On 28 January 2025, the Registration Data Access Protocol (RDAP) became the definitive source for generic top-level domain registration information, replacing sunsetted WHOIS services.
For most businesses this passed without notice. But if you have ever tried to find out who owns a domain — a lookalike of your own, one you would like to buy, or one registered in a former supplier’s name — the ground has shifted under you.
What RDAP actually changes
WHOIS was a protocol from the early internet. It returned a block of loosely formatted text that varied between registries, was difficult to parse reliably, and had no meaningful access control. RDAP returns structured, standardised data over HTTPS, supports internationalised data properly, and — critically — allows for differentiated access.
That last point is the one with consequences. RDAP makes it possible to show different levels of detail to different requesters, rather than the all-or-nothing approach WHOIS took.
What you can still look up
Plenty, and it is more useful than people assume:
- Whether a domain is registered at all
- The registrar administering it
- Creation, expiry and last-updated dates
- Domain status codes — including whether transfer locks are applied
- Nameservers, which tells you who runs the DNS
- Organisation name, where the registrant is a company rather than an individual
For a business checking its own exposure, that is usually enough. Expiry dates and status codes are the two that matter most, and both remain public.
What you generally cannot
Personal contact details. Since GDPR came into force in 2018, registration data for individuals has been largely redacted, and RDAP does not change that. If a domain is registered to a private individual, you will usually see a redacted record or a privacy-service placeholder rather than a name and address.
For .uk domains, Nominet operates its own system and allows individuals who are not trading to opt out of having their address published. Business registrants are generally visible.
The practical implications
If you are checking your own domains, do not rely on a public lookup to confirm ownership. Ask your registrar directly, as the account holder, for written confirmation of the registrant of record. That is the authoritative answer, and a reputable provider will supply it in minutes.
If you are investigating a lookalike domain, you will often hit a redacted record. That is not a dead end — the creation date, registrar and nameservers still tell you a great deal about whether it is a parked speculation or something actively being used against you.
If you are trying to buy a domain, most registrars now operate a contact-forwarding mechanism so you can reach a registrant without seeing their details.
If you use monitoring tools, check they have migrated. Anything still pointing at legacy WHOIS endpoints for gTLDs is working from an incomplete picture.
The bigger point
The direction of travel is clear: registration data is becoming less publicly visible, not more. That makes it considerably more important to have your own records straight, because you can no longer rely on looking your own domains up in public to check.
Our portfolio audit establishes exactly what your business owns, who each domain is registered to, when it expires and what security settings are applied — from both public records and direct registrar confirmation. You get it in writing.
Call 01202 835235 or email contact@domainwarden.co.uk.