WHOIS / RDAP Lookup

Server assisted New DNS & Domains

The Mutqan server finds the registry's own RDAP service through IANA's bootstrap files and shows the registrar, the registration and expiry dates, the EPP status codes, the nameservers and the DNSSEC delegation as the registry publishes them. For top-level domains without RDAP, such as .sa, it asks the registry's WHOIS server on TCP port 43 and shows the text as received; a top-level domain with neither service is reported as unsupported, with a link to its IANA entry.

Privacy: The domain, address or URL you enter is sent from the Mutqan server to the public data service named on this page (a registry, a resolver, a certificate log or a measurement network). Nothing is stored.

What is RDAP, and how does it differ from WHOIS?

RDAP (Registration Data Access Protocol) is how registries publish who registered a domain, an IP address block or an AS number: structured JSON over HTTPS with standard fields for the registrar, dates, status codes and nameservers. It replaces WHOIS, a free-text protocol on TCP port 43 whose layout differs at every registry; a few registries, such as .sa, still offer only WHOIS. Both show what the registry chose to publish, and personal contact data is usually redacted.

How to use WHOIS / RDAP Lookup

  1. Type a domain name, an IP address or an AS number (AS13335 or 13335). A pasted URL is reduced to its host name.
  2. Leave "Look up as" on "Detect automatically", or pick the kind yourself when a value could be read two ways.
  3. Press Look up. The summary shows the registrar and the key dates; the status table explains each EPP code.
  4. For a WHOIS-only top-level domain, read the registry's text in "WHOIS text as received" and download it if you need a copy.

WHOIS / RDAP Lookup features

  • One field for domain names, IPv4 and IPv6 addresses and AS numbers, detected automatically or chosen by hand
  • The registry's own RDAP service, located through IANA's bootstrap files rather than a third-party mirror
  • Registrar with its IANA ID and abuse contact, registration, expiry and last-change dates, nameservers and the DNSSEC delegation (DS records)
  • Every EPP status code explained in plain words: transfer locks, holds, grace periods, redemption and pending deletion
  • For top-level domains without RDAP, such as .sa, the registry's WHOIS text from port 43 exactly as received, with any EPP codes in it explained
  • Host names reduced to the registered name with the Public Suffix List, so www.example.co.uk is looked up as example.co.uk
  • Honest negatives: a registry 404 is shown as "no record", never as "available", and a top-level domain with no registration service is reported as unsupported with a link to its IANA page

Inputs and outputs

Inputs

  • Domain, IP address or AS number: a domain name (internationalised names are accepted), an IPv4 or IPv6 address, or an AS number written as AS13335 or 13335. A pasted URL is reduced to its host.
  • Look up as: Detect automatically (default), Domain name, IP address or AS number.

Outputs

  • Summary: for a domain the name, registrar, registration and expiry dates (with days left), the number of status codes and the source (RDAP or WHOIS) with the server that answered; for an address the network, range, Regional Internet Registry and registered country.
  • Registration record: every published field with its value, including the IANA registrar ID, abuse contacts, last change, the registry's data timestamp and DS records.
  • Status codes: each EPP status with a plain explanation. Nameservers: the delegation the registry holds. Contacts as published: the roles and names the registry chose to show.
  • WHOIS text as received: the registry's raw answer, for top-level domains without RDAP. About this record: notes on expiry, holds, missing data and the registry's notices.

WHOIS / RDAP Lookup example

Registration record of wikipedia.org

Input:

wikipedia.org · Look up as: Detect automatically

Output:

Summary: Domain wikipedia.org · Registrar MarkMonitor Inc. · Registered 2001-01-13 · Expires 2027-01-13 (in 90 days, on 2026-10-14) · Status codes 3 · Source RDAP (rdap.publicinterestregistry.org)
IANA registrar ID: 292 · Abuse contact e-mail: abusecomplaints@markmonitor.com
Status codes: client delete prohibited · client transfer prohibited · client update prohibited
Nameservers: ns0.wikimedia.org, ns1.wikimedia.org, ns2.wikimedia.org
DNSSEC: Not signed: no DS records at the registry

How to read the WHOIS / RDAP Lookup results

"client … prohibited" codes are locks the registrar set and "server … prohibited" codes are locks the registry set. A transfer lock on a domain you own is normally what you want; remove it at your registrar only right before a transfer.

clientHold or serverHold means the name is withdrawn from DNS and does not resolve, whatever the zone holds. autoRenewPeriod after the expiry date means the registry renewed the name automatically but the registrar can still delete it; redemptionPeriod means it was deleted and can be restored for about 30 days; pendingDelete means it is about to be released.

"No record" is the registry's 404: the name has no registration object at that registry. It is not a statement that you can register it.

