People still use “WHOIS” as a generic verb for looking up a domain, but the registration-data landscape has changed. RDAP—the Registration Data Access Protocol—provides a structured, standardized way to retrieve current registration data for supported domain names and Internet number resources. WHOIS remains present in tools, habits, and some systems, yet its free-form text model is harder to parse and less consistent.
The practical lesson is not to argue about labels. It is to understand what a lookup can show, what redaction and policy may hide, how status codes affect operations, and why registration data alone does not prove ownership, legitimacy, or intent. Domain buyers, defenders, investigators, and administrators need a repeatable interpretation process.
What registration data represents
A registration-data response describes the current state reported through registry and registrar systems. It can include the domain, registrar, important event dates, nameservers, status codes, DNSSEC indicators, and contact entities or redaction notices. The fields available depend on the top-level domain, policy, access level, and data source.
The response is not the same as a deed. Registration is governed by agreements and policies, and public fields may be redacted or represented through privacy services. A named organization may be outdated, inaccurate, or a proxy. A lack of public registrant data does not mean no responsible party exists.
Use registration data as one evidence layer alongside DNS, website content, certificates, transaction records, trademark research, provider responses, and direct control verification. The weight of each layer depends on the question being answered.
How RDAP improves on traditional WHOIS
Traditional WHOIS generally returns human-readable text over a simple query protocol. Formats differ among registries and registrars, field labels vary, referral behavior can be inconsistent, and internationalization is limited. Automated tools often rely on brittle text parsing.
RDAP returns structured data over HTTPS and supports standardized objects, links, events, status values, notices, and error responses. That structure makes it easier for software to interpret fields consistently and follow authoritative links. The ICANN Registration Data Lookup conducts RDAP queries and provides a practical interface for reviewing current registration data.
HTTPS also brings ordinary web security properties to the transport, while standardized response formats support internationalization and access-control mechanisms. These are protocol improvements; they do not guarantee that every desired contact field will be public or that every response will be complete.
Read the registrar and event fields carefully
Identify the sponsoring registrar and its IANA identifier where available. The registrar is the organization responsible for the registration relationship at that moment. A reseller may provide the customer-facing service, so the brand name in an account or invoice may differ from the accredited registrar shown in RDAP.
Review event dates with their labels. Creation, registration, last changed, expiration, and transfer events are not interchangeable. The registry expiration date may not match the date a reseller displays to a customer. Time zones and timestamp formats matter when building an incident or transaction timeline.
Do not infer continuous ownership from an old creation date. A domain can change registrants, registrars, uses, and control while retaining its original creation date. Historical ownership requires additional evidence, and privacy rules may limit what is available.
Interpret status codes as controls and conditions
Status codes describe conditions applied by the registrar or registry. Client-prefixed statuses are generally set through the registrar; server-prefixed statuses are generally set at the registry level. Transfer, update, delete, renew, hold, redemption, and pending statuses each have operational implications.
A transfer-prohibited status is often a normal security control. A hold status can prevent the domain from resolving. Redemption or pending-delete statuses indicate a lifecycle problem that may be time sensitive. Read the linked explanation for each code and confirm the situation with the registrar when the domain is yours or part of a transaction.
Capture the complete status set. One code rarely tells the whole story. During an incident, compare the observed statuses with a known-good baseline and approved changes. An unexpected removal of transfer protection can be as important as the appearance of a new status.
Understand redaction and legitimate access limits
Public registration data often omits personal or contact information. Redaction can protect privacy and reflect legal or contractual requirements. It also means analysts should avoid treating “REDACTED” as suspicious or using absence of a name as evidence of wrongdoing.
Some parties may have processes for requesting nonpublic data based on legitimate interests and applicable rules. Those processes require a stated purpose, appropriate authority, and compliance with provider procedures. They are not a shortcut for curiosity or bulk collection.
For ordinary due diligence, direct seller verification and contractual representations are more useful than hoping a public lookup reveals a person’s identity. For abuse response, provide providers with precise evidence and request the action or disclosure pathway appropriate to the case.
