RDAP

App · Utilities · 20 actions

Look up who owns a domain, an IP address or a network from a workflow, with no account and no API key. RDAP is the structured replacement for WHOIS that every domain registry and every regional internet registry now runs, so the answer comes back as fields you can branch on rather than text to parse. Read a domain's registrar, registrant, nameservers, DNSSEC keys, transfer locks and expiry date; check whether a name is taken; watch a portfolio of up to 50 domains in one step and see which expires soonest; turn an IP address or an AS number into the organisation behind it; and find the abuse address for any of them, ready to send an email to. Search a registry for domains, nameservers, contacts and organisations where it offers search. Read IANA's own directories to see which top-level domains publish RDAP and which server answers for each. Every action reads: RDAP has no route that changes anything.

Actions

ActionWhat it does
Check whether a domain is registeredAnswer one question about a domain: is it taken?
Find an abuse contactFind where to report abuse coming from a domain, an IP address or an autonomous system, and get the address as a plain field ready to send an email to.
Find the RDAP server for somethingSay which RDAP server is authoritative for a domain, an IP address, an AS number or an entity handle - and which of IANA's five directories said so, and on what.
List top-level domains with RDAPList every top-level domain that publishes RDAP, with the server that answers for it, optionally filtered to the ones whose name contains a string.
Look up a domainLook up everything a domain's registry publishes about it: who registered it, through which registrar, when it was registered and when it expires, which nameservers it uses, whether it is signed with DNSSEC, whether it is locked against transfer, and where to report abuse.
Look up a nameserverLook up a nameserver as the registry holds it, including the glue addresses it is registered at and whether it is locked against change.
Look up a top-level domainLook up a top-level domain's own record in IANA's root zone: the organisation that runs it, when it was delegated and last changed, the nameservers that serve it and its DNSSEC keys.
Look up an AS numberLook up an autonomous system number and find the network operator behind it: the organisation's name, the country, the range the number sits in and where to report abuse.
Look up an entityLook up a contact, an organisation or a registrar by its handle, and get its name, email address, phone number and postal address as plain fields rather than as the nested jCard array RDAP sends them in.
Look up an IP addressFind out who an IP address is registered to.
Look up domains in bulkLook up many domains in one step and get one row per domain: whether it is registered, its registrar, its expiry date, how many days that is, its status and its nameservers.
Read a bootstrap registryRead one of IANA's five RDAP directories whole: the top-level domains, the IPv4 and IPv6 address blocks, the autonomous system number ranges, or the entity handle suffixes - each with the servers that answer for them.
Read a server's terms and capabilitiesRead one RDAP server's own help response: its terms of use, any rate limit it publishes, its copyright notice, and which optional extensions it implements.
Search domains by nameSearch one registry for domains whose name matches a pattern, with at most one '' in it: 'nic.fr' finds that exact domain, 'exam.fr' finds every .fr domain starting 'exam'.
Search domains by nameserverSearch one registry for the domains it has delegated to a nameserver.
Search domains by nameserver IP addressSearch one registry for the domains it has delegated to any nameserver answering at an IP address.
Search entities by handleSearch one registry for contacts and organisations whose handle matches a pattern, with at most one '*' standing for any trailing characters.
Search entities by nameSearch one registry for contacts and organisations by name, with at most one '*' standing for any trailing characters.
Search nameservers by IP addressSearch one registry for the nameservers registered at an IP address.
Search nameservers by nameSearch one registry for nameserver records whose host name matches a pattern, with at most one '*' in it.

Check whether a domain is registered

Answer one question about a domain: is it taken? Returns a true or false a condition can branch on, and when the domain is taken it also says when it expires, how many days that is, and whether its status says it is on its way back onto the market. Use it to screen a list of names, to watch for a competitor's domain lapsing, or in a condition before the rest of a workflow runs. RDAP answers whether the registry holds a record, which is not quite the same as whether you can buy the name, and the step says so. No API key required.

Inputs

Domain namedomaintextRequired
A domain name, such as 'example.com'. Capitalisation does not matter, an internationalised name is converted for you, and a URL or an email address is reduced to its host, so a value from an earlier step usually works as it stands.

