# WHOIS & RDAP Lookup
How the WHOIS & RDAP Lookup finds the registry for a domain or IP address, reads its RDAP record into the registrar, dates, status codes, nameservers, DNSSEC data and abuse contact, and what each finding means.
Canonical: https://docs.tamperbox.dev/tools/whois-lookup/
Updated: 2026-10-24
Applies to: tamperbox.dev, October 2026
Prerequisites: A domain, an IPv4 or IPv6 address, or an RDAP record saved as JSON
Outputs: The registration as rows, status codes in plain words, nameservers and DNSSEC data, registry events, the raw RDAP JSON, findings worst first, and the underlying registry record
Limitations: One registry record at one moment; registrant details are usually redacted; an IP record names who holds the block, not who runs the server; port 43 WHOIS is not queried
The tool page is [tamperbox.dev/whois-lookup](https://tamperbox.dev/whois-lookup). It opens with a live lookup of `tamperbox.dev` and takes a domain, an IP address, or a saved RDAP record. This page is the long version: how the registry is found, what each part of the record means, every finding, and what to do with what you learn.
Where processing happens: a domain or address is sent to the Tamperbox server, which finds the responsible registry in the IANA bootstrap lists, asks its RDAP service and returns the record unchanged. The record is read in your browser. Pasted RDAP JSON never leaves the browser. History stays in memory in the open page. Explicit links to another tool may temporarily keep a one-use transfer in browser session storage; transfers expire after one minute and do not put the input in the URL.
## What the tool answers
For a domain:
1. **Who is it registered with, and since when?** Registrar, IANA registrar ID, registration, expiry and last-change dates.
2. **Who owns it?** The registrant, or that the details are redacted.
3. **How is it protected?** Status codes: locks, holds, grace periods.
4. **Where is its DNS, and is the delegation signed?** Nameservers with their provider, and the DS records the registry holds.
5. **What happened to it?** The registry's events, oldest first.
6. **Where do abuse reports go?** The registrar's abuse email and phone.
For an IP address: the network block it belongs to, its range and CIDR, the organisation holding it, its type and parent, the abuse contact, and the registry's remarks.
WHOIS over port 43 is not used: RDAP is its successor, with structured data and a standard way to find the right server. ICANN requires gTLD registries and registrars to run RDAP.
## Inputs
### A domain
`example.com`, looked up when you stop typing (or at once on Enter). A pasted address is reduced to what the tool takes: `https://www.example.com/page` becomes `www.example.com`, an email address its domain, quotes and brackets are dropped. Text that contains nothing usable stays as pasted with an explanation. Typing is never rewritten mid-word, and Break it loads are never cleaned.
Registries hold records for registered names only. `www.example.com` usually has no record even when `example.com` does; enter the registered domain yourself when a subdomain has no record.
### An IP address
IPv4 or IPv6, looked up at the regional internet registry that holds the block. Private and other non-public addresses are refused: "Enter a public IP address."
### RDAP JSON
A domain or IP network record saved from an RDAP service (it starts with `{`), pasted or dropped as a file up to 256 KiB, read in the browser. Text that is not JSON gives "Not readable JSON"; JSON that is not a domain or IP network object is refused.
## Reading the result
### Verdict and chips
For a domain: "Registered with *registrar*", with the year of registration and the expiry date, at FAIL, CHECK or PASS by the worst finding, and a line saying when the registrant details are redacted. The chips give the expiry, the transfer lock and DNSSEC. For an IP address: the network's name and who it is registered to. For no record: "Not registered: the registry has no record of …".
### Findings
The registration checks appear worst first, with passing checks folded when there are several. The count reports problems and things to check, or "No problems". An IP record adds an INFO finding naming its holder, network and any abuse contact; a missing record adds "No registration record" (INFO). The [finding reference](#finding-reference) lists them all.
### Registration
The record as rows. For a domain: domain and registry handle, registrar and IANA ID, registered, expires (red when past), last changed, registrant (or "Redacted for privacy"), abuse contact. For a network: address, network name and handle, range and CIDR, organisation and country, type and parent, abuse contact.
### Status codes, nameservers and DNSSEC, registry events
Status codes are listed with their plain names, meaning and weight (the table is in the [Domain Availability method](https://docs.tamperbox.dev/tools/domain-availability/#4-status-codes)). Nameservers are listed with the DNS provider they belong to; DS records follow with their key tag, algorithm and digest type, or "No DS record" when the delegation is unsigned. Registry events (registered, expires, last changed, transferred, locked, the registry's own refresh) are listed oldest first; future events are marked.