Use authoritative bootstrap and referral paths
RDAP clients can use bootstrap information to locate the authoritative service for a top-level domain. A response may contain links to related resources, registrar entities, notices, terms, or alternate language. Follow authoritative links rather than relying on an arbitrary third-party cache for final decisions.
Third-party tools can add historical views, screenshots, correlation, or convenience. They also may be delayed, incomplete, or governed by different collection methods. Record the source and retrieval time for every result. Distinguish current authoritative data from historical or derived data in reports.
When two sources disagree, do not average them. Determine whether one is registry data, registrar data, a stale cache, or a separately collected historical record. The difference may be the finding.
Build a domain research worksheet
For each domain, record the exact Unicode and ASCII forms where relevant, top-level domain, registrar, statuses, creation date, expiration date, last-change date, nameservers, DNSSEC state, entities shown, redaction notices, lookup source, query time, and raw response location. Add DNS answers, mail exchangers, certificate observations, and website state in separate fields.
Include a question and conclusion section. “Who owns this?” may not be answerable from public data. “Which registrar currently sponsors the domain?” or “Was transfer protection enabled at 14:00 UTC?” is more precise. Good questions prevent analysts from overstating what the evidence supports.
Preserve the raw JSON response for material investigations or transactions, subject to data-handling policy. Screenshots are useful for review but can omit fields and are harder to parse later. Hash or otherwise protect important evidence according to organizational procedures.
Apply RDAP to domain acquisition
Before buying, review the registrar, statuses, dates, nameservers, and DNSSEC state. Confirm whether transfer restrictions or lifecycle conditions affect timing. Use an independent control-verification method because public registration data may not identify the seller.
After transfer, query again and verify the expected registrar, statuses, nameservers, and events. Restore locks, confirm auto-renewal, and update the asset inventory. Keep before-and-after responses with the transaction file.
For a premium acquisition, combine RDAP with rights research, historical use, reputation checks, contract review, and DNS migration planning. The lookup is a control point, not a complete diligence package.
Apply RDAP to security monitoring
Establish a baseline for critical domains and monitor changes in registrar, statuses, nameservers, DNSSEC, and expiration. Alerts should be compared with approved change records. Independent monitoring is valuable because account-level notifications can be disabled or redirected after compromise.
For lookalike domains, RDAP may reveal registrar, dates, nameservers, and statuses even when contacts are redacted. These details can help cluster cases and route abuse reports. Avoid assuming common infrastructure proves common ownership; shared registrars, DNS providers, and hosting platforms serve many unrelated customers.
Track activation over time. A newly registered lookalike may remain dormant and later gain mail or web records. Combine registration monitoring with DNS, certificate, and email telemetry to identify meaningful changes.
Avoid common interpretation errors
Do not call the creation date the purchase date. Do not call the registrar the owner. Do not assume privacy service use is malicious. Do not treat a future registry expiration date as proof that auto-renewal is enabled. Do not assume a transfer-prohibited status blocks nameserver updates. Do not infer a company relationship from shared nameservers alone.
Avoid copying personal data into reports without a need and lawful basis. Registration research can expose sensitive information in some contexts. Follow retention, access, and disclosure policies.
Finally, do not rely on a single snapshot for a fast-changing incident. Query again after major events and preserve every timestamp. Registration changes, DNS propagation, and provider actions can create a sequence that matters more than any one response.
Make the lookup part of a disciplined process
RDAP gives domain research a more structured foundation than traditional free-form WHOIS, but disciplined interpretation remains essential. Ask precise questions, use authoritative sources, preserve raw evidence, separate facts from inferences, and combine registration data with technical and legal context.
Use the buyer’s due diligence checklist for acquisitions, the domain lock guide for status interpretation, and the brand protection framework for lookalike investigations. A lookup becomes valuable when it supports a documented decision rather than a quick assumption.