WHOIS: the legacy domain lookup protocol
WHOIS is a simple text-based query-response protocol defined in RFC 3912. A client sends a domain name to port 43 of a WHOIS server; the server returns an unstructured text block.
Its limitations include plain text, no standard authentication or privacy tiers, inconsistent fields, and weak internationalization support. Since 28 January 2025, RDAP has been the definitive source for gTLD registration data, and most gTLD registries are no longer required to provide WHOIS. Exceptions may apply to specific registry agreements, so operators should confirm their current contractual scope.
RDAP: the modern replacement
RDAP (Registration Data Access Protocol), defined in RFC 7480–7484, is ICANN's required replacement for WHOIS. ICANN mandated RDAP support for all contracted parties (registries and registrars) by August 26, 2019.
Key improvements over WHOIS:
- JSON format: Machine-readable, structured data — easier for automated tools
- HTTPS transport: Encrypted queries and responses
- Authentication support: Different data can be returned based on who is asking (registrar, registrant, law enforcement, public)
- Internationalization: Full IDN support
- Standardized fields: Consistent structure across all registries
- Referrals: A registry RDAP server can refer queries to a registrar's RDAP server for more complete data
- Pagination: For bulk queries or multiple results
For TLD operators, RDAP must be available at the IANA-registered bootstrap URL and must return RFC-compliant responses. ADG's RSP service includes a fully compliant RDAP implementation that passes ICANN's technical review.
EPP: how registrars provision domains
EPP (Extensible Provisioning Protocol), defined in RFC 5730–5734, is the XML-based protocol that registrars use to manage domain registrations in a registry's SRS (Shared Registration System).
EPP commands registrars use:
| Command | Purpose |
|---|---|
| `<check>` | Check if a domain name is available |
| `<create>` | Register a new domain |
| `<info>` | Retrieve domain details |
| `<update>` | Modify domain details (nameservers, contacts) |
| `<delete>` | Delete a domain |
| `<renew>` | Extend a domain's registration period |
| `<transfer>` | Transfer a domain between registrars |
| `<poll>` | Retrieve pending server notifications |
EPP sessions are TLS-encrypted. Registrars connect to the registry's EPP server, authenticate with a certificate, and send/receive XML messages. The registry's SRS processes each command and updates the zone accordingly.
For new gTLD applicants, ICANN requires the SRS/EPP system to be operational before TLD delegation. The RSP builds, hosts, and maintains this system on behalf of the registry operator.
How RDAP and EPP work together—and where legacy WHOIS may remain
RDAP and EPP serve different needs:
| Protocol | Users | Purpose |
|---|---|---|
| RDAP | Public and authorized parties under access policy | Structured registration data lookup |
| EPP | Registrars | Register and manage domains |
| Legacy WHOIS | Legacy systems | Compatibility where still provided |
A registrar checks and creates a domain through EPP. The SRS stores the transaction, the zone is updated, and permitted registration data becomes available through RDAP. Later changes follow the same flow. WHOIS follows this flow only where it is retained under the agreement or for compatibility.
ADG provides EPP/SRS and RDAP, with legacy WHOIS based on the agreed scope.
Frequently asked questions
Is WHOIS going away?
For most gTLD registries, WHOIS ceased to be a contractual requirement on 28 January 2025 and RDAP became the definitive source for registration data. A small number of registry agreements have exceptions, and some operators may retain WHOIS for compatibility. Check the applicable agreement before defining scope.
Can registrants hide their information from WHOIS/RDAP?
Yes, via WHOIS privacy (proxy) services. When privacy is enabled, a privacy proxy organization's contact details are shown instead of the registrant's personal information. ICANN's RDAP policies provide mechanisms for registrars and registries to redact personal data for GDPR compliance while making data available to authorized parties.
What is EPP extension and do new gTLDs need them?
EPP supports extensions that add functionality beyond the base protocol. Common extensions for new gTLDs include: DNSSEC extension (RFC 5910) for registrants to submit DS records, Launch Phase extension (RFC 8334) for Sunrise/Landrush periods, and ICANN-specific extensions for fee negotiation and domain verification. ADG's EPP implementation supports all ICANN-required extensions.