Outputs

availabletrue/false
bootstrap_matchtext
bootstrap_registrytext
caveattext
days_until_expirynumber
domaintext
expiration_datetext
may_become_availabletrue/false
messagetext
query_urltext
registeredtrue/false
secure_transporttrue/false
servertext
server_errortext
server_hosttext
statuslist
Example output
{
  "available": false,
  "bootstrap_match": "fr",
  "bootstrap_registry": "dns",
  "caveat": null,
  "days_until_expiry": 1222,
  "domain": "nic.fr",
  "expiration_date": "2029-12-31T23:00:00Z",
  "may_become_available": false,
  "message": "nic.fr - registered through Registry Operations - expires in 1222 days",
  "query_url": "https://rdap.nic.fr/domain/nic.fr",
  "registered": true,
  "secure_transport": true,
  "server": "https://rdap.nic.fr/",
  "server_error": null,
  "server_host": "rdap.nic.fr",
  "status": [
    "server transfer prohibited",
    "server delete prohibited"
  ]
}

Find an abuse contact

Find where to report abuse coming from a domain, an IP address or an autonomous system, and get the address as a plain field ready to send an email to. This is the question RDAP is asked most often and the hardest one to answer by hand: the abuse address is not on the object itself but on a contact nested inside its registrar or its network holder. The step walks to it, and falls back to the registrar's or the holder's own address when no abuse contact is published, saying which of the two it found. No API key required.

Inputs

What to reportobject_typetextRequired
What kind of thing the abuse is coming from.One of: domain (Domain name (example.com)), ip (IP address or network (8.8.8.8, 8.8.8.0/24)), autnum (Autonomous system number (AS15169)). Default: domain.
Domain, IP address or AS numbervaluetextRequired
The domain name, IP address or AS number the abuse is coming from, matching the type chosen above.

Outputs

abuse_contactobject
abuse_emailtext
abuse_phonetext
bootstrap_matchtext
bootstrap_registrytext
foundtrue/false
messagetext
object_typetext
query_urltext
reported_bytext
secure_transporttrue/false
servertext
server_errortext
server_hosttext
valuetext
Example output
{
  "abuse_contact": {
    "address": "7, avenue du 8 mai 1945, Guyancourt, 78280",
    "address_lines": [
      "7, avenue du 8 mai 1945",
      "Guyancourt",
      "78280"
    ],
    "country_code": "FR",
    "email": "juridique@afnic.fr",
    "emails": [
      "juridique@afnic.fr"
    ],
    "entities": [],
    "events": {},
    "fax": "+33.139308301",
    "handle": "NF100-FRNIC",
    "iana_registrar_id": null,
    "kind": null,
    "name": "AFNIC",
    "organization": null,
    "phone": "+33.139308300",
    "phones": [
      "+33.139308300"
    ],
    "public_ids": [],
    "role_descriptions": [
      "The holder of the registration"
    ],
    "roles": [
      "registrant"
    ],
    "status": [],
    "title": null,
    "url": null,
    "vcard": null
  },
  "abuse_email": "network-abuse@google.com",
  "abuse_phone": "+1-650-253-0000",
  "bootstrap_match": "8.0.0.0/8",
  "bootstrap_registry": "ipv4",
  "found": true,
  "message": "Report abuse from 8.8.8.8 to network-abuse@google.com",
  "object_type": "ip",
  "query_url": "https://rdap.arin.net/registry/ip/8.8.8.8",
  "reported_by": "the abuse contact",
  "secure_transport": true,
  "server": "https://rdap.arin.net/registry/",
  "server_error": null,
  "server_host": "rdap.arin.net",
  "value": "8.8.8.8"
}

Find the RDAP server for something

Say which RDAP server is authoritative for a domain, an IP address, an AS number or an entity handle - and which of IANA's five directories said so, and on what. This is the routing every other action does before it asks anything, exposed on its own. Use it to check whether a top-level domain publishes RDAP before building a workflow around it, to see which regional registry an address belongs to without querying the registry, or to fill the server field of a search step. No API key required.

Inputs

Kind of objectobject_typetextRequired
What kind of thing to find the server for.One of: domain (Domain name (example.com)), ip (IP address or network (8.8.8.8, 8.8.8.0/24)), autnum (Autonomous system number (AS15169)), entity (Entity handle (GOGL-ARIN)), nameserver (Nameserver (ns1.example.com)). Default: domain.
ValuevaluetextRequired
The domain, address, AS number, handle or nameserver to route, matching the kind chosen above.

