WHOIS and RDAP answer the same basic question: who is responsible for this domain, and what does the registry know about it? WHOIS is the original, text-based way of asking. RDAP is its standardized successor. If you have ever wondered why lookups now return tidy fields instead of a wall of text, or why a WHOIS server you used to rely on has gone quiet, this guide explains the shift.
WHOIS in brief
WHOIS is one of the oldest protocols still in use on the internet. Its current specification, RFC 3912, is only a few pages long, because the protocol does very little:
- The client opens a TCP connection to a server on port 43.
- It sends a line of text, typically a domain name.
- The server replies with text and closes the connection.
That simplicity was a strength in the early internet and a weakness later. The RFC does not define what the reply contains or how it is laid out. Each registry and registrar chose its own labels, field order, date formats and line wrapping. There is no standard way to learn which server is authoritative for a TLD, so clients relied on hard-coded lists and referrals embedded in the text. Character encoding for internationalized names was never specified, and the protocol has no built-in encryption or authentication.
A typical WHOIS reply looks like this, and the next registry's reply may look quite different:
Domain Name: EXAMPLE.COM
Registrar: Example Registrar, Inc.
Creation Date: 2015-03-10T14:22:05Z
Registry Expiry Date: 2027-03-10T14:22:05Z
Name Server: NS1.EXAMPLE.NET
Domain Status: clientTransferProhibited
RDAP in brief
RDAP, the Registration Data Access Protocol, was developed at the IETF to replace WHOIS for registration data. It uses HTTPS for transport, JSON for responses and a defined set of URL patterns for queries. The core specifications are RFC 9082 (queries), RFC 9083 (responses) and RFC 9224 (finding the right server), with RFC 9537 describing how redacted fields are marked. For a full walkthrough, see What is RDAP?.
Side-by-side comparison
| Aspect | WHOIS | RDAP |
|---|---|---|
| Transport | Plain TCP, port 43 | HTTPS |
| Response format | Free-form text, varies by server | Structured JSON with defined fields |
| Finding the server | Hard-coded lists and text referrals | IANA bootstrap registry (RFC 9224) |
| Encryption | None | TLS, as with any HTTPS request |
| Internationalized names | Not specified | Supported, with Unicode and ASCII forms |
| Redacted data | Ad hoc placeholder text | Machine-readable redaction markers (RFC 9537) |
| Access levels | Everyone sees the same output | Can support authenticated, tiered access |
| Errors | Often just text such as "No match" | Standard HTTP status codes, such as 404 |
Why the change happened
Several pressures pushed the industry toward RDAP:
- Automation. Security teams, registrars and monitoring tools need to process registration data at scale. Parsing hundreds of text formats is error-prone and breaks whenever a server changes its layout.
- Privacy law. Once regulations such as the GDPR required personal data to be withheld, registries needed a clear way to say "this field exists but is hidden." RDAP can express that explicitly, and can in principle show more to authorized requesters than to the general public.
- Security. Moving lookups onto HTTPS brings encryption and the ability to verify which server you are talking to.
- Internationalization. Domain names and contact data increasingly use non-Latin scripts, which WHOIS never handled consistently.
Where things stand now
For generic TLDs such as .com, .org and the newer gTLDs, ICANN's contracted parties moved to RDAP as the definitive source of registration data, with the obligation to provide WHOIS ending in early 2025. Some registries and registrars continue to run WHOIS voluntarily, but it is no longer the service of record, and some port 43 servers have been switched off.
Country-code TLDs are a different story. ccTLD operators are not bound by ICANN's gTLD contracts and set their own policies. Many now offer RDAP and are listed in IANA's bootstrap file. Others still provide only WHOIS, a web search form or no public lookup at all. When a lookup tool reports that a ccTLD has no RDAP service, that reflects the registry's choice, not a fault in the domain.
Practical differences you will notice
Cleaner dates and statuses
RDAP reports dates as events with fixed names, such as registration, expiration and last changed, in a standard timestamp format. Status values come from a defined list. That makes calculations like domain age or days until expiry far more reliable than scraping text.
Clearer "not found" answers
A WHOIS server might say "No match," "NOT FOUND" or something else entirely. RDAP servers generally return HTTP 404 for names they have no record of. Neither answer proves a name is available to register: registries can reserve, block or withhold names that do not appear in lookups, and only a registrar check at the time of purchase is definitive.
Registry and registrar data
Under the old "thin" model for some gTLDs, the registry held only basic data and the registrar's WHOIS held the contacts. RDAP responses can link from the registry record to the registrar's RDAP service, so a client can follow the chain in a consistent way rather than parsing referral lines.
Domain age
Domain age is usually derived from the registration date. Keep in mind that the date reflects the current registration. A name that expired, was deleted and was later registered again will show the newer date. A transfer between registrars, by contrast, normally keeps the original registration date.
Should you still use WHOIS?
For gTLDs, RDAP is the better and more authoritative choice. WHOIS can still be useful for ccTLDs that have not adopted RDAP, and for historical context. If you maintain scripts that parse WHOIS text, moving them to RDAP will usually make them simpler and much more robust.
Check it yourself
- RDAP Lookup finds the correct RDAP server through the IANA bootstrap and shows the structured result, including redaction notices.
- Domain Age calculates how long the current registration has existed, based on the RDAP registration event.