ADG Logo
Registry Operations7 min read

WHOIS vs RDAP — EPP Explained for TLD Operators

WHOIS and RDAP are public-facing protocols that allow anyone to look up registration information for a domain name. EPP (Extensible Provisioning Protocol) is the back-channel protocol that registrars use to register, renew, transfer, and manage domains in the registry's Shared Registration System. All three are required for ICANN-compliant TLD operations.

WHOIS: the legacy domain lookup protocol

WHOIS is a simple text-based query-response protocol defined in RFC 3912. A client sends a domain name to port 43 of a WHOIS server; the server returns a text block with registration information.


A typical WHOIS response includes:

  • Registrant name, organization, address (where not redacted for privacy)
  • Administrative and technical contacts
  • Registrar name and IANA ID
  • Registration and expiry dates
  • Name servers
  • Domain status codes (active, clientTransferProhibited, etc.)

    • WHOIS limitations:

  • Plain text — no structured data format
  • No authentication — same data for everyone
  • No privacy tiers — limited ability to filter sensitive data
  • No standard error codes
  • No support for internationalized domain names (IDN)
  • Inconsistent field formats across registries

    • Despite these limitations, WHOIS remains widely used and is required by most registry agreements. ICANN has mandated a transition to RDAP, but WHOIS support is still required.

    RDAP: the modern replacement

    RDAP (Registration Data Access Protocol), defined in RFC 7480–7484, is ICANN's required replacement for WHOIS. ICANN mandated RDAP support for all contracted parties (registries and registrars) by August 26, 2019.


    Key improvements over WHOIS:


  • **JSON format:** Machine-readable, structured data — easier for automated tools
  • **HTTPS transport:** Encrypted queries and responses
  • **Authentication support:** Different data can be returned based on who is asking (registrar, registrant, law enforcement, public)
  • **Internationalization:** Full IDN support
  • **Standardized fields:** Consistent structure across all registries
  • **Referrals:** A registry RDAP server can refer queries to a registrar's RDAP server for more complete data
  • **Pagination:** For bulk queries or multiple results

    • For TLD operators, RDAP must be available at the IANA-registered bootstrap URL and must return RFC-compliant responses. ADG's RSP service includes a fully compliant RDAP implementation that passes ICANN's technical review.

    EPP: how registrars provision domains

    EPP (Extensible Provisioning Protocol), defined in RFC 5730–5734, is the XML-based protocol that registrars use to manage domain registrations in a registry's SRS (Shared Registration System).


    EPP commands registrars use:


    CommandPurpose
    `<check>`Check if a domain name is available
    `<create>`Register a new domain
    `<info>`Retrieve domain details
    `<update>`Modify domain details (nameservers, contacts)
    `<delete>`Delete a domain
    `<renew>`Extend a domain's registration period
    `<transfer>`Transfer a domain between registrars
    `<poll>`Retrieve pending server notifications

    EPP sessions are TLS-encrypted. Registrars connect to the registry's EPP server, authenticate with a certificate, and send/receive XML messages. The registry's SRS processes each command and updates the zone accordingly.


    For new gTLD applicants, ICANN requires the SRS/EPP system to be operational before TLD delegation. The RSP builds, hosts, and maintains this system on behalf of the registry operator.

    How WHOIS, RDAP, and EPP work together

    The three protocols serve different audiences and purposes in the TLD ecosystem:


    ProtocolAudiencePurposeDirection
    WHOISPublic (anyone)Look up registration infoRegistry → Public
    RDAPPublic + authenticatedStructured registration lookupRegistry → Public
    EPPRegistrars onlyProvision and manage domainsRegistrar → Registry

    The lifecycle of a domain registration:

  • A registrar checks availability using EPP `<check>`
  • The registrar creates the domain using EPP `<create>` — the SRS stores the registration data
  • The registry's zone is updated to include the domain's nameservers
  • Registrant data becomes queryable via WHOIS and RDAP
  • The registrar uses EPP `<update>` when the registrant changes their nameservers
  • WHOIS/RDAP reflect the updated nameservers after propagation

    • ADG's RSP service provides all three: EPP/SRS backend, WHOIS service, and RDAP API — each tested and compliant with ICANN's technical requirements.

    Frequently Asked Questions

    Is WHOIS going away?

    WHOIS is being gradually replaced by RDAP, but there is no firm sunset date. ICANN requires both WHOIS and RDAP for new gTLD registries currently. Over time, RDAP is expected to become the primary protocol as ICANN deprecates WHOIS requirements.

    Can registrants hide their information from WHOIS/RDAP?

    Yes, via WHOIS privacy (proxy) services. When privacy is enabled, a privacy proxy organization's contact details are shown instead of the registrant's personal information. ICANN's RDAP policies provide mechanisms for registrars and registries to redact personal data for GDPR compliance while making data available to authorized parties.

    What is EPP extension and do new gTLDs need them?

    EPP supports extensions that add functionality beyond the base protocol. Common extensions for new gTLDs include: DNSSEC extension (RFC 5910) for registrants to submit DS records, Launch Phase extension (RFC 8334) for Sunrise/Landrush periods, and ICANN-specific extensions for fee negotiation and domain verification. ADG's EPP implementation supports all ICANN-required extensions.

    ADG Service

    ADG RSP — EPP, WHOIS & RDAP Services

    Learn more →