Outputs

all_urlslist
bootstrap_matchtext
bootstrap_registrytext
foundtrue/false
messagetext
object_typetext
query_urltext
secure_transporttrue/false
servertext
server_hosttext
valuetext
Example output
{
  "all_urls": [
    "https://rdap.nominet.uk/uk/"
  ],
  "bootstrap_match": "uk",
  "bootstrap_registry": "dns",
  "found": true,
  "message": "rdap.nominet.uk is authoritative for example.co.uk, matched on 'uk' in IANA's dns bootstrap registry.",
  "object_type": "domain",
  "query_url": "https://rdap.nominet.uk/uk/domain/example.co.uk",
  "secure_transport": true,
  "server": "https://rdap.nominet.uk/uk/",
  "server_host": "rdap.nominet.uk",
  "value": "example.co.uk"
}

List top-level domains with RDAP

List every top-level domain that publishes RDAP, with the server that answers for it, optionally filtered to the ones whose name contains a string. This is IANA's own directory, and it is what decides whether a domain can be looked up at all, so it is the honest way to check coverage before building a workflow over a list of domains whose top-level domains you do not control. The result carries the date IANA last published the directory. No API key required.

Inputs

Name containscontainstext
Optional. Only top-level domains whose name contains this text, for example 'bank'. All of them are returned when this is empty.
Maximum resultslimitnumber
How many top-level domains to return, from 1 to 1,500. The result says when more matched than were returned.From 1 to 1500. Default: 100.

Outputs

containstext
countnumber
limitnumber
matchednumber
messagetext
publishedtext
resultslist
totalnumber
truncatedtrue/false
Example output
{
  "contains": "bank",
  "count": 3,
  "limit": 3,
  "matched": 7,
  "message": "7 of 1200 top-level domains with an RDAP server match 'bank'",
  "published": "2026-07-23T02:00:03Z",
  "results": [
    {
      "secure_transport": true,
      "server": "https://rdap.nic.bank/",
      "server_host": "rdap.nic.bank",
      "tld": "bank",
      "unicode_tld": null
    },
    {
      "secure_transport": true,
      "server": "https://rdap.nic.commbank/",
      "server_host": "rdap.nic.commbank",
      "tld": "commbank",
      "unicode_tld": null
    },
    {
      "secure_transport": true,
      "server": "https://rdap.identitydigital.services/rdap/",
      "server_host": "rdap.identitydigital.services",
      "tld": "hdfcbank",
      "unicode_tld": null
    }
  ],
  "total": 1200,
  "truncated": true
}

Look up a domain

Look up everything a domain's registry publishes about it: who registered it, through which registrar, when it was registered and when it expires, which nameservers it uses, whether it is signed with DNSSEC, whether it is locked against transfer, and where to report abuse. This is WHOIS's replacement, so the answer is structured fields rather than text to parse, and the days remaining until expiry are worked out for you. The right registry is found automatically from IANA's own directory, so any of the roughly 1,200 top-level domains that publish RDAP will answer. A whole URL or a host name works as it stands: no registry holds a record for 'www.example.com', so the step walks up to the name that is registered and says it did. No account or API key required.

Inputs

Domain namedomaintextRequired
A domain name, such as 'example.com'. Capitalisation does not matter, an internationalised name is converted for you, and a URL or an email address is reduced to its host, so a value from an earlier step usually works as it stands.
Also read the registrar's recordfollow_registrartrue/false
Off by default, and one extra request when it is on. The .com, .net and .org registries are 'thin': their record holds a domain's status, dates and nameservers but no registrant at all, because that lives at the registrar. Turn this on to follow the registry's link to the registrar's own RDAP server and fill in what the registry left blank. A registrar server that is slow or down leaves the registry's answer intact rather than failing the step.Default: false.

