WHOIS vs RDAP: How ICANN Domain Data Works (2026 Guide)

Every domain leaves a registration trail, and for forty years the way to read that trail has been WHOIS. ICANN's replacement protocol, RDAP, answers the same questions over a modern REST interface with structured JSON. Both are built for looking up one domain at a time, which is exactly the wrong shape for research, market sizing, or infrastructure analysis across millions of names. This guide explains how the two protocols actually differ, where each one stops being useful, and what bulk domain files give you that a lookup protocol cannot.

TL;DR / Key Takeaways

• WHOIS is a plain-text protocol on port 43: no schema, no standard field names, no standard date formats. Every registry and registrar formats output slightly differently, so parsing at scale means maintaining one parser per source.
• RDAP is the ICANN-mandated successor: RESTful, HTTPS-only, JSON responses, standardized error codes, internationalization support, and query referrals between servers. It solves the parsing problem, not the access problem.
• Neither protocol is a bulk data source: both are rate-limited by design. Querying millions of domains through WHOIS or RDAP results in throttling and blocking, and no registry offers that as a supported use case.
• GDPR redaction applies to both: since 2018, registrant name, email, and postal details are redacted or proxied in public responses for most domains. Public WHOIS/RDAP is not a contact database.
• Neither protocol says anything about what a site runs: CMS, web server, CDN, mail provider, and IP are all outside the registration record. That information comes from DNS resolution and HTTP fingerprinting, not from the registry.
• WebTrackly sells the bulk layer: 1,538 downloadable packages — 716 TLD zone files, 79 technology and CMS lists, 27 curated datasets — as CSV inside a ZIP, generated fresh at purchase, from $3.50.
• You do the analysis: the files are inputs for your own tooling. There is no in-browser query builder, no per-domain lookup, and no contact data.

Table of Contents

1. Understanding WHOIS: The Legacy Protocol
2. Introducing RDAP: The Modern Standard
3. WHOIS vs RDAP: Side by Side
4. Where Both Protocols Stop
5. What Bulk Domain Files Contain
6. Buying and Processing a Package
7. Automating with the Catalog API
8. Common Mistakes in Domain Data Acquisition & How to Avoid Them
9. Frequently Asked Questions (FAQ)
10. Related Resources

Understanding WHOIS: The Legacy Protocol

WHOIS is a query and response protocol used to interrogate databases that store the registered assignees of an internet resource — a domain name, an IP address block, or an autonomous system number. It originated in the early days of the internet and was standardized by the IETF in the early 1980s. Its purpose was directory service: let anyone find out who is responsible for a resource, primarily for network troubleshooting and abuse handling.

The structure is deliberately simple. A WHOIS record is a block of plain text returned over TCP port 43. A client connects to the WHOIS server operated by the domain's registrar or registry, sends the domain name, and receives a text blob back.

Typical WHOIS records include:

• Registrant Information: name, organization, address, email, and phone of the domain holder — now redacted for most domains.
• Administrative Contact: the party responsible for administrative issues.
• Technical Contact: the party responsible for technical issues.
• Registrar Information: the company through which the domain was registered.
• Registration Dates: creation date, last update date, expiration date.
• Name Servers: the authoritative DNS servers for the domain.
• Domain Status: EPP status codes such as clientTransferProhibited or pendingDelete.

The value of WHOIS in its original intent was transparency and accountability. If a site was engaged in malicious activity, or if there was a technical fault, WHOIS provided a path to the responsible party. For competitive research it offered basic facts: registration date, registrar, and name servers.

The drawbacks matter more today. The largest is the absence of a schema. Each registrar and registry formats its output differently, with varying field labels, date formats, and section ordering. Automated parsing therefore requires per-source regular expressions and custom logic; a parser written against one registrar's output frequently fails on another's.

Rate limiting is the second constraint. WHOIS servers are provisioned for individual lookups, not bulk extraction. Querying thousands or millions of domains leads to throttling, IP blocking, or CAPTCHA interstitials. Beyond that, the data itself ages: registrants move, change addresses, and let details drift, and registrars do not aggressively enforce updates.

