On January 28, 2025, WHOIS officially died. Sort of. For the domains most people care about — .com, .net, .org, and the rest of the generic top-level domains — ICANN stopped requiring registries and registrars to run it at all.
And yet WHOIS is still everywhere. Your terminal still has the command. Your registrar’s website still has the box. Half the tooling in the security industry still shells out to port 43. A protocol that was formally sunset is going to keep breathing for years, because that’s what happens when you try to replace infrastructure that everyone quietly depends on and nobody wants to think about.
This is the story of how the replacement was ready a decade before anyone used it.
WHOIS Is Older Than You Think
WHOIS is one of the oldest application protocols still in daily use. It started as NICNAME in RFC 812, published in 1982 — back when there was one directory of everyone on the ARPANET and you could reasonably ask a single server “who is this person?” and get an answer. It was updated by RFC 954 in 1985 and finally, formally, by RFC 3912 in 2004.
Here is the entire protocol, as specified in 2004: open a TCP connection to port 43, send a text query terminated by CRLF, read back text until the server closes the connection. That’s it. RFC 3912 is about two pages of actual content, and it spends part of that admitting the protocol has no way to specify a language, no authentication, and no defined format for either the request or the response.
That last part is the one that ruins your day. There is no schema. Every registry invented its own layout. The label for an expiration date might be “Registry Expiry Date” or “Expiration Date” or “expire” or “paid-till,” depending on who you’re asking. Dates come in a dozen formats. Some servers refer you to another server and expect you to notice and follow the referral yourself. If you have ever written code to parse WHOIS, you have written a pile of regular expressions and a prayer, and you have watched it break the first time a registry changed a label.
WHOIS worked for forty years the way a lot of old infrastructure works: badly, but universally, and everyone had already paid the cost of tolerating it.
RDAP Fixed Every One of Those Problems
The Registration Data Access Protocol is what you would design if you sat down in 2015 and asked “what should WHOIS have been?”
It’s HTTP. You make a RESTful request to a URL like https://rdap.example/domain/example.com and you get back JSON. The response has actual fields — an events array with typed entries like registration and expiration, each with an ISO 8601 timestamp; a status array using a controlled vocabulary instead of free text; structured entities for registrar and contacts. You can parse it with JSON.parse and a schema, not a regex and a prayer.
It solves the referral problem too. IANA publishes bootstrap registries that map every TLD and IP block to its authoritative RDAP server, so a client can figure out where to ask without guessing. It supports internationalization, which a 1982 English-only protocol never could. And because it rides on HTTP, it inherits TLS, standard status codes, caching, and — crucially — the ability to offer differentiated access, handing more data to authenticated requesters than to anonymous ones. That last capability turned out to matter enormously once GDPR forced registries to hide personal data by default; RDAP can do tiered disclosure, WHOIS cannot.
The specifications shipped in 2015 as RFCs 7480 through 7484. In June 2021 the two most important ones were promoted to full Internet Standards as RFC 9082 (query format) and RFC 9083 (JSON responses). By any engineering measure, the argument was over. RDAP is better along every axis that matters.
So Why Did It Take Ten Years?
Because being better isn’t enough. It never is.
WHOIS had the one property that beats every technical advantage: it already worked, everywhere, and everyone had already absorbed the pain of dealing with it. Registrars had WHOIS servers. Tools had WHOIS parsers. The regex piles were already written and mostly debugged. Switching to RDAP meant real work to fix a problem that, from any individual operator’s desk, wasn’t actually on fire. The response was rational and the response was: later.
This is the same inertia that keeps DNSSEC under 20% adoption and IPv6 perpetually five years away. A better protocol doesn’t deploy itself. Someone has to spend money and take on risk to migrate, and “the old thing is ugly but functional” is a very stable equilibrium. Left alone, it can last decades.
What finally moved the industry wasn’t elegance. It was a contract. ICANN’s 2023 amendments to its registry and registrar agreements set a hard deadline: 18 months after the amendments took effect, the obligation to run WHOIS (port 43 and the web-based version) would sunset, and RDAP would become the required, authoritative source of gTLD registration data. That deadline landed on January 28, 2025. Registries that had shrugged at RDAP for eight years suddenly had a compliance date, and compliance dates are the only deadlines that infrastructure teams truly respect.
”Slowly” Is Doing a Lot of Work
Even now, the transition is partial. The ICANN mandate covers generic TLDs. It does not cover country-code TLDs — .uk, .de, .kr, and the rest run their own policies, and plenty of them still serve WHOIS as the primary interface with no RDAP in sight. So the client-side reality for anyone doing this seriously is: try RDAP, fall back to WHOIS, and normalize two completely different response shapes into something usable. The old protocol didn’t get replaced so much as demoted.
That’s how protocol transitions actually go. Not a switch that flips, but a long overlap where the new thing is mandatory in one jurisdiction, optional in another, and absent in a third, while the old thing refuses to fully die because too much still depends on it. WHOIS will be answering queries on port 43 for years after its own funeral.
The lesson isn’t that RDAP won. It’s how it won: not by being obviously superior for a decade, which it was, but by finally becoming mandatory. If you build protocols, that’s the uncomfortable part. Technical merit gets you a standard. It doesn’t get you adoption. Only a deadline does that.