Protocols

RDAP vs WHOIS, and why the difference is not cosmetic

RDAP (Registration Data Access Protocol) replaced WHOIS for gTLD registration data: on 28 January 2025 ICANN ended the obligation for gTLD registries and registrars to run WHOIS. WHOIS returned free text that differed at every registrar; RDAP returns structured JSON with defined status codes — for anything automated, the difference between parsing and reading.

Published 18 September 2026 · Updated 21 October 2026 · Figures checked against primary sources, not recalled.

Check it now: the free domain expiry checker will run a live RDAP lookup against the registry and see what it returns.

RDAP — the Registration Data Access Protocol — is the replacement for WHOIS. It is not a new front end over the same service. It is a different protocol with a different data model, and for anyone writing software against it the difference is substantial.

The change is now mandatory

ICANN's RDAP amendments to the base gTLD Registry Agreement and the 2013 Registrar Accreditation Agreement took effect, and on 28 January 2025 the obligation to provide WHOIS over port 43 and the web sunset for gTLD registries and registrars. A narrow set of legacy exceptions remains — .com, .name and .post — but for the rest, RDAP is the required interface and WHOIS is optional.

In practice this means code that still parses WHOIS text is working against a service its provider is no longer obliged to run.

What actually differs

	WHOIS	RDAP
Transport	Port 43, plain TCP	HTTPS
Response	Free text, no schema	JSON, defined in RFC 9083
Statuses	Prose, registrar-specific wording	Fixed vocabulary, e.g. `redemptionPeriod`
Errors	Text you have to recognise	HTTP status codes
Finding the server	Hard-coded lists	IANA bootstrap registry
Internationalisation	Inconsistent	Specified

Structured status is the important one

Under WHOIS, establishing that a domain was in redemption meant matching strings against output that differed between registrars, changed without notice, and was sometimes translated. Every WHOIS parser accumulated a pile of regexes, and every one of them broke silently — returning "not in redemption" for a domain that was, because the wording had shifted.

RDAP returns a status array drawn from a fixed vocabulary. redemptionPeriod is either present or it is not. There is nothing to interpret, which means there is nothing to misinterpret.

Bootstrap replaces hard-coded server lists

WHOIS gave no standard way to discover which server was authoritative for a TLD, so tools shipped static maps that went stale. RDAP publishes the IANA bootstrap registry: a machine-readable mapping from TLD to RDAP base URL. A new TLD becomes queryable without a code change.

Errors stop being ambiguous

A WHOIS query for a non-existent domain and a WHOIS query that was rate-limited could both return prose. Distinguishing "this name is free" from "the server declined to answer" was guesswork, and getting it backwards means reporting a registered domain as available. RDAP answers 404 and 429, which cannot be confused.

What an RDAP record looks like

This is part of the record Verisign returns for github.com, cut down to the fields an expiry check reads (queried 20 October 2026):

{
  "ldhName": "GITHUB.COM",
  "status": [
    "client delete prohibited",
    "client transfer prohibited",
    "client update prohibited"
  ],
  "events": [
    { "eventAction": "registration", "eventDate": "2007-10-09T18:20:50Z" },
    { "eventAction": "expiration",   "eventDate": "2028-10-09T18:20:50Z" },
    { "eventAction": "last changed", "eventDate": "2026-09-07T09:22:52Z" }
  ]
}

Two things are worth noticing. The dates are ISO 8601 events rather than lines of text to parse, so "when does it expire" is one lookup. And the statuses are written as RDAP's spelled-out forms of the EPP codes — client transfer prohibited is clientTransferProhibited — so code reading them should normalise case and spaces before comparing.

To see the full record for any domain, run it through the domain expiry checker and open "View the raw RDAP response" under the result. The request goes from your browser straight to the registry, so what you see is exactly what the registry sent.

RDAP does not mean more personal data. Registration contact details are still redacted under GDPR and ICANN policy in most cases. What RDAP improves is the structure and reliability of the record, not its visibility.

What did not get better

RDAP is a protocol, not a guarantee of data quality. Registries still differ in what they publish: some omit expiry dates entirely, some publish events the others do not, and ccTLDs are under no ICANN obligation at all. Treating an expiry date as optional rather than assumed is still necessary — it is simply now a missing field rather than a parsing failure.

Common questions

Is WHOIS dead?

For gTLDs, largely. Since 28 January 2025 registries and registrars are no longer required to provide WHOIS over port 43 or the web, with narrow exceptions for .com, .name and .post. Many still run it voluntarily, but it is no longer the contractual interface.

What RFC defines RDAP responses?

RFC 9083 defines the JSON response format, and RFC 9082 defines the query format. Both replaced the earlier RFC 7482 and 7483.

How do you find the right RDAP server for a TLD?

The IANA bootstrap registry at data.iana.org/rdap/dns.json maps each TLD to its RDAP base URL. It is fetched rather than hard-coded, so new TLDs work without a code change.

Does RDAP expose registrant contact details?

Usually not. Redaction under GDPR and ICANN policy applies to RDAP just as it did to WHOIS. RDAP improves the structure and reliability of the record, not how much personal data it contains.

Sources

Built on RDAP from the first line

DropPerch queries the authoritative registry over RDAP for every domain you watch, across more than 1,500 TLDs in the IANA bootstrap registry.

Start watching free