Outputs

bootstrap_matchtext
bootstrap_registrytext
domaintext
foundtrue/false
messagetext
notetext
queriedtext
query_urltext
registeredtrue/false
registrar_recordobject
registrar_record_errortext
resultobject
secure_transporttrue/false
servertext
server_errortext
server_hosttext
Example output
{
  "bootstrap_match": "fr",
  "bootstrap_registry": "dns",
  "domain": "nic.fr",
  "found": true,
  "message": "nic.fr - registered through Registry Operations - expires in 1222 days",
  "note": null,
  "queried": "nic.fr",
  "query_url": "https://rdap.nic.fr/domain/nic.fr",
  "registered": true,
  "registrar_record": null,
  "registrar_record_error": null,
  "result": {
    "abuse_email": "support@afnic.fr",
    "conformance": [
      "rdap_level_0",
      "icann_rdap_technical_implementation_guide_1",
      "icann_rdap_response_profile_1"
    ],
    "contacts": {
      "registrant": {
        "address": "7, avenue du 8 mai 1945, Guyancourt, 78280",
        "address_lines": [
          "7, avenue du 8 mai 1945",
          "Guyancourt",
          "78280"
        ],
        "country_code": "FR",
        "email": "juridique@afnic.fr",
        "emails": [
          "juridique@afnic.fr"
        ],
        "entities": [],
        "events": {},
        "fax": "+33.139308301",
        "handle": "NF100-FRNIC",
        "iana_registrar_id": null,
        "kind": null,
        "name": "AFNIC",
        "organization": null,
        "phone": "+33.139308300",
        "phones": [
          "+33.139308300"
        ],
        "public_ids": [],
        "role_descriptions": [
          "The holder of the registration"
        ],
        "roles": [
          "registrant"
        ],
        "status": [],
        "title": null,
        "url": null,
        "vcard": null
      }
    },
    "days_until_expiry": 1222,
    "dnssec": {
      "ds_records": [
        {
          "algorithm": 13,
          "algorithm_name": "ECDSA Curve P-256 with SHA-256",
          "digest": "10029d7a06eb202c21618090866a1e5b3f5ec65b11451671516a934e50873915",
          "digest_type": 2,
          "key_tag": 30098
        }
      ],
      "key_records": [],
      "signed": true,
      "zone_signed": false
    },
    "domain": "nic.fr",
    "entities": [],
    "events": {
      "expiration": "2029-12-31T23:00:00Z",
      "last changed": "2026-06-05T07:20:46.286415Z",
      "registration": "1995-01-01T00:00:00Z"
    },
    "expiration_date": "2029-12-31T23:00:00Z",
    "expired": false,
    "handle": "DOM000000000001-FRNIC",
    "in_redemption_period": false,
    "is_active": false,
    "is_locked": true,
    "is_on_hold": false,
    "is_pending_delete": false,
    "last_changed_date": "2026-06-05T07:20:46.286415Z",
    "last_database_update": "2026-08-27T20:24:47Z",
    "may_become_available": false,
    "nameserver_names": [
      "ns1.ext.nic.fr",
      "ns4.nic.fr",
      "ns6.ext.nic.fr",
      "ns7.ext.nic.fr"
    ],
    "nameservers": [],
    "notices": [],
    "port43": null,
    "redacted": [],
    "registrant": "AFNIC",
    "registrant_country": "FR",
    "registrar": "Registry Operations",
    "registrar_id": null,
    "registrar_url": "https://www.afnic.fr",
    "registration_date": "1995-01-01T00:00:00Z",
    "status": [
      "server transfer prohibited",
      "server delete prohibited"
    ],
    "status_descriptions": [
      "The registry has locked the domain against transfer",
      "The registry has locked the domain against deletion"
    ],
    "summary": "nic.fr - registered through Registry Operations - expires in 1222 days",
    "unicode_name": null,
    "url": "https://rdap.nic.fr/domain/nic.fr"
  },
  "secure_transport": true,
  "server": "https://rdap.nic.fr/",
  "server_error": null,
  "server_host": "rdap.nic.fr"
}

Look up a nameserver

Look up a nameserver as the registry holds it, including the glue addresses it is registered at and whether it is locked against change. This is the registry's record rather than what DNS answers today, which is exactly what you want when checking that a delegation was set up correctly. A nameserver only exists as a record of its own where it has glue, so a working nameserver can legitimately have none, and the step says so rather than failing. No API key required.