### The RDAP record
The registry's parsed JSON, formatted with indentation, with a Copy button: the source for anything the rows leave out (remarks, notices, links, extensions).
### History and next checks
History appears below the result evidence after Break it or Heal it changes the input. Revert restores the input before the latest recorded change; Reset input returns to the input before the first recorded change. Typing or pasting a new input starts a new history. Restoring a live input runs the lookup again, rather than restoring a saved response.
Take it further offers a domain expiry as a Unix timestamp, a DNSSEC check when the registry reports a signed delegation, or the first returned network CIDR for a BGP lookup. For a longer name with no record, Heal it may suggest the name one label up; that suggestion does not establish the registrable domain.
## Method
### 1. Finding the registry
The server reads the IANA RDAP bootstrap file that matches the input: domain names, IPv4 or IPv6 ([RFC 9224, sections 4 and 5](https://www.rfc-editor.org/rfc/rfc9224#section-4)). Domains match the longest registered ending; addresses match the longest covering prefix. Only HTTPS services are used, and the query is `domain/` or `ip/` ([RFC 9082, sections 3.1.1 and 3.1.3](https://www.rfc-editor.org/rfc/rfc9082#section-3.1.1)). Up to three redirects are followed, each checked to be a public HTTPS address; regional registries often redirect an address to the registry that actually holds it. With no service for the ending, the page says so and that this "does not mean it is available".
### 2. Not found
[RFC 7480, section 5.3](https://www.rfc-editor.org/rfc/rfc7480#section-5.3): an empty result is a 404, and the body is optional. A 404 counts as "no record" only with RDAP evidence: an error document with `errorCode` 404, or an empty body served as RDAP or JSON. An empty-body result requires a successful read and a JSON or RDAP JSON media type, optionally with parameters. Failed body reads and HTML 404 responses do not establish that a record is missing. A record whose `objectClassName` is not the one asked for is refused.
### 3. Reading a domain record
From the domain object ([RFC 9083, section 5.3](https://www.rfc-editor.org/rfc/rfc9083#section-5.3)):
- **Name and handle**: `ldhName` (or `unicodeName`) and `handle`.
- **Registrar**: the entity with the `registrar` role, its `fn`, and the public ID of type "IANA Registrar ID" ([section 4.8](https://www.rfc-editor.org/rfc/rfc9083#section-4.8)); the abuse contact is the registrar's child entity with the `abuse` role (email and telephone).
- **Registrant**: the entity with the `registrant` role (name, organisation, country), or "Redacted for privacy" when a description in the record's `redacted` list ([RFC 9537](https://www.rfc-editor.org/rfc/rfc9537)) names registrant fields.
- **Dates**: the `registration`, `expiration` and `last changed` events ([section 4.5](https://www.rfc-editor.org/rfc/rfc9083#section-4.5)); every event is listed in the timeline.
- **Status**: the `status` array ([section 4.6](https://www.rfc-editor.org/rfc/rfc9083#section-4.6)), EPP values of [RFC 5731, section 2.3](https://www.rfc-editor.org/rfc/rfc5731#section-2.3) and [RFC 3915, section 3.1](https://www.rfc-editor.org/rfc/rfc3915#section-3.1) in their RDAP spelling ([RFC 8056, section 2](https://www.rfc-editor.org/rfc/rfc8056#section-2)).
- **Nameservers** and **DNSSEC**: `nameservers[].ldhName`, and `secureDNS.delegationSigned` with `dsData` (key tag, algorithm, digest type, digest).
### 4. Registration checks
The same lifecycle checks as the [Domain Availability Checker](https://docs.tamperbox.dev/tools/domain-availability/#5-lifecycle-checks): expiry passed, within 30 days, or later; holds; a missing transfer lock; the registry lock; an unsigned delegation. The verdict takes the level of the worst check. Expiry findings use rounded whole days; date fields compare timestamps directly, so the two can differ close to a day boundary.
### 5. Reading an IP network record
From the IP network object ([RFC 9083, section 5.4](https://www.rfc-editor.org/rfc/rfc9083#section-5.4)): `name`, `handle`, `startAddress` and `endAddress`, the `cidr0_cidrs` extension for the CIDR, `type`, `country`, `parentHandle`, the registrant's `fn`, the first abuse contact found among the entities and their children, and the remarks. No checks are applied: the record describes who holds the block.