The decisive change for anyone hoping to use WHOIS as a contact source came with GDPR in 2018. To comply, ICANN required registrars to redact personal data from public WHOIS output for affected registrants. For most domains today the registrant name, email, and phone are replaced with "REDACTED FOR PRIVACY" or a privacy service's forwarding address. Public WHOIS should be treated as a source of technical and registration facts, not personal ones.

Introducing RDAP: The Modern Standard

Recognizing the inconsistency of WHOIS output and the growing need for access controls, ICANN drove the development of RDAP, the Registration Data Access Protocol. RDAP was designed as a standardized, secure, extensible replacement. ICANN adopted it in 2017 and registries and registrars have implemented it progressively since.

The architectural difference is the point. Instead of plain text on port 43, RDAP is a RESTful web service returning structured data, normally JSON. That removes the parsing problem: with a defined schema, an automated system can extract a field by name rather than by pattern-matching a text blob.

Key advantages of RDAP over WHOIS:

• Standardized Data Format: JSON output is machine-readable and integrates directly into pipelines.
• Security Features: RDAP runs over HTTPS and supports authentication and authorization, so accredited requesters can in principle receive more complete responses than anonymous ones.
• Internationalization: proper support for internationalized domain names and multilingual contact data.
• Error Handling: standardized HTTP status codes and error objects, so clients can distinguish "not found" from "rate limited" from "server error".
• Referrals: an RDAP response can point the client at the authoritative server for the object, which makes cross-registry lookups tractable.

ICANN's push for RDAP aims at a uniform, auditable way to access registration data. For anyone querying registration records programmatically, RDAP is a clear improvement in reliability over its predecessor.

RDAP does not change what is in the record. It operates under the same privacy mandates as WHOIS: personal data remains redacted in public responses. You can query it more cleanly, but the contact fields are still proxies or placeholders. Coverage is also uneven — not every registry and registrar has completed its RDAP rollout, so some domains are still only reachable over WHOIS. And the payload is still registration data: nothing about the operational technology, hosting, or content of the site.

WHOIS vs RDAP: Side by Side

Where Both Protocols Stop

Whatever their differences, WHOIS and RDAP answer one question: what does the registry record say about this name? Several categories of question fall outside that scope entirely.

1. No technology detection. The registration record tells you who registered a domain, not what software the site runs. CMS, e-commerce platform, web server, and JavaScript libraries are all discovered by fetching the site, not by querying the registry.
2. No usable contact data. GDPR and comparable regimes have removed registrant details from public responses. Accredited access exists for law enforcement and rights holders; it is not a general-purpose channel.
3. No infrastructure view. Beyond name servers, the protocols say nothing about the resolved IP, the hosting network, the CDN in front of the origin, or the mail provider behind the MX records.
4. No aggregation. Even with RDAP's clean JSON, covering millions of names means orchestrating queries across hundreds of servers, each with its own rate limits and availability. That is an infrastructure project, not a query.
5. No freshness guarantee at scale. The protocols have no mechanism for telling you what changed since your last pass. Detecting change means re-querying everything.
6. No population-level view. You cannot ask WHOIS or RDAP "how many .de domains exist" or "which domains resolve to this network". They answer per-name questions only.

Those are exactly the questions that bulk domain files answer, because a file is a population, not a lookup.

Working with domain data at scale?
WebTrackly publishes 1,538 downloadable packages — zone files, technology lists, and curated datasets — as CSV in a ZIP.
Browse the catalog → | View Pricing →

What Bulk Domain Files Contain

WebTrackly's catalog is organised in three groups:

• Zone files by TLD — 716 packages covering .com, .net, .de, .org and hundreds of others. The .com package alone contains 157,775,115 domains. See Zone Files by TLD.
• Technology and CMS lists — 79 packages of domains grouped by the platform detected on them. The WordPress package contains 21,639,326 domains. See Domain Data.
• Curated datasets — 27 packages, including the all-registered-domains dataset at 272,614,863 rows. See Datasets.

Every package downloads as CSV inside a ZIP archive. The file is generated at the moment of purchase, so it reflects the state of the source data on that date rather than a cached snapshot from an earlier crawl. Pricing starts at $3.50 per package; see Pricing for subscription tiers.

