What is WHOIS and how does RDAP work?

WHOIS is the traditional way to look up registration information for a domain or an Internet number resource. For generic top-level domains, RDAP is now the primary modern source of registration data. A result may show a registrar, dates, status codes and nameservers, while personal details about the registrant are often withheld.

WHOIS and RDAP: what changed?

Classic WHOIS usually sends a query to TCP port 43 and returns plain text whose layout varies between registries. RDAP uses HTTPS and structured responses. It supports internationalised names, service discovery and different levels of access. Since 28 January 2025, ICANN has treated RDAP as the definitive source for generic top-level domain registration data; some registries may still offer WHOIS. Country-code domains have their own policies, so do not apply a gTLD rule to every domain. The ICANN announcement explains the change.

What does a lookup actually tell you?

For a domain, you may see its registrar, registration and expiry dates, status, and delegated nameservers. The available fields depend on the registry and the access level. A missing name, postal address or telephone number does not mean that the domain has no owner: publication of personal data is restricted by registration-data rules. An expiry date also does not promise that a name will immediately become available to register. For an IP address, a regional Internet registry record identifies the resource holder or network operator, not necessarily the individual using an address at a particular moment.

A practical diagnostic example

Suppose a website stops resolving shortly after a domain renewal. Compare its registration date, status codes and nameservers with the registrar’s own account. A hold status may explain why the domain is not delegated, but the registrar must confirm the reason and the remedy. Allow for database update delays. Registration data cannot tell you whether the web server is healthy. If an IP address appears in a security alert, record the address and exact time with time zone; shared addresses, proxies and dynamic allocation make an address alone insufficient to identify a user.

Privacy and limits

ICANN’s Registration Data Policy sets out rules for redacting fields in public results. Access to non-public information follows a separate legitimate request process. A company may register a domain while another company hosts the site, and an operator may allocate its IP space to customers. Use the lookup as one technical clue, check the source and last update, and seek registrar documents when you need proof of control.