WHOIS vs RDAP: What Changed, Why It Matters, and How to Use Each

If you've been using whois example.com from the terminal for years, you might not have noticed that ICANN is quietly phasing out WHOIS in favor of a new protocol called RDAP. Almost every gTLD registry now supports RDAP, and several have deprecated the old WHOIS port-43 service entirely. Here's what changed, why it matters, and how to use each.

A brief history of WHOIS

WHOIS is a text-based protocol from 1982. You connect to port 43 on a registry server, send a domain name, and receive back a formatted text response. The format isn't standardized — every registrar prints its data slightly differently, which makes scraping painful.

What is RDAP?

RDAP (Registration Data Access Protocol) is a modern replacement for WHOIS, finalized by the IETF in 2015. It uses HTTPS and returns structured JSON, which is orders of magnitude easier to parse than text. ICANN mandated RDAP support for all gTLD registries in 2018.

Key differences:

• HTTPS, not port 43 — standard web protocol, works through firewalls, supports caching
• JSON responses — structured, parseable, multilingual-safe
• Standardized schema — every registry returns the same field names
• Authentication-ready — support for OAuth-style tokens to reveal more info to authorized parties
• Internationalized — properly handles non-ASCII domain names and fields

GDPR's impact on both protocols

When GDPR became enforceable in May 2018, personal data in WHOIS and RDAP records became problematic. Registries had to choose: redact personal data globally, redact only for EU domains, or face massive fines. Most chose to redact globally. Today you'll see:

• Registrant name, email, phone: REDACTED FOR PRIVACY
• Admin and tech contacts: typically REDACTED
• Abuse contact: still visible (required for security reporting)
• Registrar name, dates, nameservers: still visible (not personal data)

If you need real contact info for abuse/security purposes, you now go through the registrar's abuse email — which is still in every record.

Which should you use today?

For new tools and scripts: use RDAP. It's the long-term direction, and the JSON makes parsing 10x easier.

For quick terminal queries: classic whois still works and is faster to type. But some gTLDs (notably most new gTLDs like .dev, .app, .ai) only support RDAP.

For a web-based lookup with readable output: use our WHOIS Lookup tool. It uses RDAP under the hood and returns registrar, dates, nameservers, DNSSEC, and abuse contact in a clean UI.

RDAP endpoints by TLD

Every gTLD has its own RDAP server:

• .com, .net — rdap.verisign.com
• .org — rdap.publicinterestregistry.org
• .dev, .app — rdap.nic.google
• .io — rdap.identitydigital.services

To avoid remembering all these, use the aggregator at rdap.org/domain/{name}, which forwards to the right registry. That's what our tool uses internally.

What you'll see in a modern WHOIS/RDAP lookup

• Registrar — the company you registered through (GoDaddy, Namecheap, Cloudflare, etc.)
• Registration date — when the domain was first registered
• Expiry date — when the domain expires (usually auto-renewed)
• Last updated — the last time any record changed
• Status codes — "clientTransferProhibited", "clientDeleteProhibited", etc. — tell you if the domain can be transferred or deleted
• Nameservers — the authoritative NS records (also visible via DNS Lookup)
• DNSSEC — whether the domain is cryptographically signed
• Abuse contact — still visible post-GDPR

Who actually uses WHOIS/RDAP?

• Domain buyers — checking if a domain is about to expire
• Brand protection — monitoring domains similar to yours
• Security teams — investigating phishing domains or C2 infrastructure
• DevOps — confirming a domain's nameservers before a migration
• Lawyers — due diligence for trademark/DMCA actions

Try it now: Check any domain's WHOIS/RDAP data for free on Traffic Lens.