Fields you can expect

Columns vary by package type — a zone file is narrow, a technology list carries the detection and resolution fields. The table below shows the shape of the data rather than a promise that every column appears in every package.

What is not in the files: personal names, email addresses, phone numbers, company firmographics, or behavioural intent signals. WebTrackly sells domain data. Anything about the people behind a domain is out of scope, both as a product decision and as a compliance one.

Buying and Processing a Package

The workflow is deliberately short — there is no query builder to learn, because the analysis happens on your machine with your own tools.

1. Find the package. Browse the catalog, or go straight to /zones/ for TLD zone files, /domaindata/ for technology lists, or /datasets/ for curated datasets. Each listing shows the row count so you know the size before you buy.
2. Purchase. One-time purchases start at $3.50. Subscriptions (Pro at $29/month, Enterprise at $99/month) bundle a monthly allowance of packages and datasets plus API quota; details on the pricing page.
3. Download. The ZIP is produced on demand and available immediately after payment.
4. Process locally. Unzip and work with the CSV in whatever you already use.

For a file of a few hundred million rows, command-line tools and a columnar engine will outperform a spreadsheet by a wide margin:

unzip com-zone.zip
wc -l com-zone.csv

# filter rows by name server with plain grep
grep -i 'cloudflare' com-zone.csv > cloudflare-hosted.csv

# or query the CSV directly with DuckDB, no import step
duckdb -c "SELECT ns, count(*) AS n FROM 'com-zone.csv' GROUP BY ns ORDER BY n DESC LIMIT 20"

For repeated analysis, load once into PostgreSQL or ClickHouse with a bulk copy and index the columns you filter on. Joining two packages — for example a technology list against a zone file — is a straightforward join on the domain column.

Automating with the Catalog API

Subscription plans include API access for browsing the catalog and retrieving package metadata programmatically. Pro includes 30,000 calls per month, Enterprise 300,000. The API is a catalog interface: it lists and describes packages and datasets. It is not a per-domain lookup service.

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://webtrackly.com/api/v1/packages/?type=zone"

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://webtrackly.com/api/v1/packages/?type=technology&q=wordpress"

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://webtrackly.com/api/v1/packages/com-zone/"

Full endpoint reference, including the datasets and account endpoints, is on the API documentation page.

Common Mistakes in Domain Data Acquisition & How to Avoid Them

Working with whois vs rdap icann data at any real scale surfaces the same handful of errors. Here are the ones worth avoiding.

1. Treating WHOIS or RDAP as a bulk source

   • What goes wrong: writing a script that walks a list of a million domains and queries each one over WHOIS or RDAP.
   • Why it goes wrong: both protocols are rate-limited per source and none of the registries support that pattern. You will be throttled within minutes, and the run will take longer than the data stays valid.
   • The fix: start from a bulk file that already contains the population, and reserve per-name queries for the small subset where you need the current registry record.

2. Expecting contact data from registration records

   • What goes wrong: planning an outreach workflow around registrant emails.
   • Why it goes wrong: those fields have been redacted or proxied for most domains since 2018. The plan fails on the data, not on the execution.
   • The fix: use domain data for what it is — a map of names, infrastructure, and technology — and source contact data through channels where consent and provenance are documented.

3. Building a parser per registrar and calling it a pipeline

   • What goes wrong: regex-based WHOIS parsing that works against the registrars you tested and silently mangles the rest.
   • Why it goes wrong: WHOIS has no schema. Field labels, date formats, and section ordering all vary, and they change without notice.
   • The fix: prefer RDAP where the registry supports it, since the JSON schema is stable. Where you need a whole TLD, use the zone file rather than reconstructing it name by name.

4. Ignoring how quickly the data ages

   • What goes wrong: reusing a file from last year for this year's analysis.
   • Why it goes wrong: domains expire, migrate hosts, change CMS, and move behind CDNs continuously. Conclusions drawn from a stale population describe a web that no longer exists.
   • The fix: re-download when the analysis matters. WebTrackly generates the file at purchase time, so a fresh download is a fresh extract rather than a cached copy.

