PermitANY
Tool · Network

WHOIS Lookup

Registration data over RDAP, the structured JSON successor to port-43 WHOIS. The TLD is resolved against IANA's bootstrap registry and the query goes to whichever registry is responsible; an IP address is queried as an allocation record. Runs server-side against the registry — nothing is stored.

An empty answer is not an available domain

This is the misreading that costs money and time, and it has three causes that look the same from here.

  • The registry publishes no RDAP at all. RDAP is mandatory for gTLDs and optional for country-code registries, and many never adopted it — .de, .it, .es and .io among them. With no entry in IANA's bootstrap registry there is no endpoint to ask, and this page says so rather than reporting a not-found it never received. A missing service and a missing registration are different facts.
  • Rate limiting. RDAP services throttle, and an error after several rapid queries is an error about your query volume.
  • Genuinely unregistered — which still is not available. A domain can be unregistered and unavailable: in the redemption grace period after deletion, held by the registry, reserved or trademark-blocked, or already in an auction. Availability is a registrar's question, not RDAP's.

Redacted contacts are policy, not evasion

The names and phone numbers every record carried before 2018 are gone because publishing the personal data of every domain holder was not compatible with data protection law. Registries return entities with a role and little else; privacy and proxy services cover the rest. So "REDACTED FOR PRIVACY" is the normal, lawful state of a contact field and says nothing about intentions. Attribution is not what this record is for any more. Three fields still are:

  • The registration date is the most informative field left. A domain registered four days ago and used in a message claiming to be an established company is a finding on its own, and age is a signal no redaction policy removes.
  • The registrar is still named. It is who you file an abuse report with, and some registrars are heavily over-represented in abuse data.
  • The status codes are operational facts. clientTransferProhibited is the healthy state of a locked domain; serverHold means the registry pulled it out of DNS entirely; and pendingDelete means the clock is running.

What the record cannot tell you

It describes the registration, not the service. A registrant is often not the operator of what the domain points at; the registry's nameservers are a delegation, not proof of what DNS answers; and for an IP address the allocation holder is an ISP or hosting company whose customer is the party you want. Two domains sharing a registrar or a nameserver provider share a supplier used by millions, which is not a link between them.

An IP record is a different object: a block allocated by a regional registry, with a range, an organisation and a country — and that country is the registered organisation's, routinely not where the addresses are used.

Fields in the RDAP response

ldhNameThe domain in letters-digits-hyphens form; an internationalised name also carries its Unicode form
eventsDated actions: registration, expiration, last changed, last update of RDAP database
statusEPP status codes — clientTransferProhibited, serverHold, pendingDelete and the rest
nameserversThe delegation as the registry holds it, which can differ from what DNS answers
entitiesRegistrar, registrant, administrative and technical roles, usually mostly redacted
handleThe registry's own identifier for the object, useful when correlating records

This structure is why RDAP is worth the switch from port-43 WHOIS. Legacy WHOIS returns free text whose layout each registry invented for itself, which is why every WHOIS parser ever written is a pile of per-registry special cases. RDAP returns the same JSON shape everywhere, over HTTPS, with real status codes — so a script that reads it keeps working when a registry changes its output.

When to use something else

For what DNS answers now rather than what the registry delegates, use the DNS lookup, and for the posture of a zone, dns-security-analyzer covers SPF, DMARC, DNSSEC and the delegation problems a registration record never shows. For the network behind an address, the IP geolocation gives the ASN and operator, and IP reputation its report history.

If the domain arrived in a suspicious message, the registration date belongs in a wider picture: email-header-analyzer reads the path the message took and phishing-email-analyzer works the whole message. For many indicators at once, threat-intel-lookup is scriptable where this page is one query at a time.