RDAP vs WHOIS: What's the Difference?
RDAP and WHOIS both answer the question “who is this domain registered to?” WHOIS is the original plain-text protocol; RDAP is its standardized successor, returning JSON over HTTPS. Here is how they differ, where each is still used, and how W.is uses both.
By the W.is team · Updated
The short answer
WHOIS (RFC 3912) is a simple text protocol: connect to port 43, send a name, and read whatever text comes back. It has no standard output format, no encryption and no standard, machine-readable way to find the right server.
RDAP, the Registration Data Access Protocol, does the same job over HTTPS with standardized URLs, JSON responses, HTTP error codes and an IANA directory of servers. If you are new to it, start with What is RDAP?
For generic TLDs such as .com, .org and .app, RDAP has been mandatory since 2019 and has been the authoritative source since January 28, 2025, when ICANN dropped the requirement for all registrars and most registries to run WHOIS. Country-code TLDs make their own choices, so WHOIS is still widely used — which is why a good lookup tool speaks both.
RDAP vs WHOIS at a glance
The main differences, aspect by aspect:
| Aspect | WHOIS | RDAP |
|---|---|---|
| Specification | RFC 3912 (2004), which only describes the transport | RFC 7480, 7481, 9082, 9083 and 9224 (Internet Standard STD 95) |
| Transport | Plain TCP connection to port 43 | HTTPS, like any web API |
| Query format | Free text; each server has its own syntax and flags | Standard URLs such as /domain/example.com and /nameserver/ns1.example.com |
| Response format | Unstructured text whose labels differ between registries | JSON with defined members: events, entities, status, nameservers |
| Errors | Free text such as “No match for” or “NOT FOUND” | HTTP status codes (404, 429 and others) plus JSON error objects |
| Security | No encryption and no way to verify the server | TLS encryption and server authentication; client authentication possible (RFC 7481) |
| Internationalization | No way to declare a character set, so non-ASCII text is often garbled | UTF-8 JSON; internationalized names come as both ldhName and unicodeName |
| Access control and redaction | Same answer for everyone; hidden values replaced with text such as “REDACTED FOR PRIVACY” | Can return different levels of detail to authenticated users; RFC 9537 lists redacted fields in a machine-readable way |
| Finding the right server | No standard; clients hard-code server lists or follow referrals from whois.iana.org | IANA bootstrap file (RFC 9224) that maps each TLD to its RDAP server |
| Rate limiting | Server-specific; excess queries may be refused or silently dropped | Signalled with HTTP 429 Too Many Requests |
| Links to related data | The registrar's WHOIS server is named in the text | Machine-readable links, for example to the registrar's RDAP record for the domain |
| Generic TLDs (gTLDs) | No longer required of registrars and most registries since January 28, 2025; many servers have been switched off | Required since August 26, 2019; now the authoritative source |
| Country-code TLDs (ccTLDs) | Still the main or only service at many registries | Optional; offered by a growing number of registries |
The same record in both protocols
The difference is easiest to see side by side. Here is an excerpt of the registry WHOIS record for google.com, in the format ICANN specified for generic TLDs:
Domain Name: GOOGLE.COM
Registry Domain ID: 2138514_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Updated Date: 2019-09-09T15:39:04Z
Creation Date: 1997-09-15T04:00:00Z
Registry Expiry Date: 2028-09-14T04:00:00Z
Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: [email protected]
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS1.GOOGLE.COM
Name Server: NS2.GOOGLE.COM
DNSSEC: unsignedEvery one of these facts is also in the RDAP response, but in named JSON members instead of text labels:
| Field | WHOIS label | RDAP member |
|---|---|---|
| Created | Creation Date | events → eventAction "registration" |
| Expires | Registry Expiry Date | events → eventAction "expiration" |
| Last updated | Updated Date | events → eventAction "last changed" |
| Registrar | Registrar, Registrar IANA ID | entity with role "registrar"; IANA ID in publicIds |
| Abuse contact | Registrar Abuse Contact Email | entity with role "abuse" inside the registrar entity |
| Status | Domain Status: clientTransferProhibited | status: "client transfer prohibited" |
| Name servers | Name Server | nameservers → ldhName |
| DNSSEC | DNSSEC: unsigned | secureDNS → delegationSigned: false |
The data is the same; what differs is how reliable it is to read. RDAP's member names are fixed by RFC 9083 for every registry, while the WHOIS labels above are the format ICANN specified for gTLDs only. Country-code registries use their own: .cn says “Expiration Time”, .ru says “paid-till”, and some registries, such as DENIC for .de, publish no expiry date at all. Status values follow the same pattern: WHOIS prints the EPP code (clientTransferProhibited), RDAP the spelled-out form defined in RFC 8056. Both are explained in our domain status code reference.
