RDAP vs WHOIS: What Replaced WHOIS and Why It Matters
On 28 January 2025 ICANN dropped the requirement to run WHOIS at all. If your tooling still queries port 43, it is reading a service nobody is obliged to keep running. Here is what changed and what to use instead.
September 9, 20265 min readRDAP · WHOIS · Domain data
The short answer. On 28 January 2025, ICANN removed the contractual obligation for gTLD registries and registrars to run WHOIS on port 43. RDAP is now the definitive source for registration data. Port 43 is being switched off gradually rather than all at once, so plenty of servers still answer, but nobody is required to keep them running.
If you have ever run a WHOIS lookup and got a different answer from a different tool, this is the article that explains why, and why that particular problem is now mostly solved.
WHOIS, and what was wrong with it
WHOIS dates to 1982. It speaks plain text over port 43, and it has served the internet for four decades.
Its defining weakness is that it never specified a response format. Every registry invented its own layout. Field names differ, dates are formatted inconsistently, and status information appears in whatever shape each operator chose.
This is why two WHOIS tools can disagree about the same domain. They are not querying different data. They are parsing the same loose text with different guesses, and one of them guessed wrong.
For a human reading one domain, that is a minor annoyance. For any software making decisions about thousands of domains, it is a permanent source of quiet errors.
Other problems compounded it: no proper internationalisation, no standard authentication, no way to give different answers to different requesters, and no encryption on the wire.
RDAP, and what it fixed
The Registration Data Access Protocol is the replacement, defined across IETF RFCs 7480 to 7484 and updated by RFC 9224.
| WHOIS | RDAP | |
|---|---|---|
| Introduced | 1982 | 2015 |
| Transport | Port 43, plain text | HTTPS |
| Response format | Whatever the registry chose | Structured JSON |
| Field names | Inconsistent | Defined by specification |
| Internationalisation | Poor | Full Unicode |
| Access control | None | Granular, by requester |
| Encryption | No | Yes |
| Errors | Free text | Standard HTTP status codes |
The practical difference is that RDAP returns data you can rely on programmatically. A field means the same thing everywhere. A date parses the same way everywhere. An HTTP status code tells you what happened without needing to interpret prose.
The bootstrap
RDAP also solved discovery. IANA publishes a bootstrap registry listing which RDAP server is authoritative for each extension. A client reads it, then queries the registry that actually operates the extension.
That matters more than it sounds. It is the difference between asking the authoritative source and asking an intermediary's cached copy, and it is why our checker routes every lookup through the IANA bootstrap rather than a third-party aggregator.
What actually changed in 2025
ICANN sunsetted the WHOIS requirement on 28 January 2025. Specifically, it removed the contractual obligation for gTLD registries and registrars to operate WHOIS on port 43, and made RDAP the definitive source for gTLD registration data.
Three things follow.
Nobody is obliged to answer on port 43 any more. Some still do, and the shutdown is gradual rather than a single switch. But a WHOIS query that fails is no longer a bug at the other end.
RDAP is the system of record for gTLDs. If the two ever disagree, RDAP is the answer.
Legacy tooling is on borrowed time. Anything in your stack that queries port 43 will keep working until the specific server it depends on stops, and then it will fail without warning.
This is not the same as the data changing. Registrant details were already redacted long before this, for GDPR reasons. The 2025 sunset changed the protocol, not what the record contains. What is and is not public is a separate question.
What a lookup actually tells you
Whichever protocol you use, the useful fields are the same:
| Field | What you learn |
|---|---|
| Registrar | Who sponsors the domain |
| Creation date | How long it has existed |
| Expiry date | When it lapses |
| Updated date | Whether it is actively managed |
| Nameservers | Where it points, and often who hosts it |
| Status codes | Locks, disputes, and expiry stage |
Status codes are the most underused of these. They are the authoritative answer to whether a domain can be transferred, whether it is expired, and how far through the deletion lifecycle it has travelled. A name showing pendingDelete is exactly five days from release. A name showing redemptionPeriod is still its owner's.
That is the difference between guessing at a drop date and knowing one.
Why this matters for availability checks
Here is the part that affects anyone building on this data.
With WHOIS, deciding whether a domain is registered meant parsing unstructured text and looking for phrases like "No match" or "NOT FOUND", which every registry words differently. Get the parsing wrong and you tell someone a registered domain is free.
With RDAP you get a structured response and an HTTP status together. A standards-shaped 404 from the authoritative RDAP server is strong evidence that no registration object exists.
Strong evidence, not proof. An HTTP status alone should never be presented as a guarantee of registrability. Unrecognised error bodies, rate limiting and registry-specific quirks all still need cautious handling, and a domain can be technically unregistered while still being unavailable to you because of registry premium pricing or eligibility rules.
Any tool that treats a single status code as certainty will eventually tell you a name is free when it is not.
What to do about it
If you use lookups occasionally, nothing. Use a tool that speaks RDAP and you will not notice the transition.
If you have scripts querying port 43, migrate them. They work today at some registries and will fail silently at others, at a time you do not choose.
If you are building on this data, go through the IANA bootstrap, treat status codes as first-class, and do not collapse an ambiguous response into a confident answer.
If you rely on country extensions, check individually. The 2025 sunset applies to gTLDs. Country-code registries set their own policy, and many still run WHOIS, some with no RDAP service at all.
In one line
WHOIS was a 1982 protocol asked to do a job it was never designed for, and as of January 2025 it is no longer required to exist. RDAP does the same job with structure, encryption and a defined format, which is what makes automated domain data trustworthy rather than approximately right.
Run a lookup and you will see the structured version: dates, nameservers, registrar and status codes, from the registry that actually operates the extension.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain