RDAP vs WHOIS: What's the Difference?

RDAP and WHOIS both answer the question “who is this domain registered to?” WHOIS is the original plain-text protocol; RDAP is its standardized successor, returning JSON over HTTPS. Here is how they differ, where each is still used, and how W.is uses both.

By the W.is team · Updated

The short answer

WHOIS (RFC 3912) is a simple text protocol: connect to port 43, send a name, and read whatever text comes back. It has no standard output format, no encryption and no standard, machine-readable way to find the right server.

RDAP, the Registration Data Access Protocol, does the same job over HTTPS with standardized URLs, JSON responses, HTTP error codes and an IANA directory of servers. If you are new to it, start with What is RDAP?

For generic TLDs such as .com, .org and .app, RDAP has been mandatory since 2019 and has been the authoritative source since January 28, 2025, when ICANN dropped the requirement for all registrars and most registries to run WHOIS. Country-code TLDs make their own choices, so WHOIS is still widely used — which is why a good lookup tool speaks both.

RDAP vs WHOIS at a glance

The main differences, aspect by aspect:

AspectWHOISRDAP
SpecificationRFC 3912 (2004), which only describes the transportRFC 7480, 7481, 9082, 9083 and 9224 (Internet Standard STD 95)
TransportPlain TCP connection to port 43HTTPS, like any web API
Query formatFree text; each server has its own syntax and flagsStandard URLs such as /domain/example.com and /nameserver/ns1.example.com
Response formatUnstructured text whose labels differ between registriesJSON with defined members: events, entities, status, nameservers
ErrorsFree text such as “No match for” or “NOT FOUND”HTTP status codes (404, 429 and others) plus JSON error objects
SecurityNo encryption and no way to verify the serverTLS encryption and server authentication; client authentication possible (RFC 7481)
InternationalizationNo way to declare a character set, so non-ASCII text is often garbledUTF-8 JSON; internationalized names come as both ldhName and unicodeName
Access control and redactionSame answer for everyone; hidden values replaced with text such as “REDACTED FOR PRIVACY”Can return different levels of detail to authenticated users; RFC 9537 lists redacted fields in a machine-readable way
Finding the right serverNo standard; clients hard-code server lists or follow referrals from whois.iana.orgIANA bootstrap file (RFC 9224) that maps each TLD to its RDAP server
Rate limitingServer-specific; excess queries may be refused or silently droppedSignalled with HTTP 429 Too Many Requests
Links to related dataThe registrar's WHOIS server is named in the textMachine-readable links, for example to the registrar's RDAP record for the domain
Generic TLDs (gTLDs)No longer required of registrars and most registries since January 28, 2025; many servers have been switched offRequired since August 26, 2019; now the authoritative source
Country-code TLDs (ccTLDs)Still the main or only service at many registriesOptional; offered by a growing number of registries

The same record in both protocols

The difference is easiest to see side by side. Here is an excerpt of the registry WHOIS record for google.com, in the format ICANN specified for generic TLDs:

Domain Name: GOOGLE.COM
Registry Domain ID: 2138514_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Updated Date: 2019-09-09T15:39:04Z
Creation Date: 1997-09-15T04:00:00Z
Registry Expiry Date: 2028-09-14T04:00:00Z
Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: [email protected]
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS1.GOOGLE.COM
Name Server: NS2.GOOGLE.COM
DNSSEC: unsigned

Every one of these facts is also in the RDAP response, but in named JSON members instead of text labels:

FieldWHOIS labelRDAP member
CreatedCreation Dateevents → eventAction "registration"
ExpiresRegistry Expiry Dateevents → eventAction "expiration"
Last updatedUpdated Dateevents → eventAction "last changed"
RegistrarRegistrar, Registrar IANA IDentity with role "registrar"; IANA ID in publicIds
Abuse contactRegistrar Abuse Contact Emailentity with role "abuse" inside the registrar entity
StatusDomain Status: clientTransferProhibitedstatus: "client transfer prohibited"
Name serversName Servernameservers → ldhName
DNSSECDNSSEC: unsignedsecureDNS → delegationSigned: false

The data is the same; what differs is how reliable it is to read. RDAP's member names are fixed by RFC 9083 for every registry, while the WHOIS labels above are the format ICANN specified for gTLDs only. Country-code registries use their own: .cn says “Expiration Time”, .ru says “paid-till”, and some registries, such as DENIC for .de, publish no expiry date at all. Status values follow the same pattern: WHOIS prints the EPP code (clientTransferProhibited), RDAP the spelled-out form defined in RFC 8056. Both are explained in our domain status code reference.