5. Underestimating the cost of building the collection layer

   • What goes wrong: deciding to crawl and fingerprint the web in-house because the individual steps look simple.
   • Why it goes wrong: resolution at scale, retry logic, fingerprint maintenance, storage, and re-crawl scheduling are an ongoing engineering commitment, not a sprint.
   • The fix: buy the population file for the cases where you need coverage, and build in-house only where your requirements genuinely diverge from what is available off the shelf.

6. Loading hundreds of millions of rows into the wrong tool

   • What goes wrong: opening a multi-gigabyte CSV in a spreadsheet, or looping over it row by row in a scripting language.
   • Why it goes wrong: the row counts here run to hundreds of millions. Tools that hold everything in memory will not finish.
   • The fix: stream it. Command-line filters, DuckDB over the CSV directly, or a bulk load into a columnar store all handle this size without difficulty.

7. Skipping the legal review of what you collected

   • What goes wrong: assuming that because data is publicly reachable, any use of it is permitted.
   • Why it goes wrong: GDPR, CCPA, and registry terms of use constrain how registration data may be processed and re-published, independent of how it was obtained.
   • The fix: keep personal data out of the pipeline entirely. Domain names, DNS records, IPs, and technology fingerprints do not identify individuals; registrant details do.

Frequently Asked Questions (FAQ)

Q: What is the practical difference between WHOIS and RDAP?
A: WHOIS returns unstructured text over port 43 and requires a custom parser per registrar. RDAP returns JSON over HTTPS against a defined schema, supports authentication, uses standard HTTP error codes, and can refer a client to the authoritative server. For programmatic use RDAP is strictly easier to work with. Both are subject to the same privacy redaction and the same rate limits.

Q: Can I get registrant emails or phone numbers from either protocol?
A: Not for most domains. Since GDPR took effect in 2018, ICANN requires registrars to redact personal data from public WHOIS and RDAP responses. Accredited access paths exist for specific parties such as law enforcement. WebTrackly does not sell contact data of any kind.

Q: Does WebTrackly offer a lookup for a single domain?
A: No. The product is bulk files. You choose a package from the catalog, buy it, and download a CSV inside a ZIP. There is no per-domain search interface.

Q: What format are the downloads, and how fresh are they?
A: CSV inside a ZIP archive, downloadable immediately after purchase. The file is generated at the time of purchase rather than served from a pre-built snapshot.

Q: How large is the catalog?
A: 1,538 packages: 716 TLD zone files, 79 technology and CMS lists, and 27 curated datasets. For scale, the .com zone package contains 157,775,115 domains, the WordPress package 21,639,326, and the all-registered-domains dataset 272,614,863 rows.

Q: What does it cost?
A: One-time package purchases start at $3.50. Pro is $29/month and includes 50 packages, 10 datasets, and 30,000 API calls. Enterprise is $99/month with 200 packages, 50 datasets, and 300,000 API calls. Current details are on the pricing page.

Q: Is there an API?
A: Yes, for the catalog. The API lists packages and datasets and returns their metadata, authenticated with a bearer token. See the API documentation. It does not perform domain lookups.

Q: How should I process a file with hundreds of millions of rows?
A: Stream rather than load. Standard command-line tools handle filtering and counting; DuckDB queries a CSV in place without an import step; for repeated analysis, bulk-load into PostgreSQL or ClickHouse and index the columns you filter on.

Conclusion

WHOIS and RDAP do the job they were designed for: they tell you what a registry records about one name. RDAP does it with a schema, over HTTPS, with real error handling — a genuine improvement, and worth migrating to for any code that queries registration data. What neither protocol will ever do is hand you a population. They are lookups, rate-limited by design, stripped of personal data by regulation, and silent on everything that happens after resolution.

When the question is about a whole TLD, a whole platform, or a whole segment of the web, the right input is a file. That is what WebTrackly publishes: zone files, technology lists, and curated datasets, as CSV, generated at purchase, for you to analyse with your own tools.

Start with the catalog.
716 TLD zone files, 79 technology lists, 27 datasets — CSV in a ZIP, from $3.50.
Browse packages → | View pricing →

Related Resources

• Package Catalog — 1,538 downloadable domain databases
• Zone Files by TLD — .com, .net, .de and 700+ more
• Domain Data — domain lists by CMS and technology
• Curated Datasets — all registered domains, MX servers, e-commerce
• Pricing — one-time purchases from $3.50