## Standards and conformance
| Specification | Sections used | How the tool applies them | Where it stops |
| --- | --- | --- | --- |
| [RFC 7480](https://www.rfc-editor.org/rfc/rfc7480), HTTP usage | [5.3](https://www.rfc-editor.org/rfc/rfc7480#section-5.3) | 404 with RDAP evidence means no record | HTML 404s are treated as inconclusive |
| [RFC 9082](https://www.rfc-editor.org/rfc/rfc9082) (obsoletes RFC 7482) | [3.1.1](https://www.rfc-editor.org/rfc/rfc9082#section-3.1.1), [3.1.3](https://www.rfc-editor.org/rfc/rfc9082#section-3.1.3) | Exact domain and IP lookups | No searches, no entity or AS lookups (the ASN lookup covers AS numbers) |
| [RFC 9083](https://www.rfc-editor.org/rfc/rfc9083) (obsoletes RFC 7483) | 4.5, 4.6, 4.8, 5.3, 5.4 | Fields read into rows; raw JSON shown | Notices, remarks on domains and vCard fields beyond those listed stay in the raw JSON |
| [RFC 9224](https://www.rfc-editor.org/rfc/rfc9224) (obsoletes RFC 7484) | 4, 5.1, 5.2 | Longest-match bootstrap, HTTPS only | |
| [RFC 9537](https://www.rfc-editor.org/rfc/rfc9537), redaction | The `redacted` member | Registrant shown as redacted when the list names it | Other redacted fields are visible in the raw JSON |
| [RFC 5731](https://www.rfc-editor.org/rfc/rfc5731), [RFC 3915](https://www.rfc-editor.org/rfc/rfc3915), [RFC 8056](https://www.rfc-editor.org/rfc/rfc8056) | Status values and mapping | Plain names and weights | |
## Finding reference
| Finding | Level | Source | Meaning | What to do |
| --- | --- | --- | --- | --- |
| Expires in N days (more than 30) | PASS | [RFC 9083 4.5](https://www.rfc-editor.org/rfc/rfc9083#section-4.5) | Paid up | |
| Expires in N days (30 or fewer) | CHECK | | Lapses soon without renewal | Check auto-renew and payment |
| Expired N days ago | FAIL | | Past the reported expiry; renewal rights depend on policy | Renew |
| Expired and on its way out | FAIL | [RFC 3915 3.1](https://www.rfc-editor.org/rfc/rfc3915#section-3.1) | Redemption or pending delete | Restore now, or follow its release |
| On hold | FAIL | [RFC 5731 2.3](https://www.rfc-editor.org/rfc/rfc5731#section-2.3) | Does not resolve | Ask the registrar why |
| No transfer lock | CHECK | [RFC 5731 2.3](https://www.rfc-editor.org/rfc/rfc5731#section-2.3) | Can be moved with its auth code | Turn the lock on |
| Registry lock | PASS | [RFC 5731 2.3](https://www.rfc-editor.org/rfc/rfc5731#section-2.3) | Server transfer and update restrictions are present; process is registry-specific | |
| Delegation not signed | INFO | [RFC 9083 5.3](https://www.rfc-editor.org/rfc/rfc9083#section-5.3) | No DS at the registry | See the [DNSSEC Checker](https://docs.tamperbox.dev/tools/dnssec-checker/) |
| No registration record (finding); Not registered (verdict) | INFO | [RFC 7480 5.3](https://www.rfc-editor.org/rfc/rfc7480#section-5.3) | No record for this exact name | Check the registered name |
| Registered to *holder* (IP finding and verdict) | INFO | [RFC 9083 5.4](https://www.rfc-editor.org/rfc/rfc9083#section-5.4) | Who holds the block | Report abuse to its contact |
## Guide
### Contacting a domain's owner
Most records redact the registrant. Contact the registrar named in the record: registrars offer a contact form or relay address for the owner, and handle abuse reports at the abuse contact shown. For a legal request, the registrar's terms say how to request disclosure.
### Reporting abuse
For a phishing or malware domain, write to the registrar's abuse contact with the full URL, the time you saw it and the evidence. For spam or attacks from an address, look the address up here and write to the network's abuse contact with the address, the exact times (with time zone) and the headers or logs.
### Moving a domain to another registrar
Remove the transfer lock at the current registrar, get the auth code, start the transfer at the new registrar, and confirm it by email. Note any "Just transferred" status afterwards: a further transfer is usually blocked for 60 days. Turn the lock back on once the transfer completes.
