Support Library

WHOIS vs RDAP

WHOIS vs RDAP: how they differ, why RDAP is the official gTLD source since January 2025, and how to query and read RDAP with curl and jq.

Author
CategoryDNS Tools & Commands
Length4 minute read
UpdatedOctober 24, 2026

The short answer

WHOIS and RDAP both answer the question "who holds this domain, through which registrar, and in what state is it?" WHOIS is the old protocol: free text over port 43, with a different layout at every registry. RDAP, the Registration Data Access Protocol, returns structured JSON over HTTPS. For generic top-level domains such as .com and .org, RDAP is now the official source: ICANN ended the contractual requirement for gTLD registries and registrars to run WHOIS services on January 28, 2025.

$ whois example.com

$ curl --fail --location 'https://rdap.org/domain/example.com'

--location matters. rdap.org does not hold any data itself; it redirects you to the right registry's RDAP server, and curl only follows redirects when told to.

How the two compare

WHOISRDAP
TransportPlain text over TCP port 43 (RFC 3912)HTTPS (RFC 9082)
FormatFree text, laid out differently by each registry and registrarJSON with standard fields for entities, events and statuses (RFC 9083)
Finding the right serverBuilt into each whois client, or by referralIANA's bootstrap file, which maps each TLD to its RDAP server (RFC 9224)
Internationalized textNo defined character setUTF-8
Status for gTLDsNo longer required since January 28, 2025; some operators still run itRequired, and the definitive source
Country-code TLDsCommonVaries; many ccTLDs offer RDAP, others only WHOIS or a web lookup

The end of the requirement did not switch every WHOIS server off. Many registries and registrars still answer on port 43, but what they return may be incomplete or out of date, and for gTLDs RDAP is the reference when the two disagree. Country-code TLDs set their own policies, so check the registry if a ccTLD lookup fails.

Reading an RDAP response

An RDAP domain record is long, but a few fields carry most of what you need. With jq installed you can pull them out:

$ curl --silent --fail --location 'https://rdap.org/domain/example.com' \
  | jq '{ldhName, status, events, nameservers: [.nameservers[].ldhName]}'
FieldWhat it holds
ldhNameThe domain name in ASCII form
statusEPP statuses in RDAP spelling, such as client transfer prohibited. See Domain Status Codes.
eventsDated events such as registration, expiration and last changed
entitiesThe registrar, with its IANA ID and abuse contact, and any registrant contacts the registry may publish
nameserversThe delegation the registry holds
linksFor thin registries such as .com, a related link to the registrar's own RDAP record, which can have more detail

Contact details for registrants are usually redacted for privacy under ICANN policy and data-protection law. A redacted record is normal, not a sign that something is hidden for bad reasons.

When to use which

  • Scripts and monitoring: use RDAP. The fields are predictable and dates come in a standard format.
  • A quick look at a gTLD domain: either works, but treat RDAP as authoritative.
  • A ccTLD with no RDAP service: use WHOIS or the registry's web lookup.
  • Registration changes: check both the registry and the registrar RDAP records, since the registrar's expiration date can differ from the registry's, as explained in Domain Expiration, Grace Periods and Deletion.

How DNS Panopticon helps

Website Recon looks domains up in RDAP, finding the registry's server through IANA's bootstrap file. Its results show the registrar, the registry's creation, update and expiration dates, the name servers, and each status with its meaning and who set it. It does not query port 43 WHOIS, so a TLD without an RDAP service shows no registration data.

Sources and further reading