What is RDAP? The new WHOIS protocol

Starting in January 2025, sig­nif­i­cant changes will come into effect for operators of generic top-level domains (gTLDs). They mostly affect the way that in­for­ma­tion about domain holders is made available. A central component is the re­place­ment of the classic WHOIS protocol with the modern RDAP (Regis­tra­tion Data Access Protocol).

Why is the WHOIS protocol being replaced?

The WHOIS protocol has served as the basis for querying domain reg­is­tra­tion data for decades. Users could use WHOIS to retrieve in­for­ma­tion about the owner of a domain. But the protocol is now outdated in places. Par­tic­u­lar­ly when it comes to data pro­tec­tion and domain privacy, the largely un­en­crypt­ed protocol is proving in­suf­fi­cient, as there is no stan­dard­ized way to protect personal data. Since the in­tro­duc­tion of data pro­tec­tion laws like the GDPR, this has become a sig­nif­i­cant dis­ad­van­tage. In addition, WHOIS is based on a text protocol that does not provide machine-readable or struc­tured data, making it un­suit­able for modern uses.

The RDAP (Reg­is­tra­tion Data Access Protocol) was developed by the Internet En­gi­neer­ing Task Force (IETF) to address these weak­ness­es. It provides a secure, stan­dard­ized solution for accessing reg­is­tra­tion data.

What is changing in January 2025?

The Internet Cor­po­ra­tion for Assigned Names and Numbers (ICANN), the global co­or­di­nat­ing body for domain names, announced that all gTLD reg­istries need to switch to the RDAP by January 2025. The change will increase data security, as the RDAP enables more control over who has access to what in­for­ma­tion. For example, sensitive data like personal contact addresses can be better protected. RDAP data is also delivered in the machine-readable format JSON, making it easier to integrate into modern systems. Unlike the old WHOIS protocol, in which data were freely available, RDAP makes it possible to precisely define access rights. That means that different user groups can have different au­tho­riza­tions.

What does that mean for domain holders?

If you own a domain, you might be asking yourself what the switch to the RDAP means for you. But rest assured, you don’t need to take any direct action as a domain holder. The switch mostly affects reg­istries and reg­is­trars (domain providers). The process of domain reg­is­tra­tion and ad­min­is­tra­tion won’t change. You and third parties who want to receive in­for­ma­tion about your domain will benefit from better data pro­tec­tion, thanks to the RDAP.