Inputs

NameservernameservertextRequired
A nameserver's host name, such as 'ns1.example.com'. Capitalisation does not matter.

Outputs

bootstrap_matchtext
bootstrap_registrytext
foundtrue/false
messagetext
nameservertext
notetext
query_urltext
resultobject
secure_transporttrue/false
servertext
server_errortext
server_hosttext
Example output
{
  "bootstrap_match": "net",
  "bootstrap_registry": "dns",
  "found": true,
  "message": "a.iana-servers.net (199.43.135.53, 2001:500:8F:0:0:0:0:53)",
  "nameserver": "a.iana-servers.net",
  "note": null,
  "query_url": "https://rdap.verisign.com/net/v1/nameserver/a.iana-servers.net",
  "result": {
    "conformance": [
      "rdap_level_0"
    ],
    "entities": [],
    "events": {
      "last update of rdap database": "2026-08-27T20:24:31Z"
    },
    "handle": null,
    "has_glue": true,
    "hostname": "a.iana-servers.net",
    "in_redemption_period": false,
    "ip_addresses": [
      "199.43.135.53",
      "2001:500:8F:0:0:0:0:53"
    ],
    "ipv4": [
      "199.43.135.53"
    ],
    "ipv6": [
      "2001:500:8F:0:0:0:0:53"
    ],
    "is_active": true,
    "is_locked": false,
    "is_on_hold": false,
    "is_pending_delete": false,
    "may_become_available": false,
    "notices": [],
    "redacted": [],
    "status": [],
    "status_descriptions": [],
    "summary": "a.iana-servers.net (199.43.135.53, 2001:500:8F:0:0:0:0:53)",
    "unicode_name": null,
    "url": "https://rdap.verisign.com/net/v1/nameserver/a.iana-servers.net"
  },
  "secure_transport": true,
  "server": "https://rdap.verisign.com/net/v1/",
  "server_error": null,
  "server_host": "rdap.verisign.com"
}

Look up a top-level domain

Look up a top-level domain's own record in IANA's root zone: the organisation that runs it, when it was delegated and last changed, the nameservers that serve it and its DNSSEC keys. The step also says whether the registry behind it publishes RDAP, and where, so you can tell in one call whether a domain under it can be looked up at all. Every delegated top-level domain is in the list, not only the ones with an RDAP server. No API key required.

Inputs

Top-level domaintldtextRequired
The top-level domain to read, chosen from IANA's root zone. An internationalised one is listed under its readable name as well as its 'xn--' form.

