Case Study A Registrar’s Transition from WHOIS to RDAP

The transition from the legacy WHOIS protocol to the Registration Data Access Protocol (RDAP) represents one of the most significant overhauls in domain name infrastructure in recent decades. This case study explores the detailed process undertaken by a mid-sized domain name registrar, referred to here as Orion Domains, as it shifted from a WHOIS-based information service to a fully compliant RDAP implementation. Orion Domains, managing approximately two million domain names across a wide range of generic top-level domains (gTLDs), began this transition in response to regulatory shifts, ICANN mandates, and the growing demand for a more secure and structured data access model.

The registrar’s journey began with internal assessments of the limitations of their existing WHOIS infrastructure. The WHOIS service, built on a legacy codebase running over port 43, lacked the ability to format responses consistently, did not support user authentication, and was unable to comply with evolving privacy regulations such as the General Data Protection Regulation (GDPR). Additionally, the increasing number of queries and complex access policies made it difficult to scale the WHOIS service while ensuring both performance and compliance. Recognizing these limitations, Orion Domains assembled a cross-functional transition team composed of engineers, policy analysts, legal counsel, and customer support specialists.

The first phase of the transition involved understanding the technical requirements of RDAP as defined by RFCs 7480 through 7484, as well as the RDAP Operational Profile set forth by ICANN. The team identified key differences in request/response handling, authentication capabilities, and JSON-based data formatting. Unlike WHOIS, where responses are human-readable and vary widely between registrars, RDAP enforces a structured format with clearly defined schema elements, making it easier to parse and integrate into automated tools. Orion Domains realized early that adopting RDAP would require not only replacing their WHOIS service but also reengineering parts of their registration database schema to ensure accurate and standards-compliant output.

To address these challenges, the technical team began designing a stateless RDAP server architecture using RESTful APIs and HTTPS endpoints. The backend was built using Python and Flask, interfacing with a PostgreSQL database optimized for domain and contact queries. RDAP-specific schema mappings were created to transform internal data models into the standardized RDAP JSON output. Extensive attention was given to data validation, ensuring that all mandatory fields—such as object class names, entity handles, status values, and event timelines—were accurately represented. Redaction logic was implemented to handle cases where registrant information needed to be suppressed for privacy reasons, in compliance with GDPR and other regional regulations.

One of the more complex tasks involved implementing differentiated access controls. WHOIS had been a largely public service with uniform data disclosure, but RDAP introduced the possibility of role-based access, allowing Orion Domains to expose different data sets to anonymous users, authenticated partners, or law enforcement agencies. OAuth 2.0 was chosen as the preferred authentication framework, and a secure token-based system was developed to issue and validate credentials. These credentials were integrated into the RDAP server’s logic to dynamically adjust the visibility of contact information, domain statuses, and registrar details based on the access level of the querying party.

The legal and compliance teams played a crucial role in developing the RDAP privacy policy and terms of use. They were tasked with ensuring that the data exposed through RDAP did not violate any local or international data protection laws. This included creating a layered approach to consent management and ensuring that all registrants were informed about how their data might be used or disclosed through RDAP queries. The customer support team prepared to handle inquiries related to changes in data visibility and began drafting documentation to assist users transitioning from WHOIS-based tools to RDAP interfaces.

Testing and validation formed a core part of the deployment plan. Orion Domains participated in ICANN’s RDAP pilot program, which allowed them to register their endpoints in the IANA bootstrap registry and receive feedback from the broader internet community. Internal tools were developed to simulate various query types, test for compliance with RDAP schemas, and monitor performance under load. External validators and compliance checkers were used to ensure interoperability with major RDAP clients and that the implementation adhered strictly to the RDAP Operational Profile.

Deployment was staged in phases to minimize disruption. The RDAP service was initially launched in parallel with the WHOIS service, allowing users to test and familiarize themselves with the new protocol. Redirects and notifications were added to WHOIS responses to inform users about the availability of RDAP and to encourage migration. After a three-month parallel run, WHOIS service for certain query types was deprecated, and the RDAP service became the authoritative source for domain registration data. Throughout this process, feedback loops were maintained with registrars, law enforcement entities, and technical users to ensure the service met operational and usability expectations.

Post-deployment, Orion Domains invested in ongoing monitoring and maintenance of their RDAP service. Logging and analytics tools were integrated to track query patterns, detect anomalies, and provide insight into how users interacted with the data. These insights were used to refine performance tuning, improve caching strategies, and enhance response times for high-volume queries. Additionally, the company continued to monitor updates from IETF and ICANN to remain compliant with evolving RDAP standards and policy changes, including potential future features like federated authentication or real-time access revocation.

The transition from WHOIS to RDAP significantly improved Orion Domains’ ability to meet regulatory requirements, support diverse stakeholder needs, and operate a secure and scalable data access platform. By embracing RDAP’s capabilities—such as structured data, secure transport, differentiated access, and internationalization support—the registrar positioned itself for long-term sustainability and technical alignment with the modern internet ecosystem. This case underscores the importance of cross-disciplinary collaboration, early adoption of standards, and a proactive approach to managing change in internet infrastructure services.

The transition from the legacy WHOIS protocol to the Registration Data Access Protocol (RDAP) represents one of the most significant overhauls in domain name infrastructure in recent decades. This case study explores the detailed process undertaken by a mid-sized domain name registrar, referred to here as Orion Domains, as it shifted from a WHOIS-based information…