Latest news of the domain name industry

Recent Posts

Registries have started shutting down Whois

Kevin Murphy, February 24, 2025, 18:06:15 (UTC), Domain Registries

Nominet seems to have become the first major registry services provider to start to retire Whois across its portfolio, already cutting off service for about 70 top-level domains.

Queries over port 43 to most of Nominet’s former Whois servers are no longer returning responses, and their URLs have been removed from the respective TLDs’ records on the IANA web site.

The move follows the expiration last month of ICANN’s contractual requirements to provide Whois in all gTLDs. Now, registries must use the successor protocol RDAP instead, with Whois optional.

A Nominet spokesperson tells us the shut-off, which affects large dot-brand clients including Amazon, happened after consultation with ICANN and clients on January 29.

TLDs Nominet was supporting under ICANN’s Emergency Back-End Registry Operator program are also affected.

The registry spokesperson said that the gTLDs .broadway, .cymru, .gop, .pharmacy, and .wales are still offering Whois, due to an interoperability issue:

“The sole reason for the retention of these gTLD WHOIS services is for interoperability with the Brand Safety Alliance (BSA) service integration, which does not yet support RDAP,” she said.

The BSA is the GoDaddy-backed project that offers the multi-TLD GlobalBlock trademark-blocking service.

Nominet’s flagship .uk is also still offering Whois, because Nominet discovered that some of its registrars were still using it, rather than EPP, to do domain availability checks.

The fact that a GoDaddy service and some .uk registrars still don’t support RDAP, even after a years-long ICANN transition plan, is perhaps revelatory.

I’ll admit the only reason I noticed Nominet’s Whois coverage was patchy was that I’d neglected to update one of my scripts and it started failing. Apparently I was not alone.

While RDAP can be fairly simple to implement (if I can do it…), actually finding each registry’s RDAP server is a bit more complicated than under the Whois regime.

All gTLD registries were obliged to offer Whois at whois.nic.[tld], and IANA would publish the URLs on its web site, but RDAP URLs are not standardized.

It’s not super obvious, but it seems instead you have to head over to IANA’s “Bootstrap Service” and download a JSON file containing a list of TLDs and their associated base RDAP URLs.

If you find this post or this blog useful or interestjng, please support Domain Incite, the independent source of news, analysis and opinion for the domain name industry and ICANN community.

Tagged: , , , ,

Comments (9)

  1. peter orourke says:
    February 24, 2025 at 10:18 pm

    I can tell you one registrar that should be shutdown. That is sav.com. They have stollen several domains, domain portfolios.

    In my case they stole $2,400. There is an atmosphere of lying. They lied about sending my funds 3 times. They are very nice while stabbing you in the back. I sold the domain in Nov 24 and it is now the end of Feb. I havent seen a cent of my money. They just lie and lie about sending the money.

    Reply
  2. Gavin Brown says:
    February 25, 2025 at 9:50 am

    > It’s not super obvious, but it seems instead you have to head over to IANA’s “Bootstrap Service” and download a JSON file containing a list of TLDs and their associated base RDAP URLs.

    It’s obvious enough if you read the RFCs:

    https://datatracker.ietf.org/doc/std95/

    You did read the RFCs, right? RFC 9224 is right there in the list.

    The “old” way of doing it, where whois clients maintained their own mappings, was unreliable, and was the cause of this issue:

    https://domainincite.com/30227-hackers-break-mobi-after-whois-domain-expires

    If you’re doing anything non-trivial with RDAP, you should use a proper RDAP client, there is a list here:

    https://rdap.rcode3.com/client_implementations/index.html

    I did a survey of RDAP clients (and client libraries) last year, and every single one implements bootstrapping, so you never need to work out which RDAP server to use:

    https://regiops.net/sites/default/files/documents/10-ROW13-Gavin%20Brown-Stealth%20RDAP.pdf#page=5

    For ad-hoc RDAP lookups, You can use RDAP.org which will just redirect you to the correct RDAP server, eg

    https://rdap.org/domain/domainincite.com

    Reply
    • Kevin Murphy says:
      February 25, 2025 at 12:57 pm

      Thanks for all the info Gavin.

      I did read the RFCs, and the Base Registry Agreement, while trying to figure out what the authoritative source of RDAP servers was. That appears to be the only way to do it, as the bootstrap page doesn’t seem to be linked from anywhere on the IANA web site. Not that I could find, anyway.

      I would argue that having to do this amount of research to obtain information that was previously just posted for each TLD on the IANA web site, easily qualifies for the description “not super-obvious” 🙂

      Reply
      • Rubens Kuhl says:
        February 25, 2025 at 1:25 pm

        Previously, data.iana.org had a directory listing that would refer to all of the datasets they publish. Perhaps some security consultant told them “directory listings are bad” and it was replaced by a redirect to iana.org.

        Reply
        • Gavin Brown says:
          February 26, 2025 at 9:39 am

          The main IANA website has a full list of everything they publish if you follow the “Protocol Registries” link.

          I don’t think the directory listing has been removed because a security consultant said to, it’s more likely a limitation of the CDN being used. IANA publishes all its resources via FTP and RSYNC so disabling directory listings would be pointless.

          Reply
      • David Conrad says:
        February 26, 2025 at 5:49 am

        https://data.iana.org/rdap/dns.json

        In theory, rdap clients should fetch that file to know where to lookup DNS names, so you normally wouldn’t need to know where the bootstrap file.

        Reply
      • Gavin Brown says:
        February 26, 2025 at 9:37 am

        IANA is very receptive to feedback: send them an email at iana@iana.org 🙂

        (BTW – I should have said this in my previous post, but I am speaking here in a personal capacity, not that of my employer)

        Reply

Add Your Comment