Outputs

bootstrap_matchtext
bootstrap_registrytext
foundtrue/false
has_rdap_servertrue/false
messagetext
query_urltext
rdap_servertext
resultobject
secure_transporttrue/false
servertext
server_errortext
server_hosttext
tldtext
Example output
{
  "bootstrap_match": "fr",
  "bootstrap_registry": "root zone",
  "found": true,
  "has_rdap_server": true,
  "message": ".fr is delegated to Association Fran\u00e7aise pour le Nommage Internet en Coop\u00e9ration (A.F.N.I.C.), RDAP at rdap.nic.fr",
  "query_url": "https://rdap.iana.org/domain/fr",
  "rdap_server": "https://rdap.nic.fr/",
  "result": {
    "abuse_email": "support@afnic.fr",
    "conformance": [
      "rdap_level_0",
      "icann_rdap_technical_implementation_guide_1",
      "icann_rdap_response_profile_1"
    ],
    "contacts": {
      "registrant": {
        "address": "7, avenue du 8 mai 1945, Guyancourt, 78280",
        "address_lines": [
          "7, avenue du 8 mai 1945",
          "Guyancourt",
          "78280"
        ],
        "country_code": "FR",
        "email": "juridique@afnic.fr",
        "emails": [
          "juridique@afnic.fr"
        ],
        "entities": [],
        "events": {},
        "fax": "+33.139308301",
        "handle": "NF100-FRNIC",
        "iana_registrar_id": null,
        "kind": null,
        "name": "AFNIC",
        "organization": null,
        "phone": "+33.139308300",
        "phones": [
          "+33.139308300"
        ],
        "public_ids": [],
        "role_descriptions": [
          "The holder of the registration"
        ],
        "roles": [
          "registrant"
        ],
        "status": [],
        "title": null,
        "url": null,
        "vcard": null
      }
    },
    "days_until_expiry": 1222,
    "dnssec": {
      "ds_records": [
        {
          "algorithm": 13,
          "algorithm_name": "ECDSA Curve P-256 with SHA-256",
          "digest": "10029d7a06eb202c21618090866a1e5b3f5ec65b11451671516a934e50873915",
          "digest_type": 2,
          "key_tag": 30098
        }
      ],
      "key_records": [],
      "signed": true,
      "zone_signed": false
    },
    "domain": "nic.fr",
    "entities": [],
    "events": {
      "expiration": "2029-12-31T23:00:00Z",
      "last changed": "2026-06-05T07:20:46.286415Z",
      "registration": "1995-01-01T00:00:00Z"
    },
    "expiration_date": "2029-12-31T23:00:00Z",
    "expired": false,
    "handle": "DOM000000000001-FRNIC",
    "in_redemption_period": false,
    "is_active": false,
    "is_locked": true,
    "is_on_hold": false,
    "is_pending_delete": false,
    "last_changed_date": "2026-06-05T07:20:46.286415Z",
    "last_database_update": "2026-08-27T20:24:47Z",
    "may_become_available": false,
    "nameserver_names": [
      "ns1.ext.nic.fr",
      "ns4.nic.fr",
      "ns6.ext.nic.fr",
      "ns7.ext.nic.fr"
    ],
    "nameservers": [],
    "notices": [],
    "port43": null,
    "redacted": [],
    "registrant": "AFNIC",
    "registrant_country": "FR",
    "registrar": "Registry Operations",
    "registrar_id": null,
    "registrar_url": "https://www.afnic.fr",
    "registration_date": "1995-01-01T00:00:00Z",
    "status": [
      "server transfer prohibited",
      "server delete prohibited"
    ],
    "status_descriptions": [
      "The registry has locked the domain against transfer",
      "The registry has locked the domain against deletion"
    ],
    "summary": "nic.fr - registered through Registry Operations - expires in 1222 days",
    "unicode_name": null,
    "url": "https://rdap.nic.fr/domain/nic.fr"
  },
  "secure_transport": true,
  "server": "https://rdap.iana.org/",
  "server_error": null,
  "server_host": "rdap.iana.org",
  "tld": "fr"
}

Look up an AS number

Look up an autonomous system number and find the network operator behind it: the organisation's name, the country, the range the number sits in and where to report abuse. An AS number is how a network is identified on the public internet, so this is the step for turning a BGP route or a traffic report into a company you can contact. The right regional internet registry is found automatically. No API key required.

Inputs

AS numberasntextRequired
An autonomous system number, written 'AS15169' or just '15169'. An AS number identifies a network operator on the public internet.

Outputs

asnnumber
bootstrap_matchtext
bootstrap_registrytext
foundtrue/false
messagetext
notetext
query_urltext
resultobject
secure_transporttrue/false
servertext
server_errortext
server_hosttext
Example output
{
  "asn": 15169,
  "bootstrap_match": "14848-16383",
  "bootstrap_registry": "asn",
  "found": true,
  "message": "AS15169 - Google LLC",
  "note": null,
  "query_url": "https://rdap.arin.net/registry/autnum/15169",
  "result": {
    "abuse_email": "network-abuse@google.com",
    "abuse_phone": "+1-650-253-0000",
    "as_number": "AS15169",
    "conformance": [
      "nro_rdap_profile_0",
      "rdap_level_0"
    ],
    "contacts": {},
    "country": null,
    "end_autnum": 15169,
    "entities": [],
    "events": {
      "last changed": "2019-10-31T15:45:45-04:00",
      "registration": "2000-03-30T00:00:00-05:00"
    },
    "handle": "AS15169",
    "in_redemption_period": false,
    "is_active": true,
    "is_locked": false,
    "is_on_hold": false,
    "is_pending_delete": false,
    "may_become_available": false,
    "name": "GOOGLE",
    "notices": [],
    "organization": "Google LLC",
    "port43": "whois.arin.net",
    "redacted": [],
    "start_autnum": 15169,
    "status": [],
    "status_descriptions": [],
    "summary": "AS15169 - Google LLC",
    "type": "DIRECT ALLOCATION",
    "url": "https://rdap.arin.net/registry/autnum/15169"
  },
  "secure_transport": true,
  "server": "https://rdap.arin.net/registry/",
  "server_error": null,
  "server_host": "rdap.arin.net"
}

