travel_explore Whois Lookup (Domain & IP — RDAP) star

How It Works

Enter a domain or an IP address and the lookup queries RDAP — the Registration Data Access Protocol — the IETF's structured, JSON-based successor to the original 1982 WHOIS protocol (plain-text answers over TCP port 43). The query goes from your browser to the rdap.org bootstrap service, which reads the domain's TLD (or the IP's allocation block) and redirects the request to whichever registry is actually authoritative for that name — Verisign for .com, EURid for .eu, a regional internet registry like ARIN or RIPE for IP blocks, and so on. That routing step matters because there is no single central WHOIS server for the whole internet; every TLD is served by a different registry, each historically with its own text format, field names and quirks — exactly the mess RDAP was designed to fix by returning a consistent, machine-readable JSON structure regardless of which registry answers.

For a domain, the response typically includes the registrar (the company the domain was purchased through, not necessarily who runs the registry), creation, expiry and last-updated dates, the domain's EPP status codes, and the authoritative name servers currently on file. EPP status codes are worth reading carefully: clientTransferProhibited means the registrar has locked the domain against unauthorized transfer — a good sign, since it's exactly the protection that prevents domain hijacking; clientHold or serverHold means the domain has been pulled from the DNS entirely and won't resolve; pendingDelete means the domain is in its final redemption window before being released back into the available pool. For an IP address, the same RDAP infrastructure instead returns the owning network block and the regional internet registry (ARIN for North America, RIPE for Europe, APNIC for Asia-Pacific, and so on) that allocated it — useful for tracing which organization or hosting provider a given server IP actually belongs to.

One thing this tool won't show for most domains: the registrant's personal name, email or phone number. Since GDPR took effect in 2018, registries and registrars redact personal WHOIS/RDAP data at the source for any registrant who is (or might be) an individual in a jurisdiction the regulation covers — this isn't something a lookup tool can work around, since the data is masked before it ever leaves the registry. Some registrants use a privacy/proxy service that keeps a permanent stand-in contact even outside GDPR's reach; either way, a redacted registrant is normal and doesn't indicate anything is wrong with the domain.

What to Know

• What remains visible after GDPR redaction — dates, registrar, status codes, name servers — is usually enough to judge a domain's age, expiry risk and transfer-lock state.
• Nearly all generic TLDs and most country-code TLDs support RDAP; a handful of ccTLDs still only offer legacy WHOIS and return no data here.
• A domain nearing its expiry date isn't necessarily abandoned — check the status codes (autoRenewPeriod, redemptionPeriod) alongside the date before assuming so.