WHOIS / RDAP Lookup

Domain registration data is the public control record behind a name, not the website that appears when the name is opened. It connects a domain to its registry, registrar, lifecycle dates, delegated nameservers, status codes, and any contact roles that policy still allows to be shown. That record is often the fastest clue when a renewal deadline is missed, a transfer is blocked, or an incident responder needs to know which registrar owns the next administrative step.

The registration record answers a different question from live DNS. A domain may be registered and delegated while its web server is down, and a domain may list nameservers even when the zone has no usable A, AAAA, MX, or TXT answers. Reading the record well means separating ownership and delegation evidence from service-health evidence, then checking whether expiry dates, status codes, registrar details, and nameservers all point to the same operational story.

Registry

The operator for a top-level domain such as .com, .org, or a country-code TLD.

Registrar

The sponsor that normally handles renewal, transfer locks, account ownership, and customer support for the registration.

Registrant

The registered name holder. Public registrant fields may be redacted, proxied, or omitted.

Delegation

The nameserver set published in registration data, which identifies intended authoritative DNS servers but not the zone contents.

RDAP, the Registration Data Access Protocol, gives registration lookups a structured HTTP and JSON shape. Legacy WHOIS is older, text-oriented, and less consistent from one registry or provider to another. ICANN now requires gTLD registries and registrars to provide RDAP, and most gTLD WHOIS service obligations ended on Jan. 28, 2025, with limited exceptions. Country-code domains and provider-parsed WHOIS data can still differ, so comparing source paths remains useful when a record looks sparse.

A registration lookup is strongest as a triage record. Privacy redaction can hide contacts, registry grace periods can complicate deletion timing, and status text can require exact policy context before anyone acts. The safest reading is to treat registrar, expiry, status, and nameserver fields as clues that guide the next check rather than as a complete explanation of website, email, or DNS behavior.

How to Use This Tool:

Use one public domain at a time, then choose the lookup order based on whether you want the structured RDAP record first or a WHOIS-style comparison first.

1. Enter a bare name in Domain, such as example.com. Pasted http:// or https:// URLs are reduced to the host before the lookup runs.
2. Keep RDAP first, WHOIS fallback for ordinary renewal, transfer, and registrar checks. Use RDAP only for a standards-shaped source, or WHOIS first when legacy-style provider coverage is the comparison point.
3. Adjust Lookup timeout only when needed. The control accepts 2500 to 15000 milliseconds, and slower registries may need more time before fallback or failure is fair.
4. Click Lookup. The summary reports the normalized domain, source used, registrar when present, expiry clue, and a shortened status value.
5. Open Registration Lifecycle for creation, update, expiry, age, status, and days-to-expiry fields. Use Name Server Set when delegation is part of the question.
6. Review Registrant Contacts and Registrar Profile for public role and registrar details. Blank contact rows are common when redaction or proxy services apply.
7. If the lookup rejects the input, remove spaces, ports, email prefixes, leading dots, trailing dots, and single-label internal hostnames. If the record is valid but thin, try the alternate source order before concluding that the public source has no data.

For an audit trail, record the domain, source used, registrar, Expires, Days to Expiry, Status, and nameservers. For website or mail outages, follow with a live DNS and service check.

Interpreting Results:

Read the result as a registration record first. Days to Expiry sets renewal urgency, Status can explain locks or holds, and Nameservers identifies the delegated DNS host. None of those fields proves that the website, mail records, certificate, or authoritative DNS responses are healthy.

Sparse data is not automatically a failure. Compare RDAP and WHOIS-style paths when contact rows, dates, or registrar fields are missing, then act on the fields that remain consistent across source, lifecycle, status, and delegation evidence.

Technical Details:

Registration data is distributed between registry and registrar systems. RDAP gives that data a standardized query pattern and response format, so a domain record can expose lifecycle events, status values, nameservers, entities, and registrar details in structured fields. WHOIS predates that model and often returns provider-specific text, which is why legacy-style results can vary in field names, date formats, redaction, and completeness.

