WHOIS and RDAP: what you can still find out about a domain

WHOIS used to answer one question: who owns this domain, and how do I contact them. Then privacy law arrived, registrars started redacting almost everything, and a lot of people concluded the tool had stopped being useful.

It has not. The contact details mostly went away, but the operational facts did not, and those turn out to be the more useful half. Expiry dates, registrar, nameservers, status codes and creation dates are all still public, and each of them answers a question that comes up regularly.

WHOIS, RDAP and why you see two answers

WHOIS is old. It dates from a time when the internet was small enough that a single text file of contacts was reasonable, and it shows: the protocol has no authentication, no standard response format, and every registry formats its output slightly differently.

RDAP is the modern replacement. It returns structured JSON over HTTPS, uses consistent field names, supports internationalised text properly, and can offer different levels of detail to different requesters. Most registries now run both.

Practically, RDAP is the better default because the data comes back in predictable fields rather than free text that has to be parsed by guesswork. Plain WHOIS is still worth having available, because a few registries expose fields in WHOIS that their RDAP service omits, and some country code domains have not fully migrated. The Whois tool lets you pick which to use, which makes comparing the two straightforward when an answer looks incomplete.

What is redacted and what is not

Since privacy regulations tightened, registrant names, addresses, phone numbers and email addresses are usually replaced with placeholders like "REDACTED FOR PRIVACY" or a forwarding address at the registrar. Privacy services do the same thing commercially.

What remains public, and is often more useful anyway:

Field	What it tells you
Registrar	Which company the domain is registered through. This is who to contact about abuse, and who you deal with for a transfer.
Creation date	When the domain was first registered. Extremely informative, for reasons below.
Expiry date	When it lapses if nobody renews. The answer to "why did our site disappear overnight".
Updated date	When the record last changed. A recent update on a domain you own and did not touch is worth investigating.
Nameservers	Which DNS provider actually answers for the domain. The authoritative answer to "where are the records hosted".
Status codes	The domain's current state at the registry, including locks and expiry stages.
DNSSEC	Whether the zone is signed.

Status codes are the interesting part

Status codes are the field most people skim past, and they carry the most operational information. They come in two families.

Client codes are set by the registrar, usually at the owner's request:

• clientTransferProhibited: the domain cannot be transferred to another registrar. This is a good thing to see on a domain you own, because it blocks the most common form of domain hijacking. If it is missing from a domain that matters to you, turning it on is free.
• clientUpdateProhibited and clientDeleteProhibited: further locks against modification and deletion.
• clientHold: the registrar has asked the registry to stop publishing the domain in DNS. The domain exists and resolves nowhere, which is usually a billing or compliance dispute.

Server codes are set by the registry itself and generally indicate something more serious:

• serverHold: the registry has suspended it. Court orders, abuse enforcement or registry policy.
• pendingDelete: it is about to be released. The end of the lifecycle below.
• redemptionPeriod: it has expired and is in the expensive recovery window.

A domain with ok or active and nothing else is in a completely ordinary state, with no locks. That is fine for something unimportant and a small risk for anything you care about.

The expiry timeline, and the expensive middle of it

A domain does not vanish the moment it expires. It goes through several stages, and the difference between them is measured in hundreds of currency units.

1. Expiry date passes

   For most generic domains, nothing dramatic happens immediately. The registrar may stop serving the site or park it.

2. Auto-renew grace period, roughly 0 to 45 days

   You can renew at the normal price. Many registrars keep the domain resolving through part of this, which is why an expired domain sometimes still works.

3. Redemption period, roughly 30 days

   The domain is removed from DNS and the site goes dark. It can still be recovered, but at a redemption fee that is typically an order of magnitude higher than a renewal. This is the stage worth avoiding, and the reason to check expiry dates before they arrive.

4. Pending delete, roughly 5 days

   Nothing can be done. The owner cannot recover it and nobody else can register it yet.

5. Released

   It becomes available again. For anything with existing traffic or links, drop catching services compete for it within seconds of release, so assuming you can simply re-register it later is optimistic.

All of which argues for checking expiry dates on the domains you depend on before anything goes wrong. It is a lookup that takes seconds, and saving it as an automation across your domains turns it into one tap, with the results kept in Run History so you can see dates approaching.

Worth remembering that a domain can also fail without expiring. If the nameservers listed at the registry no longer serve the zone, every lookup fails while the registration remains perfectly valid. That is a DNS failure rather than a registration one, and comparing the registry's nameserver list against the NS records DNS actually returns will tell you which you have.

IP lookups, which are not redacted

WHOIS on an IP address is a different system with different rules, run by the regional internet registries, and it was never subject to the same personal data redaction because address blocks are allocated to organisations rather than individuals.

An IP lookup gives you:

• The organisation the block is allocated to.
• The size of the allocation, in CIDR notation.
• An abuse contact address, which is the correct place to report a problem originating from that address.
• The country the allocation is registered in, which is not necessarily where the machine physically sits.
• The autonomous system number, which identifies the network operator in global routing.

This is what makes an IP lookup so useful when reading a traceroute. A hop that answers slowly means little until you know whether it belongs to your ISP, a transit provider in the middle, or the destination's own network, and that changes who you should be talking to. The public IP and ASN lookup gives you the same organisational detail for your own address.

Five things worth looking up

1. When your own domains expire

The single most valuable use. Domain expiry outages are entirely preventable and reliably occur at the worst possible moment, usually because the renewal email went to someone who left the company.

2. How old a suspicious domain is

This is a genuinely strong signal. Phishing and scam domains are typically registered days or weeks before they are used, because the older ones get blocked. A link claiming to be from a bank, on a domain created eleven days ago, is telling you something important on its own. A legitimate company's domain is usually many years old.

3. Which nameservers a domain really uses

During a migration, the registry's nameserver list is the authoritative statement of where queries will be sent. If you have been editing records at a provider that is not in that list, you have been editing a zone nobody asks about, which explains a lot of "the change is not propagating" confusion.

4. Where to report abuse

For a domain, the registrar's abuse contact. For an IP address, the registry's abuse contact for that block. These are the addresses that actually get read, as opposed to a generic contact form.

5. Whether a domain is genuinely available

A registrar's search box has an incentive to upsell you. A direct query is a plain answer: either the registry has a record or it does not. If it exists but is in pendingDelete, you now know roughly when it will be released, and that a lot of automated services will be waiting for the same moment.

The short version

Contact details are mostly redacted now, but everything operationally useful is still public: registrar, creation and expiry dates, nameservers and status codes. Prefer RDAP for structured output and keep classic WHOIS for the registries that have not caught up. Check the expiry dates on domains you depend on before the redemption period makes it expensive, treat a very recent creation date on an unfamiliar domain as a warning, and remember that IP address lookups were never redacted and will tell you exactly which organisation to contact.