For years, scraping WHOIS was the standard method to obtain domain information. Every few months, someone asked how to do it at scale, and the answers were always the same: port 43 sockets, regex soup for 200 registrar formats, and rate limits that would ban you by lunchtime. But registries replaced that long ago with a JSON protocol called RDAP (Registration Data Access Protocol), open, keyless, and standardized. A single GET request to https://rdap.verisign.com/com/v1/domain/example.com with Accept: application/rdap+json returns structured JSON with events (registration, expiration, last change), status locks, nameservers, DNSSEC delegation, and the registrar as a structured entity. No text parsing. Dates are ISO 8601. The response for a .com domain comes directly from Verisign, the registry itself, not a reseller or cached mirror. This changes the game for companies that need custom software to manage large volumes of domains.
Routing is resolved with the IANA bootstrap file: GET https://data.iana.org/rdap/dns.json. This JSON maps about 1,200 TLDs to their RDAP base URLs. Fetch it once, build a map of TLD to endpoint, and query each domain at its own registry. With concurrency 8 and a 15-second timeout, you can check 2,000 domains in a couple of minutes, and no one rate limits you because you spread standard queries across the services built to answer them. Code is trivial: const boot = await (await fetch('https://data.iana.org/rdap/dns.json')).json(); const map = new Map(); for (const [tlds, urls] of boot.services) { const base = urls.find(u => u.startsWith('https://')); for (const tld of tlds) map.set(tld, base); }. A 404 from the authoritative registry means the domain is not registered, turning a registration data checker into a free bulk availability checker. But only trust the 404 when it comes from the TLD's own registry. Aggregators like rdap.org return 404 both for 'domain not found' and 'TLD not supported', which would happily tell you github.io is available. You must handle this case explicitly.
The gaps are ccTLDs. ICANN requires RDAP for all gTLDs, so .com, .net, .org and hundreds of new TLDs have full coverage. Country TLDs are voluntary: .ai, .tv, .cc and .uk are in the bootstrap, while .io and .sh are missing from it but quietly served by the registry operator at rdap.identitydigital.services/rdap/. Others (.de, .co, .me) still have nothing public. For these, you must handle the absence explicitly, without guessing. The registrar hides inside a jCard, which is vCard reimagined as nested JSON arrays. The name is the fn entry, and the IANA registrar ID is in publicIds: const reg = data.entities?.find(e => e.roles?.includes('registrar')); const name = reg?.vcardArray?.[1]?.find(i => i[0] === 'fn')?.[3]; This cleanly extracts the registrar entity.
For businesses, domain age alone sorts a lead list by business credibility, flags a phishing lookalike registered last Tuesday, and prices an expired domain hunt. Integrating this information into automated business intelligence processes is key. Here at Q2BSTUDIO we develop AI agents that query RDAP in real time, feed Power BI dashboards, and trigger cybersecurity workflows when suspicious domains appear. Our team integrates this data with cloud infrastructure AWS/Azure to scale queries to millions of domains without overloading registries. Combining RDAP with natural language processing allows extracting registration patterns and detecting phishing campaigns before they affect customers. Additionally, the BI/Power BI dashboards we build show domain registration evolution by sector, expiration dates, and registrar concentration, all from an official source without fragile parsing.
The RDAP protocol eliminates the need for proxies, IP rotation, and parser maintenance. It's an open standard designed for modern registration data querying. Where dedicated scraping teams were once needed, a single endpoint now returns structured data. This allows startups and large corporations to integrate domain verification as an internal service, independent of third parties. Our experience in process automation has taught us that the key lies in the routing layer: correctly handling absent ccTLDs, periodically updating the bootstrap, and managing 404 errors with business logic. For example, a domain returning 404 on .com is free; but on .de we need an alternative source, such as direct WHOIS, until the registry adopts RDAP. For those cases, we combine RDAP with cybersecurity services that monitor availability and DNS changes, alerting on possible identity spoofing.
GDPR privacy has redacted the registrant's name and email in both RDAP and WHOIS, but what matters for most workflows remains available: dates, registrar, locks, and nameservers. With that data, an AI system can assess domain trustworthiness based on its age and recent changes. At Q2BSTUDIO we have created AI agents that cross-reference RDAP data with threat intelligence feeds, allowing security teams to react within minutes. We also offer custom software that consumes RDAP as a backend for vendor verification platforms, commercial due diligence, or B2B lead generation. The transition from WHOIS to RDAP is not just a technical shift; it's an opportunity to rethink how organizations obtain and use domain registration data.
In summary, WHOIS scraping belongs to the past. RDAP offers structured JSON, no rate limits when respecting distributed load, and clear authority from the TLD registry. Companies that adopt this protocol will gain efficiency, scalability, and reliability. If you need to implement this architecture or build a domain intelligence system, Q2BSTUDIO can help you with turnkey solutions. Contact us to explore how to integrate RDAP into your tech stack, whether for cybersecurity, BI, or process automation.