Where each protocol is used today

Generic TLDs

ICANN has required every gTLD registry and registrar to run RDAP since August 26, 2019. On January 28, 2025, the obligation for registrars and most registries to also provide WHOIS ended. Some operators still answer on port 43 voluntarily, but many have shut their WHOIS servers down, and for gTLD data RDAP is the reference.

Country-code TLDs

Country-code registries are not bound by ICANN's gTLD contracts and choose their own services. Of the 306 active ccTLDs, 81 have an RDAP endpoint in W.is's data; for the rest, W.is uses WHOIS where the registry runs a WHOIS server, and some registries offer only a lookup form on their own website.

Popular ccTLDs that W.is queries over RDAP: .ai, .uk, .ca, .au, .in, .fr, .nl, .is.

Popular ccTLDs with no RDAP endpoint in W.is's data, looked up over WHOIS instead: .io, .co, .me, .de, .cn, .jp, .us, .eu.

The full picture is in the RDAP server list and the WHOIS server list.

How W.is combines RDAP and WHOIS

W.is keeps a built-in list of registry RDAP servers — currently 1,207 TLDs across 594 endpoints — and follows these rules for every domain lookup:

  1. RDAP first. If W.is has an RDAP server for the TLD, it queries the registry directly over HTTPS.
  2. Complete answer: if the RDAP record includes the registrar, the creation date and the name servers, W.is shows it as is, labeled “RDAP Data”.
  3. Filling gaps: if any of those three is missing, W.is also asks the WHOIS server and merges the answers. RDAP values win field by field, WHOIS fills what is missing, status codes from both are combined without duplicates, and both raw responses are shown. The result is labeled “RDAP+WHOIS”.
  4. Not found: if the registry's RDAP server answers 404, W.is reports the domain as not found and does not ask WHOIS, because the registry has already given an authoritative answer.
  5. RDAP failure: if the RDAP server times out, rate-limits the request, returns an error or sends something that is not valid JSON, W.is falls back to WHOIS.
  6. No RDAP endpoint: for TLDs without an RDAP server in W.is's list, W.is goes straight to the registry's WHOIS server on port 43.

Look up any domain to see which source W.is used:

Which one should you use?

  • For a quick check, use a client that speaks both, such as W.is. You get the registry's RDAP data where the client has an endpoint for it and WHOIS everywhere else, without having to know which registry supports what.
  • In scripts and integrations, use RDAP. Find the server through the IANA bootstrap files, send an Accept: application/rdap+json header, treat 404 as “not found” and back off on 429. Keep a WHOIS fallback only for TLDs without RDAP.
  • For ccTLDs without RDAP, WHOIS is still the right tool; some registries also offer a lookup form on their website with extra details.
  • Whatever you use, respect each server's terms of use. Most prohibit high-volume automated querying and using the data for unsolicited marketing.

Frequently asked questions

Is WHOIS being shut down?

Not everywhere. For generic TLDs, ICANN removed the contractual requirement for registrars and most registries to run WHOIS on January 28, 2025, and RDAP is now the authoritative source; some operators still run WHOIS voluntarily, but many have switched it off. Many country-code registries still operate WHOIS, and for some it is their only lookup service.

Does RDAP show more information than WHOIS?

Not necessarily. Both protocols usually publish the same underlying registration data and apply the same privacy redactions. RDAP's advantages are that the data is structured and consistently labeled, travels over HTTPS, and can support authenticated access with more detail for requesters who have a legitimate need.

Why do RDAP and WHOIS sometimes show different data for the same domain?

The two services can be run on different systems, refreshed at different times, or queried at different levels: a registry's WHOIS and a registrar's RDAP record, for example. Expiry dates in particular can differ between registry and registrar records around renewal time. When they disagree for a gTLD, treat the registry's RDAP record as authoritative.

Should I use RDAP or WHOIS in my scripts?

Use RDAP whenever the registry offers it: responses are JSON with standard field names, errors use HTTP status codes, and IANA's bootstrap files tell you which server to query. Keep WHOIS as a fallback for TLDs without RDAP, and expect to write registry-specific parsing for it.

Does W.is use RDAP or WHOIS?

Both. W.is uses RDAP whenever it has an RDAP endpoint for the TLD and falls back to WHOIS when it has none or the RDAP server fails. If an RDAP record lacks the registrar, creation date or name servers, W.is fills the gaps from WHOIS, and the result page shows which source the data came from.