RDAP, the Registration Data Access Protocol, is the successor to WHOIS. It serves registration data about domains and IP addresses over HTTP, with structured responses in a standard format. For domain owners it is a handy way to check your own status codes, nameservers and expiry before someone else does.
WHOIS and RDAP in plain terms
WHOIS is an old text protocol. Output formats differ between registries, which makes it hard for software to parse. RFC 7480 describes RDAP as a successor protocol to the very old WHOIS protocol, and defines how it runs over HTTP. RFC 7482 defines uniform URL patterns for queries to both Regional Internet Registries and domain name registries, using web access patterns of the RESTful kind.
ICANN's agreements with gTLD registry operators and accredited registrars also refer to RDAP service requirements, alongside WHOIS, under the heading of registration data directory services. Which fields appear for a domain depends on the registry, the registrar and the privacy rules in force, so do not assume every record shows an owner name.
| WHOIS | RDAP | |
|---|---|---|
| Transport | Its own text protocol | HTTP |
| Output | Free text, varies by operator | Structured, built for software |
| Query format | Server specific | Standard URL patterns |
| Typical use | A person reads the text | Scripts and tools parse the result |
What a domain lookup can tell you
Use a lookup on a domain you own and read:
- Status codes. Locks such as clientTransferProhibited, and stages such as redemptionPeriod. See registry locks and what happens when a domain expires.
- Nameservers. They should match what you expect. An unexpected change is an alarm.
- Registrar. Confirms where the domain lives.
- Dates. Creation, last change and expiry.
Steps: a monthly domain check
- List every domain in your inventory.
- Query each with an RDAP client or a lookup site that uses RDAP.
- Compare registrar, nameservers and status codes with your records.
- Flag any expiry date inside the next 90 days.
- Alert on any change in nameservers or status since last month.
- Record the result with the date.
You can script this, since the responses are structured. Store the previous result and diff it. That gives you a cheap change monitor for the registration layer, alongside DNS change alerts.
Using it on other people's domains
Investigating a suspicious lookalike or a sender domain? A lookup shows how old the registration is and which registrar holds it, which helps triage. Treat it as one signal. Dates and registrar do not prove intent.
Privacy and your own record
Registrant details may be partly hidden depending on your registrar and the rules for your top level domain. Ask your registrar what is public. Whatever shows, keep contact data accurate, because registrars use it for recovery and notices, and use a role address rather than a named person.
Related checks
Combine registration checks with the DNS hygiene checklist. Safeguard covers the software side with SBOM and dependency scanning and asset discovery, and offers a free scan at gold.safeguard.sh/scan.
Quick check
Is RDAP replacing WHOIS completely?
It is the designated successor, and registries and registrars operate RDAP services. Some WHOIS services may still run, so check what your registrar and registry support.
Does a lookup prove who owns a domain?
No. Fields may be redacted or protected, and dates show age but not intent. Use it as one input among several.
Sources
- RFC 7480, HTTP Usage in the Registration Data Access Protocol
- RFC 7482, Registration Data Access Protocol Query Format
- ICANN, Temporary Specification for gTLD Registration Data
- ICANN, EPP status codes
Last reviewed: 19 October 2026.
