DNS & domain

What is RDAP? Registration Data Access Protocol explained

RDAP is the successor of WHOIS and provides a domain's registration data in machine-readable form: registrar, status, locks and expiry date.

How RDAP works

RDAP queries the registry or registrar via HTTPS and returns structured JSON data. Which server is responsible for a top-level domain is listed by IANA (bootstrap).

Three items matter most for protecting a domain: the expiry date, so the domain does not lapse by accident; the status locks against transfer and deletion; and critical states such as "clientHold" or "redemptionPeriod", in which the domain no longer works or is about to be deleted.

Not every top-level domain offers RDAP; for .de the IANA list currently names no RDAP server. The criterion is then not applicable in the Domain Trust Check.

Example

{
  "ldhName": "example.com",
  "status": ["client delete prohibited", "client transfer prohibited", "client update prohibited"],
  "events": [{ "eventAction": "expiration", "eventDate": "2027-10-31T23:59:59Z" }]
}

Simplified, schematic excerpt of an RDAP response: locks and expiry date.

Common mistakes

• The domain expires because auto-renewal is switched off or the payment failed.
• No transfer lock – an attacker with access to the registrar account can move the domain more easily.
• Critical states such as clientHold go unnoticed until website and email fail.

How the Domain Trust Check rates RDAP

Criterion “Domain registration” (weight 3 of 5): Registration data via RDAP (successor of WHOIS): expiry date plus transfer, delete and update locks against domain hijacking.

Standard: RFC 9082, RFC 9083

Related terms

• Registrar lock
• Nameservers