What Is RDAP?

At a glance

RDAP is a modern alternative to WHOIS. It returns structured data and provides more explicit access controls. It can help establish a domain's registration history and current status, although privacy protection may conceal some registrant information.

What are WHOIS and RDAP?

WHOIS is an older request-and-response protocol for querying registration data about domains and Internet number resources. A typical WHOIS service returns unstructured text over TCP port 43. RDAP, the Registration Data Access Protocol, serves a similar purpose using HTTPS, standard HTTP semantics and structured JSON responses. This makes consistent presentation and automated processing across registration authorities easier.

From January 28, 2025, RDAP became the primary way to deliver registration information for generic top-level domains. This does not mean every WHOIS service disappeared on that date. Some country-code top-level domains and specific contractual obligations may differ.

How the two lookup methods work

• A WHOIS client locates the appropriate server, establishes a TCP connection and interprets plain-text results whose format varies between providers.
• An RDAP client can discover the service through IANA bootstrap data, then request a domain, IP network or ASN object over HTTPS.
• RDAP JSON can describe entities, events, status, name servers, notices and source links. It also supports differentiated access to data after authentication.
• Public results may be redacted because of privacy law, registration data policy or the requester's access rights. A missing field does not mean the registration information is false.

What registration data can tell you

• Registration and event dates can help establish how long a domain has been registered and whether it has recently changed.
• The registrar, domain status, expiry date and authoritative name servers provide clues about administration and renewal.
• A status such as clientTransferProhibited normally protects against transfers. States such as clientHold, serverHold or pendingDelete need to be interpreted alongside their definitions and the website's accessibility.
• Privacy services may conceal registrant details. Public data is therefore better suited to checking registration facts than directly proving who operates a website.

Practical use and interpretation

Taken together, registration dates, status, expiry dates and update events can indicate whether a domain is being maintained. A long registration history with a steady update pattern is more consistent with a long-term asset. A recent registrar change or unusual status is a reason to check access and DNS resolution as well.

Privacy policies and access rights affect public registration records. When ownership fields are empty or redacted, the information is unknown. Privacy protection is a common administrative measure and should not itself be treated as a negative signal.

Points to consider

Domain age, expiry dates and status can indicate continuity of maintenance, but cannot establish a website's trustworthiness on their own.

Frequently asked questions

Why might RDAP show less information than older WHOIS results?

RDAP supports differentiated access, so a public request may return only fields permitted for public disclosure. Privacy protection, registration data policy and query permissions all affect the result.

Does domain age prove that a website is trustworthy?

No. Domain age describes registration history only. A domain can change hands, change purpose or be compromised. Its content, infrastructure and current behavior still matter.

Does registration privacy mean a domain has a problem?

No. Privacy protection is common. It means public registrant information cannot be confirmed. The operator's identity should be checked against official pages, certificates and other public information.