Domain age, RDAP and what registries still publish
Why WHOIS returns so much less than it used to, what domain age does and does not indicate, and how to read a registration record.
Last reviewed · 1,352 words
In short
- RDAP has replaced WHOIS as the standard protocol. It returns structured JSON rather than free text, and it is what modern tools query.
- GDPR removed most registrant contact details from public records in 2018. What remains is dates, status codes and nameservers.
- Domain age is not a ranking factor. Google has said so directly, and the correlation people observe comes from age proxying for accumulated links.
- A creation date only days old on a site asking for money is a genuine warning sign.
- clientTransferProhibited is a normal protective lock, not a problem. Confusing it with a suspension is common.
Every registered domain has a public record held by its registry. What that record contains has changed substantially in the last few years, and so has how you query it.
WHOIS and RDAP
WHOIS dates to 1982. It returns unstructured text over a plain TCP connection, in a format that varies by registry, with no authentication and no encryption. Parsing it reliably means writing a parser per registry.
RDAP — Registration Data Access Protocol — replaced it as the standard. It returns structured JSON over HTTPS, supports authentication so that authorised parties can see more, and internationalises properly.
ICANN required generic top-level domains to support RDAP from 2019, and WHOIS is being retired. Any tool built today queries RDAP.
One practical note for anyone building such a tool: RDAP endpoints do not send CORS headers, so a browser cannot query them directly. The request has to go through a server, which is why a purely client-side domain lookup is not possible.
What GDPR removed
Before May 2018, a WHOIS record typically showed the registrant's name, postal address, email and phone number. That was a privacy problem and a spam source, and GDPR ended it.
Registries now redact personal data from public responses. What remains:
| Still public | Now hidden |
|---|---|
| Creation, update and expiry dates | Registrant name |
| Registrar name and IANA ID | Postal address |
| Nameservers | Email, usually |
| Status codes | Phone number |
| DNSSEC status | Administrative and technical contacts |
Some registries redact more than others, and country-code domains follow their own national rules — several were more private than gTLDs long before GDPR.
Contact is usually possible through an anonymised forwarding address or a registrar-provided form. Law enforcement and rights holders can request the full record through a defined process.
Reading the dates
Creation date — when the domain was first registered. This is the one people mean by domain age.
Updated date — when the record last changed. It moves for a nameserver change, a registrar transfer, a status change or a renewal, so a recent update means very little on its own.
Expiry date — when the current registration ends. A domain expiring within weeks and not renewed is worth noting; a long expiry date is a weak signal of intent to keep it.
An important caveat: the creation date resets if a domain is allowed to lapse and is re-registered. A domain first registered in 2003, dropped in 2019 and picked up in 2024 shows 2024. The history before that is not in the record, and the archived web is the only way to find it.
Domain age and search ranking
It is not a ranking factor. Google has stated this directly and repeatedly. Matt Cutts addressed it in 2010, and John Mueller has confirmed it several times since.
The correlation people observe is real and the causation runs the other way. An older domain has usually accumulated more links, more content and more history of being useful — and those are ranking factors. The age itself contributes nothing.
Two related points. Buying an aged domain for its age alone rarely works: any accumulated authority is topical, and a decade-old domain about hardware repurposed for a finance site brings little across. And a domain with a history of spam or a manual penalty carries that history with it, which makes an aged domain an occasional liability rather than an asset.
Registration length is also not a signal, despite a persistent belief that registering for ten years helps. Google has denied this too. Registering long protects you against forgetting to renew, which is a real and sufficient reason.
Status codes
The status field carries EPP codes, and two families cause confusion.
Client codes are set by the registrar, usually at your request:
clientTransferProhibited — the domain cannot be transferred away. This is a good thing. It is the standard protection against domain hijacking and is enabled by default at most registrars.
clientUpdateProhibited, clientDeleteProhibited — similar locks on other operations.
Server codes are set by the registry and are more serious:
serverHold — the domain is not in the DNS at all, so the site does not resolve. Usually a dispute or a compliance issue.
pendingDelete — the domain is being released.
redemptionPeriod — the registration lapsed and it can still be recovered, at a substantial fee.
Seeing clientTransferProhibited and concluding that a domain has a problem is a common misreading. Seeing serverHold is a genuine finding.
The expiry cycle
A domain does not become available the day it expires.
| Stage | Duration | What it means |
|---|---|---|
| Expired | 0–30 days | Usually still renewable at the normal price; site may stop resolving |
| Redemption period | 30 days | Recoverable, typically for ₹5,000 to ₹15,000 |
| Pending delete | 5 days | Cannot be recovered by anyone |
| Available | — | Released for registration |
The redemption fee is set by the registry and is not negotiable. The lesson is to keep auto-renewal on and the payment method current — recovering a lapsed domain costs many times what renewing it would have.
Domains dropping out of pending delete are caught almost instantly by drop-catching services, so a valuable expired domain does not become quietly available.
What a lookup is actually useful for
Checking a suspicious site. A domain created three days ago, hosting a site asking for payment or credentials, is a strong warning. Legitimate businesses rarely operate on domains registered last week.
Before buying a domain. The record shows whether it is registered, when it expires, and whether it is locked.
Verifying an acquisition. Age, registrar and status are the first checks before agreeing a price.
Diagnosing a site outage. An expired registration or serverHold explains a site that has disappeared entirely, and it is worth checking before debugging DNS.
Competitive research, though it says considerably less than it used to.
Finding the history a record does not show
Because the creation date resets on re-registration and contact details are redacted, a lookup shows less than it used to. Three other sources fill gaps.
The Internet Archive shows what was at the domain over time. A site that was a payday loan directory in 2016 and is now a wellness brand is a fact worth knowing before buying it, and nothing in the registration record reveals it.
Certificate transparency logs record every TLS certificate ever issued for a domain, publicly and permanently. They reveal subdomains, roughly when a site became active, and which certificate authorities have been used — none of which is in the RDAP record.
DNS history services show past nameserver and IP changes, which indicate hosting moves and periods of inactivity.
Together these usually reconstruct enough of a domain's history to make a purchase decision. Individually, each is partial.
Choosing and protecting a domain
A few practical points that follow from how the record works.
Turn auto-renewal on and keep the payment method current. The redemption fee for a lapsed domain is many times the renewal cost, and the window is short.
Keep the registrar lock enabled. clientTransferProhibited is the default
protection against hijacking and there is no reason to disable it except during a
transfer you initiated.
Use a real email address that you control as the registrant contact, and one that is not on the domain itself — a domain whose contact email is at that same domain becomes unrecoverable if the domain goes down.
Enable two-factor authentication on the registrar account, which is the account that controls everything else. Domain hijacking almost always begins there rather than at the registry.
Register the obvious variants if the brand matters — the .in alongside the .com, and the common misspellings. It is cheap insurance against someone else doing it.
What this tool assumes
- Queries go to the registry's RDAP endpoint through a server, since browsers cannot query RDAP directly.
- Not every top-level domain supports RDAP fully; some country-code registries provide limited or no public data.
- Registrant contact details are redacted for most domains, which is a privacy requirement rather than a failure of the lookup.
- The creation date reflects the current registration, and it resets if the domain previously lapsed.
- Age is descriptive. It is not a quality signal, and it is not a ranking factor.