Contacts showing "REDACTED FOR PRIVACY", a privacy service or nothing at all are normal for most generic top-level domains since 2018. The registrar and its abuse contact are what remains public.

When to use WHOIS / RDAP Lookup

  • Finding the registrar of a domain before a transfer, a renewal or an abuse report.
  • Checking expiry dates, locks and holds while investigating why a domain stopped resolving.
  • Confirming that the nameservers and DS records at the registry match what the DNS provider expects after a migration or a DNSSEC change.
  • Identifying the network and registry that hold an IP address or AS number seen in logs or mail headers.

Troubleshooting

  • "Registry data: Not published": the top-level domain is real but publishes neither RDAP nor a WHOIS server. Follow the IANA root zone database link in the record to find the registry's website.
  • "There is no top-level domain …": the part after the last dot is not in the DNS root zone, usually a typo such as .con for .com. Correct the spelling; there is no registry to ask.
  • The registry's RDAP service is rate-limiting or unavailable: registries throttle by source address and the request comes from shared Cloudflare egress. Wait a minute and try again.
  • "is a public suffix": names such as co.uk or com.sa are operated by the registry itself; enter a name registered under them, such as example.co.uk.
  • Refused as private or blocked: private and reserved addresses (10.0.0.0/8, 192.168.0.0/16, documentation ranges) and single-label names have no public registration record.

Frequently asked questions about WHOIS / RDAP Lookup

Why are the owner's name and e-mail address hidden?

Since the GDPR took effect in 2018, most registries and registrars leave the registrant's personal data out of public registration data or mark it "REDACTED FOR PRIVACY". The tool shows what the registry published. To reach the holder, use the contact form of the registrar named in the record, or its abuse contact for abuse reports.

What is the difference between WHOIS and RDAP?

Both publish registration data. WHOIS (RFC 3912) is free text over TCP port 43, laid out differently by every registry. RDAP (RFC 9082 and RFC 9083) answers structured JSON over HTTPS with standard field names, status values and dates. The tool uses RDAP wherever the registry offers it and falls back to WHOIS only for registries that have no RDAP service.

Why does a .sa domain show plain WHOIS text?

The .sa registry publishes no RDAP service. The Mutqan server sends the name to the WHOIS server IANA lists for the top-level domain (whois.nic.net.sa for .sa) on TCP port 43 and shows that server's answer as it was received, up to 16 KiB. Dates and field names are in the registry's own format and are not reinterpreted.

Does "not found" mean the domain is available?

No. It only means the registry's RDAP service answered 404 for that name. Reserved, blocked and premium names can be missing from RDAP and still not be open for registration. The Domain Availability Checker adds a DNS check, and only a registrar can confirm that a name can be registered.

Why was www.example.co.uk looked up as example.co.uk?

A registry keeps records for registered names only, so the server reduces a host name to its registrable domain with the ICANN section of the Public Suffix List. Asking the registry for www.example.co.uk itself would only return "not found".

Can I look up an IP address or an AS number?

Yes. Addresses and AS numbers are looked up at the Regional Internet Registry that holds them (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC), found through the same IANA bootstrap files. The country shown is the one in the registration record, not the place where the address is used.

Technical notes

RDAP is the HTTPS and JSON successor of WHOIS: RFC 9082 defines the query paths (domain/, ip/, autnum/), RFC 9083 the JSON responses, and RFC 9224 the IANA bootstrap files that map each top-level domain, address block and AS range to its registry's RDAP base URL. The Mutqan server reads those files (cached for up to a day), queries the first HTTPS base URL that answers, and normalises the answer: events, status values, the registrar entity and its abuse contact, nameservers and secureDNS.

Status values follow EPP (RFC 5731, with the grace and redemption states of RFC 3915); RDAP writes them in words ("client transfer prohibited") as mapped by RFC 8056, WHOIS usually in camelCase. Registries without RDAP are asked over the WHOIS protocol of RFC 3912: one line with the name on TCP port 43 and the registry's free-text answer, read up to 64 KiB with a 5-second deadline and shown up to 16 KiB.

Limitations and methodology

Registration data is what the registry publishes; Mutqan does not verify it. Registrant names, e-mail addresses and phone numbers are usually redacted, and registrars may hold more detail than the registry.

WHOIS-only registries are shown as raw text: the tool does not reinterpret their dates or fields, and some registries refuse or throttle queries from shared cloud addresses.

The answer reflects the registry at the time of the query; RDAP data can lag behind the registry database, as its "Registry data updated" timestamp shows.

Security and privacy

The name, address or AS number you enter is sent from the Mutqan server to the registry that holds it: its RDAP service, or its WHOIS server for a WHOIS-only top-level domain (IANA's WHOIS directory may be asked which server that is, given the top-level domain alone). IANA's bootstrap files are downloaded without your query. Nothing is stored; analytics record only that the lookup endpoint was used.

References