WHOIS and RDAP explained: how to look up who owns a domain

WHOIS and RDAP are two ways to look up the registration record of a domain name. WHOIS is the older text-based system, and RDAP is the newer standardized replacement. A lookup shows when a domain was created, which registrar holds it and when it expires, but it often will not show the owner's name because of privacy rules.

For founders, investors and anyone buying a startup, that record is still a useful source of clues. This guide explains how the two systems differ, what you can and cannot learn, and how to read the results.

What WHOIS is

WHOIS is a decades-old protocol that returns registration data for a domain. If you looked up a domain years ago, you would typically see a block of plain text with the registrant's name, address, email and phone number, plus technical details such as name servers.

The format was never fully standardized. Different registries and registrars returned data in different layouts, which made automated parsing messy. It also exposed personal information to anyone who asked, which became a problem for privacy and for spam.

What RDAP is

The Registration Data Access Protocol, or RDAP, is the successor. According to ICANN's RDAP page, it was developed by the IETF technical community as a replacement for WHOIS that provides current registration data. It returns WHOIS-like data, but uses standardized data access and query response formats.

ICANN lists several improvements. RDAP supports internationalization, it allows secure access to data, and it can locate the authoritative servers for a given name. In practice, an RDAP response is structured data (JSON) rather than a free-form text block, so software can read it reliably.

WHOIS versus RDAP at a glance

Feature	WHOIS	RDAP
Output format	Free text, varies by registry	Structured JSON, standardized
Internationalization	Limited	Supported
Access control	Mostly open or rate limited	Designed for secure and tiered access
Finding the right server	Manual or guesswork	Built-in discovery of authoritative servers
Status	Being phased out for many domains	The required service for gTLDs

When WHOIS was phased out

ICANN states that as of January 28, 2025, generic top-level domain registries and registrars are no longer required to provide WHOIS services. There is an exception for .com, .name and .post. All gTLD registries and registrars must provide RDAP under the gTLD RDAP Profile.

That does not mean WHOIS vanished overnight. Many providers still run WHOIS servers, and many lookup websites still use the word "WHOIS" for what is now often an RDAP query. When you see a WHOIS lookup tool in 2026, there is a good chance it is fetching RDAP data behind the scenes.

Country-code domains such as .ai, .io and .de are run under their own rules, so their lookup options differ. Check the registry's own site if a generic tool returns little.

What a domain lookup usually shows

A typical record includes:

• Domain name and status. For example whether it is active, locked or pending deletion.
• Creation date. When the domain was first registered.
• Last updated and expiry dates. Useful to see whether a domain is about to lapse.
• Registrar. The company that sold or manages the registration.
• Name servers. These hint at the DNS host, which sometimes reveals the hosting or CDN provider.
• Registrant, admin and technical contacts. Often redacted or replaced with a privacy service.

Why you often cannot see the owner

Since the introduction of privacy regulations such as GDPR in 2018, many registrars hide personal contact data by default. Even before that, privacy services were popular. You will often see "Redacted for privacy" or a proxy company in place of a name.

This is normal and not a sign of wrongdoing. Plenty of legitimate startups use privacy protection, and it keeps founders' home addresses off the internet.

When you really need to reach the owner, there are other routes:

• Use the contact form or the email shown on the website.
• Use the registrar's relay email if the record provides one. Some domains list a contact form that forwards messages.
• Check the site footer, the privacy policy, and company registers for a legal entity name.
• If the domain is parked, look for a "for sale" notice or a marketplace listing.

Respect privacy and local law. Do not use lookup data to harass anyone or to send unsolicited bulk email.

How founders use domain records

Judging how established a site is

The creation date tells you when the domain was registered, not necessarily when the site launched. It is still a quick sanity check. If a seller says a business has operated for five years but the domain was registered last month, ask questions. For more on whether an old domain matters for rankings, see domain age and SEO.

Due diligence when buying a startup

If you are evaluating a purchase on the buy-a-startup marketplace or elsewhere, confirm that the seller can really control the domain. Check the registrar, the expiry date and the lock status. Ask the seller to prove control by changing a DNS record or by logging into the registrar account during a call. A domain transfer is a core part of any acquisition.

Spotting expiring or abandoned domains

An expiry date in the past or near future can mean opportunity or risk. A competitor's domain that is about to lapse might be a signal that the product is being dropped. Remember that registries use grace and redemption periods, so an expired date does not always mean the domain is instantly available.

Checking for look-alike or brand-abuse domains

If you own a brand, search for domains that imitate it. Registration dates and registrars help you decide whether to contact the registrar or file a dispute.

Understanding competitors' infrastructure

Name servers and registrar choice hint at how a company runs its stack. Combine them with tech stack detection for a fuller picture.

How to run a lookup

1. Enter the domain into a lookup tool or the registry's own search.
2. Note the creation, update and expiry dates.
3. Read the status flags. "clientTransferProhibited" is a common lock and is usually a good sign.
4. Check the name servers and registrar.
5. Look for contact details or a privacy notice.
6. If the record seems thin, query the registry's RDAP service directly.

The StartupsIntel traffic checker includes WHOIS data via RDAP in each site report, next to modelled traffic, an SEO audit and a tech stack. You can also compare many domains in the bulk checker. If you are still choosing a name, the TLD checker helps you see which extensions are available.

Limits of the data

Registration records show a snapshot. They can be out of date, incomplete or deliberately minimal. A creation date can reset if a domain is dropped and re-registered. Privacy services mean you cannot always identify the true owner. Treat WHOIS and RDAP as one clue among several, and verify important claims through other means such as company registers, payment provider dashboards and direct conversation.

FAQ

Is RDAP replacing WHOIS completely?

For generic top-level domains, yes in practice. ICANN says registries and registrars are no longer required to provide WHOIS as of January 28, 2025, apart from an exception for .com, .name and .post. RDAP is the required service.

Why does a lookup show "redacted for privacy"?

Registrars hide personal data to comply with privacy laws and to protect domain owners. The record can still show dates, the registrar and name servers, which are often enough for basic research.

Can I find out who owns any domain?

Not always. If the owner uses privacy protection, the record will not name them. You can contact them through the website or the registrar relay, or look for company information on the site itself.

What is the most useful field for startup research?

The creation date and the expiry date are usually the most useful, together with the registrar and name servers. They help you check claims about a business's age and confirm that the domain is properly maintained.