Blog/
RDAP vs WHOIS: what changed for domain and IP lookups
RDAP replaces classic port-43 WHOIS with structured data. Learn the difference for domain and IP lookups — and when fields are redacted.
WHOIS traditionally meant a plaintext query on port 43. RDAP (Registration Data Access Protocol) is the modern HTTP+JSON successor used by RIRs and many TLDs. Tools increasingly speak RDAP under the hood even when the UI still says “WHOIS.”
Practical differences
- RDAP returns structured fields (status, events, nameservers, entities).
- WHOIS output varies by registry and is harder to parse reliably.
- Privacy redaction is common in both under GDPR-style rules.
- IP blocks and domains use different RDAP services — do not mix them up.
Domain lookup vs IP lookup
Domain RDAP answers registrar-side questions: status codes, nameservers, expiration events when published. IP RDAP answers which organization holds a prefix. Investigating phishing often needs both: domain registration plus hosting IP ownership.
Free public RDAP — no paid WHOIS API.
Why owner email may be missing
Redacted contacts are normal. Use published abuse contacts on the IP network object, registrar forms, or hosting abuse desks. Historical WHOIS archives are separate commercial products — not part of a live RDAP query.