MyRecon OSINTWHOIS and RDAP Explained: Who Owns a Domain?
Every domain name has a paper trail: when it was registered, through which company, and when it expires. Reading that record is one of the fastest ways to judge whether a website is established and legitimate or brand-new and suspicious.
What WHOIS is
WHOIS is a decades-old system for looking up the registration details of a domain name. When someone registers a domain, the registrar records information about it in a database, and WHOIS is the protocol that lets anyone query that database. The response tells you things like the registrar, the registration and expiry dates, and the domain's nameservers.
The fields that matter
- Registrar — the company through which the domain was registered (for example GoDaddy, Namecheap, or MarkMonitor). Large brands often use corporate registrars.
- Creation date — when the domain was first registered. This is one of the most useful signals: a domain created a few days ago that claims to be an established business is a red flag.
- Expiry date — when the registration lapses. Serious owners renew years in advance.
- Updated date — the last time the record changed, which can hint at a recent transfer or nameserver change.
- Nameservers — the DNS servers authoritative for the domain, which often reveal the hosting or DNS provider.
- Status codes — machine-readable states such as clientTransferProhibited, which is a normal lock that prevents unauthorized transfers.
- DNSSEC — whether the domain uses cryptographic signing to protect its DNS answers from tampering.
Why the owner's name is usually hidden
Years ago, WHOIS exposed the registrant's name, address, email, and phone number. Since privacy regulations such as the GDPR came into force, most of that personal contact information is now redacted or replaced with a privacy-protection service. So while WHOIS still tells you plenty about a domain, it rarely names an individual anymore. That is by design, and it is why investigators lean on the structural details — dates, registrar, nameservers — rather than expecting a name.
RDAP: the modern replacement
WHOIS returns free-form text that every registry formats slightly differently, which makes it awkward to parse reliably. RDAP (the Registration Data Access Protocol) is its standardized successor. It returns clean, structured JSON, supports consistent fields across registries, and handles access control and internationalization far better. MyRecon's domain tool uses RDAP so the registrar, dates, status codes, DNSSEC state, and nameservers come back in a predictable, reliable shape.
WHOIS is not DNS. WHOIS/RDAP tells you about a domain's registration — who registered it and when. DNS tells you how the domain currently resolves — its servers and mail configuration. They answer different questions. See our guide to DNS records.
Putting it to use
A practical way to read a registration record: check the creation date against the site's claims, confirm the registrar and nameservers look consistent with a real business, and note whether DNSSEC and transfer locks are in place. Combined with the domain's DNS records and the geolocation of its server, you get a quick, evidence-based read on whether a domain is what it claims to be — useful for spotting phishing sites, verifying a company, or simply understanding infrastructure.