### Independent check
```sh
# RDAP for a domain or an address, through a public redirector that uses the IANA bootstrap
curl -sL https://rdap.org/domain/example.com | head -c 600
curl -sL https://rdap.org/ip/198.51.100.24 | head -c 600
# Classic port 43 WHOIS, where the registry still runs it
whois example.com
```
### Break it cases
Every case is a sample record on the reserved `.example` zone or a documentation address: a registration's state belongs to the world, not to your input.
| Case | Input | What it shows |
| --- | --- | --- |
| An IP address | `198.51.100.24` | An IP network record: TEST-NET-2, reserved for documentation |
| Not registered | `harborsupply-marine.example` | No registration record |
| Expired, redeemable | `anchor-chandlery.example` | Expired and on its way out, with no nameservers |
| No transfer lock | `dockside-tools.example` | A registration without a transfer lock |
## Worked example
The page opens with a live RDAP lookup of `tamperbox.dev`. Start with the registrar and dates, then read the status, nameserver and DNSSEC sections. Finally inspect the JSON for notices or extensions that the summary does not render. The registry can change these fields, so this guide does not promise a fixed registrar, expiration date or nameserver set.
A missing registrant name is not evidence that the domain has no owner. Redaction, omitted fields and privacy placeholders require careful interpretation. Likewise, the registry's signed-delegation flag and DS data describe registration-side information; use the DNSSEC Checker to inspect the public chain rather than treating the flag as a validation result.
Choose An IP address in Break it to view the reserved documentation-network fixture. The network range, holder and abuse contact answer a different question from a domain registration. An allocation does not identify the operator of every server in that range. Heal it restores the prior input, and live inputs are queried again.
## For agents
Search the Tamperbox MCP catalog for `whois_lookup`, inspect its schema and supply the domain or public IP as `q`. It returns the RDAP object from the lookup service, not the browser's formatted rows or lifecycle findings. Preserve notices, redactions and missing fields when summarizing it. A failed lookup must not become an assertion that the name is available. Keep these warnings with any conclusion:
- One registry record at one moment; registrars may hold more than the registry shows.
- Redacted registrant data is not evidence about the owner.
- An IP record names who holds the block, not who operates the server.
See [Connect an MCP client](https://docs.tamperbox.dev/mcp/connect/) for the calling pattern and [Security and privacy](https://docs.tamperbox.dev/reference/security/) for where the input travels.
### Keeping an observation reproducible
Record the target, the time of the lookup, the relevant raw records and the resolver or registry that supplied them. Repeat a live lookup after a configuration change instead of assuming a restored input restores an old response. A saved RDAP object or pasted DNSSEC record set is a snapshot: its dates are assessed against the current clock, but its contents are not refreshed.
Separate absence from failure. A successful response with no applicable record, a rejected input, a timeout and an upstream error support different conclusions. Preserve an error when a query could not complete; do not replace it with a claim that the record does not exist. When sharing findings, include the narrow observation and the relevant limitation rather than only the verdict label.
## Limits
- One registry record, at one moment.
- Registrant details are usually redacted.
- Port 43 WHOIS is not queried; endings without RDAP cannot be looked up.
- An IP record says who holds the block, not who runs the server.
- The Break it cases use sample records and documentation addresses.
- History stays in memory in the open page. Explicit links to another tool may temporarily keep a one-use transfer in browser session storage; transfers expire after one minute and do not put the input in the URL.
## References
- [RFC 3915, Domain Registry Grace Period Mapping for EPP](https://www.rfc-editor.org/rfc/rfc3915), section 3.1
- [RFC 5731, EPP Domain Name Mapping](https://www.rfc-editor.org/rfc/rfc5731), section 2.3
- [RFC 7480, HTTP Usage in RDAP](https://www.rfc-editor.org/rfc/rfc7480), section 5.3
- [RFC 8056, EPP and RDAP Status Mapping](https://www.rfc-editor.org/rfc/rfc8056), section 2
- [RFC 9082, RDAP Query Format](https://www.rfc-editor.org/rfc/rfc9082), sections 3.1.1 and 3.1.3 (obsoletes RFC 7482)
- [RFC 9083, JSON Responses for RDAP](https://www.rfc-editor.org/rfc/rfc9083), sections 4.5, 4.6, 4.8, 5.3 and 5.4 (obsoletes RFC 7483)
- [RFC 9224, Finding the Authoritative RDAP Service](https://www.rfc-editor.org/rfc/rfc9224), sections 4 and 5 (obsoletes RFC 7484)
- [RFC 9537, Redacted Fields in RDAP](https://www.rfc-editor.org/rfc/rfc9537)