WHOIS / RDAP lookup

What this tool checks

The WHOIS / RDAP lookup asks the registry responsible for a domain, IP address, prefix or AS number what it has on record. It uses RDAP, the Registration Data Access Protocol: structured JSON over HTTPS (RFC 9082 for queries, RFC 9083 for responses), the successor to text-based WHOIS on port 43.

You can enter:

• a domain such as example.com (internationalised names are converted to their ASCII form first);
• an IPv4 or IPv6 address or prefix such as 192.0.2.1 or 2001:db8::/32;
• an AS number such as AS64496 or just 64496.

The right server is found through IANA's RDAP bootstrap files (RFC 9224), which list the service for each top-level domain, IP block and AS range. The exact RDAP URL used is linked under the result, so you can read the raw JSON.

It does not fall back to port-43 WHOIS, so a TLD without RDAP gives an error. It shows what the registry publishes, which for domains is often just the registrar, as registrant details are usually redacted. It does not follow on to the registrar's own RDAP server.

For an AS number's peering policy and exchange presence, use the PeeringDB lookup. For the ROAs on a prefix, use the RPKI / ROA validator.

Reading the results

The summary shows whichever of these fields the registry returned:

Contacts lists the entities in the record with their roles, such as registrar, registrant, administrative or technical, where a name is published. For records from the RIPE database only organisations, registrants and abuse contacts are shown: RIPE's terms don't let a public website pass on the personal contacts in it. Look those up in the RIPE database itself.

Registration data belongs to the registry that publishes it and is shown under its terms of use, linked under each result. Use it to run or troubleshoot networks, not for marketing or bulk collection.

The findings:

• Found at shows which registry server answered.
• Expires in N days - a pass with 30 days or more, a warning under 30 days, a failure once the date has passed. Only shown when the registry publishes an expiry date, which is normal for domains and rare for IPs and ASNs.
• Transfer lock is on / off - domains only. A pass if the status includes client transfer prohibited (registrar lock) or server transfer prohibited (registry lock), otherwise a warning.
• DNSSEC is enabled at the registry - a pass for a signed delegation; otherwise a note for information.

Common problems and fixes

"That TLD has no RDAP service (WHOIS only)"

Some country-code top-level domains have not published an RDAP service in the IANA bootstrap. Use the registry's own website or a port-43 WHOIS client for those.

Domain expiring soon

Renew it at your registrar, switch on auto-renew and check the payment card on the account.

Transfer lock is off

Turn on the registrar lock (often called "domain lock" or "transfer lock") in your registrar's control panel. It sets clientTransferProhibited, so the domain cannot be moved to another registrar until you unlock it. A registry lock (serverTransferProhibited) counts too. Some registries offer neither, in which case the warning cannot be cleared.

DNSSEC not enabled

If your DNS provider signs the zone, publish its DS record through your registrar. Check the result with the DNSSEC check.

Finding who to contact about an IP address

Look for Abuse contact. For the network that actually announces the address, cross-check with the ASN & BGP prefix lookup, which shows the origin AS.

FAQ