How to read a domain's RDAP record, and what redaction hides

Every registered domain has a public record: who holds it, when it expires, where its DNS lives and what operations it currently permits. The modern way to read it is RDAP, the Registration Data Access Protocol, which has replaced WHOIS at essentially every registry that matters.

The practical difference is that RDAP returns structured JSON rather than free text formatted differently by every registrar. You can read it, and so can a script.

Getting the record

Without jq the output is one long line, so pipe it through python3 -m json.tool instead. In a browser, lookup.icann.org renders the same data without the JSON.

1. Status codes: what the domain will allow

This is the field worth reading first. Status codes are EPP codes, and they describe the operations the domain currently permits. Codes beginning client were set by the registrar and can usually be changed in its panel; codes beginning server were set by the registry and cannot.

• ok or active — nothing unusual. Notably, this also means no transfer lock, which is not the state a live business domain should be sitting in.
• clientTransferProhibited — the ordinary transfer lock. On by default at most registrars, and it should stay on; it is what stops somebody who gets into your account from moving the domain away. Turn it off for the hour you are actually transferring.
• clientUpdateProhibited and clientDeleteProhibited — stronger locks, worth enabling on a domain the business depends on.
• clientHold or serverHold — the domain has been removed from DNS. The site and the mail are down. Usually non-payment or an ignored contact-verification email.
• pendingTransfer — a transfer is in progress. If you did not start it, treat it as an emergency.
• redemptionPeriod — the registration was deleted and is inside its 30-day recovery window. Restorable, with a fee.
• pendingDelete — past redemption. The domain is queued for public release and is effectively gone.
• autoRenewPeriod — the registry has renewed it and the registrar is within the window to reverse that. Normal.

clientHold is the one to recognise on sight, because it is indistinguishable from an outage to everyone who is not looking at this record. What happens when a domain expires covers how a domain gets there.

2. Events: the dates that matter

RDAP puts dates in an events array, each with an eventAction:

• registration — when the domain was first created. A recent date on a domain claiming to be an established business is a useful signal.
• expiration — the one to put in a calendar. Independently of whatever the registrar's dashboard says.
• last changed — the last modification of any kind. An unexpected recent change on your own domain deserves a look at the account it was made from.
• transfer — the last time it moved registrar. Within the last 60 days means it cannot be transferred again yet.

3. Nameservers: where the DNS actually is

The nameservers array is authoritative in a way a hosting control panel is not: it is what the registry will tell the world to ask. If these do not point where you think your DNS lives, nothing you change in a DNS panel will have any effect, because nobody is asking that panel.

This is the first thing to check when a DNS change appears to do nothing at all. The DNS records a small business needs covers what belongs in the zone once you have established which zone is live.

4. Entities: who holds it, and why most of it is blank

The entities array carries the parties, each with a roles list — registrant, administrative, technical, abuse, and the registrar itself. On almost any domain you look up today, the registrant's name and email will be absent or replaced with something like REDACTED FOR PRIVACY.

This is expected, not suspicious. Since GDPR, registrars withhold registrant personal data from public output as a matter of course, for everyone rather than only for Europeans. The data still exists at the registrar; it is simply not published.

Redaction is not the same as privacy protection. Redaction is the registrar declining to publish data it holds about you. A privacy or proxy service substitutes a third party as the published contact and sometimes as the legal contact. Both result in a record you cannot read; only one changes who the registry thinks it is dealing with.

What survives redaction is usually enough: the registrar name, the abuse contact, and the registrant's country and sometimes state. The registrar name is the useful part — it tells you which company's account the domain lives in, which is where every real question gets answered.

Proving a domain is yours when the record is redacted

Because the public record no longer names anybody, it cannot be used as evidence of ownership. Three things can:

1. Logging into the registrar account, under your own credentials, and seeing the domain there. This is the test that actually settles it.
2. Publishing a DNS TXT record that somebody asked you for. Only whoever controls the zone can do this, which is why every platform that needs to verify a domain asks for one.
3. Receiving mail at the registrant address on record. This is what the transfer-approval email relies on, and it is the mechanism that quietly fails when the address is on a domain that has since moved.

The second is the one to reach for when you need to prove control to a third party, and the first is the one that matters when the question is whether the domain is genuinely yours. Who actually owns your domain goes into what to do when the answer is no.

Why rdap.org, and what to use for country domains

rdap.org is a redirector: it looks up which registry is authoritative for the ending and forwards you there, so one URL works for .com, .io, .dev and the rest without you knowing who runs each.

Country endings are inconsistent. Many national registries have not deployed RDAP, and some that have expose far less. .de is the clearest example: DENIC publishes almost nothing, and whois denic.de returns little more than the technical contact. For those, the registry's own lookup page is the only complete source.