RDAP domain discovery starts with the top-level domain. Bootstrap data maps a TLD to one or more RDAP base services, and the domain record is requested from the matching service when available. A WHOIS-style provider can still be useful as a comparison source, especially when a registry has partial RDAP coverage, when a country-code domain behaves differently, or when a parser exposes legacy fields not present in the structured record.

Lookup Core

The accepted input is a public, host-shaped domain. The lookup lowercases the name, strips a pasted HTTP scheme and path, and removes leading or trailing dots. Validation then requires at least two labels. Each label may contain letters, digits, and hyphens, but a hyphen cannot start or end a label. That excludes URLs, email addresses, ports, spaces, and private single-label hostnames from public registration queries.

Formula Core

Registration timestamps come from the returned public record. Day counts convert those timestamps into renewal and age clues for triage.

86400000 is the number of milliseconds in a day. AgeDays floors partial days after creation, while DaysToExpiry rounds a partial remaining day up and never displays below zero. A domain with 10.4 days remaining shows 11 days; a date already in the past shows zero instead of a negative runway.

Status Code Reading

Many domain status values come from the Extensible Provisioning Protocol ecosystem and appear in both RDAP and WHOIS-shaped records. clientTransferProhibited usually points to a registrar-side transfer lock. serverHold and clientHold can explain why a name is not published in DNS. Deletion states such as redemptionPeriod and pendingDelete require special care because recovery windows and release timing depend on registry and registrar policy.

Status text is a strong clue, not a substitute for registrar confirmation. Renewal, transfer, restoration, and publication changes still need to be checked with the registrar account, registrar support, or the registry named in the record.

Privacy and Accuracy Notes:

The entered domain is sent to public registration data sources according to the selected source order. Some public sources may be reached through the site when direct browser access is unavailable. Avoid confidential internal hostnames, acquisition targets, customer incident details, or private investigation notes.

• RDAP and WHOIS-style results can disagree because coverage, parsing, redaction, freshness, and registry policy differ.
• Public contact fields may be empty even when the registration is valid and active.
• Expiry and status fields describe registration state, not website uptime, mail delivery, certificate health, or live DNS correctness.
• A timeout can hide a slow but valid source. Increase Lookup timeout before treating a slow registry as unavailable.

Worked Examples:

A renewal check for example.com can start with RDAP first, WHOIS fallback. If the summary shows 12 days remaining, the useful action is to verify billing and auto-renewal inside the registrar account, then keep the public record as supporting evidence.

A transfer review for example.net may return clientTransferProhibited. That status usually means a registrar transfer lock is active, so a new transfer request may stall until the lock is removed or explained by the registrar.

A website outage can show the expected Nameservers in the registration record while the site still fails. That points away from the registration record and toward live DNS answers, DNSSEC, hosting, TLS, or HTTP checks.

A contact review may show no Registrant Contacts rows even for an active domain. Trying WHOIS first can expose a different provider parse, but registrar profile, IANA ID, lifecycle dates, status, and nameservers are usually the stronger public audit trail.

FAQ:

Glossary:

RDAP

Registration Data Access Protocol, the structured HTTP and JSON protocol for registration data.

WHOIS

A legacy registration lookup method whose text responses vary by registry, registrar, and provider.

Registry

The authority that operates a top-level domain and maintains the domain registration system for it.

Registrar

The company that sponsors and manages a domain registration for the registered name holder.

EPP status

A domain state code that can describe locks, holds, pending actions, grace periods, or normal operation.

Nameserver set

The delegated DNS servers listed in registration data for the domain.

Redaction

The removal or hiding of public contact details because of privacy law, policy, or proxy service rules.

References:

• Registration Data Access Protocol, ICANN.
• Registration Data Access Protocol Query Format, RFC Editor, June 2021.
• JSON Responses for the Registration Data Access Protocol, RFC Editor, June 2021.
• Bootstrap Service Registry for Domain Name Space, IANA, April 4 2022.
• EPP Status Codes, ICANN, June 16 2014.
• ICANN Lookup FAQ, ICANN.