Unfortunately the malicious domain could be registered for days or weeks before being used in a campaign. The time that the domain is in stealth mode doesn't i

Unfortunately the malicious domain could be registered for days or weeks before being used in a campaign. The time that the domain is in stealth mode doesn't incur any extra cost to the spammer, and nor does it give any clues to the blacklisters that the domain is about to host something malicious. If there were some way of bootstrapping new domains with some sort of positive trust signal (e.g. links from domains that have been in use for a long time?) then it might be possible to preemptively blacklist domains, as you say, but there are potential anti-trust issues with any such system that dissuades people from accessing the websites of new companies, for example.