNS at all, it’s blocked; otherwise it’s allowed through rather than blocking on missing information.

External services

This plugin performs domain age verification by querying RDAP (Registration Data Access Protocol) services, the standardized successor to WHOIS.

1. IANA RDAP Bootstrap Registry
   This plugin fetches a public bootstrap file from IANA to determine which RDAP server is authoritative for a given domain’s TLD. This happens automatically whenever a domain needs to be looked up and no cached bootstrap data exists (cached for 7 days).
   Data sent: none beyond the standard HTTP request to fetch the static file (no user data is sent).
   Terms of Service: https://www.icann.org/en/data-protection/terms-of-service
   Privacy Policy: https://www.icann.org/en/data-protection/privacy-policy

2. RDAP registry servers (varies by TLD)
   When a user submits an email address, this plugin extracts the domain portion and sends it to the RDAP server responsible for that domain’s TLD, in order to retrieve the domain’s registration date and estimate its age. This is used as a fraud/spam signal in form submissions.
   Data sent: only the domain name (e.g. “example.com”) — never the full email address or local part — and only when a domain hasn’t been checked in the last 30 days (cached).
   Service operator: varies by TLD (e.g. Verisign for .com/.net, PIR for .org, etc.), as determined by IANA’s bootstrap registry.
   RDAP operators: https://www.iana.org/assignments/rdap-dns/rdap-dns.xhtml, and most operate under registry-standard terms similar to Verisign’s: https://www.verisign.com/en_US/domain-names/register-domain-name/rdap/index.xhtml