sveltemail

← All guides

What WHOIS and RDAP tell you about a domain

How domain registration data works, what is public and what is redacted, and how to read a lookup result.

Every registered domain has a public record behind it: who sold it, when it was created, when it runs out, and which nameservers it uses. For decades the way to read that record was a WHOIS lookup. Today the same question is answered by a newer protocol called RDAP, and most of the personal details that WHOIS used to show are hidden.

A lookup is still worth doing. You just need to know which parts of the answer are facts, which parts are placeholders, and what the status codes mean.

Three parties share every registration

  • The registry runs a top-level domain. There is one registry for .com, one for .org, one for each country code, and so on. It keeps the master database of every name under that ending and publishes the DNS delegation for each one.
  • The registrar is the company you pay. It is accredited to add and change entries in the registry's database on behalf of customers. Some companies that sell domains are resellers acting through a registrar, which is why the registrar in a lookup is sometimes a name you don't recognize.
  • The registrant is the person or organization that holds the name.

What a lookup returns

Registrar

The company responsible for the registration. This is the most useful field when something is wrong with a domain, because the registrar is who can act on an abuse report, and who you contact about a transfer or a dispute.

Dates

There are three. The registration date is when the name was first created in its current run. It does not reset when the name is sold or moved to another registrar, so an old date tells you the name is old, not that the same holder has had it all along. The last-changed date moves whenever anything in the record is updated, including routine renewals. The expiration date is when the current paid term ends.

A domain that has just passed its expiration date is not free for the taking. Registrars and registries apply grace and recovery periods during which the previous holder can still renew, and only after those does the name return to the pool.

Status codes

Status codes describe what may be done to the registration. They come in two families. Codes beginning with client are set by the registrar, usually at the holder's request. Codes beginning with server are set by the registry and are harder to remove.

  • clientTransferProhibited: the domain cannot be moved to another registrar. This is the ordinary “registrar lock” and it is a good sign, not a problem. You switch it off yourself when you want to transfer.
  • clientUpdateProhibited and clientDeleteProhibited: the record cannot be changed or deleted until the lock is lifted. Common on high-value names.
  • serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited: the same locks applied at the registry. Seen on domains with a registry-lock service, and during disputes.
  • clientHold and serverHold: the domain has been taken out of DNS and will not resolve. Typical causes are non-payment, an unverified contact address, or a suspension for abuse.
  • redemptionPeriod and pendingDelete: the registration has lapsed and is on its way to deletion.
  • ok or active: no restrictions are set. Normal, though it means the transfer lock is off.

RDAP writes these with spaces and in lower case, so clientTransferProhibited appears as client transfer prohibited. The meaning is identical.

Nameservers

These are the nameservers the registry delegates the domain to. They tell you who hosts the domain's DNS, which is often a different company from the registrar and from the web host. If a domain's DNS seems to ignore your edits, comparing this list with the provider you are editing at is the first check to make.

Why the contact details are usually missing

WHOIS used to publish the registrant's name, postal address, phone number and email for anyone to read. That made it a ready-made list for spammers and worse, and it sat badly with privacy law. Two things changed the picture.

First, privacy and proxy services. The registrar, or a company working with it, puts its own contact details in the record in place of the customer's. Mail sent to the listed address may be forwarded, but the record itself names the service.

Second, redaction by default. Since European data protection law (GDPR) came into force, registrars and registries of generic top-level domains redact personal data from public output as a matter of course. Fields are blank or say that the data is redacted for privacy. An organization name and a country sometimes remain, because they are less likely to be personal data.

The data still exists. The registrar holds it, and parties with a legal basis, such as law enforcement or a rights holder in a dispute, can request it through the registrar. A public lookup just no longer hands it out. Country-code domains set their own policies, so what you see for a national domain can be more or less than for a .com.

How RDAP differs from port-43 WHOIS

Classic WHOIS is about as simple as a protocol can be. A client opens a TCP connection to port 43, sends the domain name, and receives a block of text. That simplicity caused most of its problems:

  • No standard format. Every registry and registrar laid out its text differently, so software had to carry a parser for each one.
  • No standard way to find the right server. Clients relied on built-in lists and on following referral lines in the text.
  • No encryption and no notion of who is asking. Everyone got the same answer, in clear text, so the only privacy choice was to publish a field or not.
  • No defined character encoding, which made non-English names and addresses unreliable.

RDAP (Registration Data Access Protocol) is the replacement. It runs over HTTPS and returns JSON with defined field names, so the same code can read a response from any registry. A published bootstrap list maps each top-level domain to its RDAP server, so a client knows where to ask. Errors are ordinary HTTP status codes, such as 404 for a name with no record. Because it is plain web technology, a server can also give different levels of detail to different authenticated users. And it covers IP address blocks and network numbers as well as domains.

For generic top-level domains RDAP is now the required service and port-43 WHOIS is being retired.

What the lookup on this site shows

The WHOIS lookup here uses RDAP. Your browser sends the query to a public redirect service, which forwards it to the authoritative RDAP server for the domain. The request does not pass through our server. The result lists the registrar, the registered, last-updated and expiry dates, the registrant organization and country when they are published, the status codes, and the nameservers. Anything the record leaves out is shown as “not disclosed”.

If the tool reports that no registration record was found, the domain may be unregistered. It can also mean the top-level domain has no RDAP service, which is still the case for some country codes, so treat it as a hint and not as proof the name is available.

Practical uses

  • Judging a suspicious link. A domain that claims to be a long-established bank but was registered last week is a strong warning sign. Pair it with a look at the message's email headers.
  • Watching your own renewals. Confirm the expiration date and that the transfer lock is on for every domain you depend on.
  • Preparing a transfer. If the status shows a transfer lock, remove it at the current registrar first or the transfer will be refused.
  • Debugging DNS. Check that the registry's nameserver list matches the provider where you manage records, then inspect the records themselves with the DNS lookup tool.