Where each protocol is used today
Generic TLDs
ICANN has required every gTLD registry and registrar to run RDAP since August 26, 2019. On January 28, 2025, the obligation for registrars and most registries to also provide WHOIS ended. Some operators still answer on port 43 voluntarily, but many have shut their WHOIS servers down, and for gTLD data RDAP is the reference.
Country-code TLDs
Country-code registries are not bound by ICANN's gTLD contracts and choose their own services. Of the 306 active ccTLDs, 81 have an RDAP endpoint in W.is's data; for the rest, W.is uses WHOIS where the registry runs a WHOIS server, and some registries offer only a lookup form on their own website.
Popular ccTLDs that W.is queries over RDAP: .ai, .uk, .ca, .au, .in, .fr, .nl, .is.
Popular ccTLDs with no RDAP endpoint in W.is's data, looked up over WHOIS instead: .io, .co, .me, .de, .cn, .jp, .us, .eu.
The full picture is in the RDAP server list and the WHOIS server list.
How W.is combines RDAP and WHOIS
W.is keeps a built-in list of registry RDAP servers — currently 1,207 TLDs across 594 endpoints — and follows these rules for every domain lookup:
- RDAP first. If W.is has an RDAP server for the TLD, it queries the registry directly over HTTPS.
- Complete answer: if the RDAP record includes the registrar, the creation date and the name servers, W.is shows it as is, labeled “RDAP Data”.
- Filling gaps: if any of those three is missing, W.is also asks the WHOIS server and merges the answers. RDAP values win field by field, WHOIS fills what is missing, status codes from both are combined without duplicates, and both raw responses are shown. The result is labeled “RDAP+WHOIS”.
- Not found: if the registry's RDAP server answers 404, W.is reports the domain as not found and does not ask WHOIS, because the registry has already given an authoritative answer.
- RDAP failure: if the RDAP server times out, rate-limits the request, returns an error or sends something that is not valid JSON, W.is falls back to WHOIS.
- No RDAP endpoint: for TLDs without an RDAP server in W.is's list, W.is goes straight to the registry's WHOIS server on port 43.
Look up any domain to see which source W.is used:
Which one should you use?
- For a quick check, use a client that speaks both, such as W.is. You get the registry's RDAP data where the client has an endpoint for it and WHOIS everywhere else, without having to know which registry supports what.
- In scripts and integrations, use RDAP. Find the server through the IANA bootstrap files, send an
Accept: application/rdap+jsonheader, treat 404 as “not found” and back off on 429. Keep a WHOIS fallback only for TLDs without RDAP. - For ccTLDs without RDAP, WHOIS is still the right tool; some registries also offer a lookup form on their website with extra details.
- Whatever you use, respect each server's terms of use. Most prohibit high-volume automated querying and using the data for unsolicited marketing.
Frequently asked questions
Is WHOIS being shut down?
Not everywhere. For generic TLDs, ICANN removed the contractual requirement for registrars and most registries to run WHOIS on January 28, 2025, and RDAP is now the authoritative source; some operators still run WHOIS voluntarily, but many have switched it off. Many country-code registries still operate WHOIS, and for some it is their only lookup service.
Does RDAP show more information than WHOIS?
Not necessarily. Both protocols usually publish the same underlying registration data and apply the same privacy redactions. RDAP's advantages are that the data is structured and consistently labeled, travels over HTTPS, and can support authenticated access with more detail for requesters who have a legitimate need.
Why do RDAP and WHOIS sometimes show different data for the same domain?
The two services can be run on different systems, refreshed at different times, or queried at different levels: a registry's WHOIS and a registrar's RDAP record, for example. Expiry dates in particular can differ between registry and registrar records around renewal time. When they disagree for a gTLD, treat the registry's RDAP record as authoritative.
Should I use RDAP or WHOIS in my scripts?
Use RDAP whenever the registry offers it: responses are JSON with standard field names, errors use HTTP status codes, and IANA's bootstrap files tell you which server to query. Keep WHOIS as a fallback for TLDs without RDAP, and expect to write registry-specific parsing for it.
Does W.is use RDAP or WHOIS?
Both. W.is uses RDAP whenever it has an RDAP endpoint for the TLD and falls back to WHOIS when it has none or the RDAP server fails. If an RDAP record lacks the registrar, creation date or name servers, W.is fills the gaps from WHOIS, and the result page shows which source the data came from.
Related guides
- What is RDAP? — how RDAP works, with an example query and response.
- RDAP server list — the registry RDAP endpoints W.is queries.
- WHOIS server list — the port-43 WHOIS servers published by IANA.
- TLD list — which top-level domains offer RDAP, WHOIS or both.
- Domain status codes — EPP codes and their RDAP equivalents explained.
- Find a domain owner — what either protocol can tell you about who owns a domain.