Reference guide
What are WHOIS and RDAP?
WHOIS and RDAP answer the same question — who registered this domain, until when, and what state it is in — but one returns free text and the other structured data. The first is on its way out.
7 min readUpdated September 12, 2026
In short
WHOIS is the original service, returning a domain's registration details as free text. RDAP is its standardized successor: the same details as JSON, served over HTTPS, and queried the same way everywhere. Since 28 January 2025, registries and registrars for generic extensions are no longer required to run a WHOIS service.
What WHOIS and RDAP are for
You do not buy a domain name, you rent it. That rental has an end date, a holder, a registrar, and locks that allow or forbid certain operations. WHOIS and RDAP are the two counters publishing it, and they are the only authoritative sources: none of it appears in DNS.
The difference between them is not cosmetic. WHOIS returns text meant for a human, laid out differently at every registry: a parser that works for one extension gets the next one wrong. RDAP returns structured data, identical whichever registry you query, served over HTTPS like any modern interface.
For an agency tracking thirty domains across six different registrars, that difference decides everything: it is what separates reliable monitoring from a spreadsheet someone has to correct by hand every quarter.
WHOIS and RDAP, line by line
The same content, two eras. The right-hand column is why the switch was pushed rather than merely put up with.
WHOIS
RDAP
- Transport
- A cleartext connection on port 43.HTTPS, encrypted, like any web interface.
- Response format
- Free text, laid out differently by each registry.Structured JSON, identical from one registry to the next.
- Finding the right server
- By convention and trial and error, often via a manual referral.Through a published directory saying which server to query for each extension.
- Differentiated access
- None: everyone sees the same thing, which since GDPR is close to nothing.Built into the standard: an authenticated requester can receive more fields.
- Non-Latin scripts
- Poorly supported, often unreadable output.Supported natively.
- Today
- No longer required for generic extensions since 28 January 2025; many registries have switched it off.The source to query, and the only one to build a tool on.
Where each WHOIS field lives in RDAP
The information has not gone away; it has moved and been renamed. Here is the mapping for the fields people actually look up.
| WHOIS field | Location in RDAP | What it is used for |
|---|---|---|
| Creation Date | An event with action registration. | The domain's age, useful for estimating its value and spotting a recent registration. |
| Registry Expiry Date | An event with action expiration. | The date that counts. It is the registry's, not the one shown in the registrar's interface. |
| Updated Date | An event with action last changed. | Spotting a recent change you did not make yourself. |
| Registrar | An entity with the registrar role. | Knowing where the domain is actually registered, regardless of who invoices it. |
| Domain Status | An array of status codes. | The most useful information day to day: what the domain allows and what it forbids. |
| Name Server | Nameserver objects. | Checking that the delegation matches the expected DNS hosting. |
| Registrant | An entity with the registrant role, almost always redacted. | Rarely usable since GDPR came into force. |
| DNSSEC | A secureDNS object, with the published digests. | Knowing whether the chain of trust is established on the registry side. |
A domain's status codes
The codes are the same at every registry. The prefix says who set them: client for the registrar, server for the registry — and you cannot remove the registry's yourself.
| Code | What it means | What it changes for you |
|---|---|---|
| ok | No restriction is set on the domain. | Everything is allowed, transfer included. It is also the state most exposed to hijacking. |
| clientTransferProhibited | The registrar refuses outbound transfers. | The baseline protection, worth switching on everywhere. A transfer means removing it first. |
| clientUpdateProhibited | Changes to the record are blocked. | Guards against unwanted changes of nameservers or holder. |
| clientDeleteProhibited | Deletion is blocked. | Prevents an accidental or malicious deletion from the account. |
| clientHold | The registrar asks the registry to withdraw the domain from DNS. | The site and the mail stop dead, while the domain is still yours. Usually an unpaid invoice or a pending contact verification. |
| serverTransferProhibited | The registry itself blocks transfers. | Cannot be removed from your account. Applied during the first sixty days after a registration or a transfer. |
| serverHold | The registry has withdrawn the domain from DNS. | The same effect as a registrar hold, but the decision comes from one level up. |
| inactive | No nameserver is declared for the domain. | The domain exists but does not resolve. Common right after registration, abnormal afterwards. |
| pendingTransfer | A transfer to another registrar is under way. | If you did not request it, this is an emergency: the window to refuse is short. |
| autoRenewPeriod | The domain has just been auto-renewed by the registry. | Cancellation is still possible during this period, with a refund at most registrars. |
| redemptionPeriod | The domain has been deleted and sits in the redemption window. | It can still be recovered, but at the price of a restoration fee. The site and mail have already stopped. |
| pendingDelete | The final stage before the name is released. | Recovery is over. The name goes back on sale at the end of this period. |
Check your own domain, right now
Enter a domain name: the tool reads its expiry date, its registrar and its status codes, straight from the source.
What happens to a domain that expires
Roughly two months pass between the expiry date and the return to sale for generic extensions. Knowing the stages saves you writing off a domain that is still recoverable — and the reverse.
- 1
The expiry date is reached
The domain stops being paid for. Depending on the registrar, resolution stops at once or a few days later: the site can go down before you have even noticed the date pass.
- 2
The grace period
The holder can still renew at the normal price. The registrar sets its length, not the registry, so it varies from one account to the next.
- 3
The redemption period
Around thirty days for generic extensions. The domain is no longer yours in the everyday sense, but you alone can restore it — for a fee well above a renewal.
status: redemptionPeriod
- 4
Pending deletion
Around five days in which nothing can be done. The name is heading for release and nothing stops it.
status: pendingDelete
- 5
Release
The name becomes available for anyone to register. On a domain with history, it is generally taken within seconds by an automated buyer.
These durations are those of generic extensions. Country-code extensions apply their own rules: the .fr timeline, for instance, is set by its registry and does not follow the same stages.
The questions that come next
Why are the holder's contact details hidden?
Because GDPR put an end to publishing an individual's personal data in Europe. Registries redact most contact fields as a result. RDAP does provide fuller access to authenticated requesters, but that is not open to the public.
How do you reach a domain's owner then?
Through the form or relay address many registrars publish in place of the real details. It is the intended channel, and often the only one that exists.
Should the transfer lock be switched on?
Yes, on every domain. It costs nothing, comes off in two clicks the day a transfer is genuinely planned, and blocks the most classic manoeuvre in a name hijacking.
My domain shows clientHold, what now?
Your registrar asked the registry to withdraw the domain from DNS, usually over an unpaid invoice or an unverified contact address. Nothing in the zone will fix it: settle the cause on the account side, and resolution comes back afterwards.
The date that counts is not the one on your invoice
The only authoritative date is the one the registry publishes, and it does not always match what your registrar's interface shows. DomainVigil reads it at the source on every domain you own and warns you long before the deadline.
Start for freeFive domains free, forever. No card required.
The other reference guides
- SPF: the list of servers allowed to send mail as your domain
- DKIM: the signature that travels with the message
- DMARC: the rule that says what to do when SPF and DKIM fail
- DNSSEC: signed DNS answers, and what it costs when they break
- CAA: the list of authorities allowed to issue your certificates
- TTL: how long a DNS answer stays in cache
- A and AAAA: the two ways of saying where a name lives
- CNAME: the DNS alias, and the four things it cannot do
- MX: where a domain's mail goes, and in what order
- The certificate chain: three links, and the one people forget
- HSTS: forcing HTTPS, and the trap on the way back