Look up an entity

Look up a contact, an organisation or a registrar by its handle, and get its name, email address, phone number and postal address as plain fields rather than as the nested jCard array RDAP sends them in. Handles come back on every other lookup - a domain's registrar, a network's abuse contact - so this is how a workflow follows one to the organisation behind it. The handle's own suffix says which registry to ask, so nothing else is needed for a tagged handle. No API key required.

Inputs

Entity handlehandletextRequired
An entity's handle, which ends in the registry that issued it - 'ORG-RIEN1-RIPE' is RIPE NCC's, 'ABUSE5250-ARIN' is ARIN's. That suffix is what says which server to ask, so a handle without one needs the RDAP server field filled in as well.
RDAP serverregistrytext
Optional, and only needed for a handle with no registry suffix, such as ARIN's own 'GOGL'. Leave it empty for a tagged handle and the right server is found from the suffix.

Outputs

bootstrap_matchtext
bootstrap_registrytext
foundtrue/false
handletext
messagetext
notetext
query_urltext
resultobject
secure_transporttrue/false
servertext
server_errortext
server_hosttext
Example output
{
  "bootstrap_match": "RIPE",
  "bootstrap_registry": "object-tags",
  "found": true,
  "handle": "ORG-RIEN1-RIPE",
  "message": "ORG-RIEN1-RIPE - Reseaux IP Europeens Network Coordination Centre (RIPE NCC)",
  "note": null,
  "query_url": "https://rdap.db.ripe.net/entity/ORG-RIEN1-RIPE",
  "result": {
    "address": "P.O. Box 10096, 1001 EB, Amsterdam, NETHERLANDS",
    "address_lines": [
      "P.O. Box 10096",
      "1001 EB",
      "Amsterdam",
      "NETHERLANDS"
    ],
    "conformance": [
      "cidr0",
      "rdap_level_0",
      "nro_rdap_profile_0",
      "redacted"
    ],
    "country_code": null,
    "email": "ncc@ripe.net",
    "emails": [
      "ncc@ripe.net"
    ],
    "entities": [],
    "events": {},
    "fax": null,
    "handle": "ORG-RIEN1-RIPE",
    "iana_registrar_id": null,
    "kind": "org",
    "name": "Reseaux IP Europeens Network Coordination Centre (RIPE NCC)",
    "notices": [],
    "organization": null,
    "phone": "+31205354444",
    "phones": [
      "+31205354444"
    ],
    "public_ids": [],
    "redacted": [],
    "role_descriptions": [],
    "roles": [],
    "status": [],
    "title": null,
    "url": "https://rdap.db.ripe.net/entity/ORG-RIEN1-RIPE",
    "vcard": null
  },
  "secure_transport": true,
  "server": "https://rdap.db.ripe.net/",
  "server_error": null,
  "server_host": "rdap.db.ripe.net"
}

Look up an IP address

Find out who an IP address is registered to. Returns the network the address falls inside, its CIDR range, the organisation that holds it, what kind of allocation it is, and where to report abuse from it. This is the step for turning an address out of a server log into an owner: an attacker's address into a network operator to report, or a visitor's address into the company behind it. The right regional internet registry - ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC - is found automatically. IPv4 and IPv6 both work. No API key required.

Inputs

IP address or networkip_addresstextRequired
An IPv4 or IPv6 address, or a network in CIDR notation. The answer is the registered network the address falls inside, which is usually larger than the address itself.

Outputs

bootstrap_matchtext
bootstrap_registrytext
foundtrue/false
ip_addresstext
messagetext
notetext
query_urltext
resultobject
secure_transporttrue/false
servertext
server_errortext
server_hosttext
Example output
{
  "bootstrap_match": "8.0.0.0/8",
  "bootstrap_registry": "ipv4",
  "found": true,
  "ip_address": "8.8.8.8",
  "message": "8.8.8.0/24 - Google LLC",
  "note": null,
  "query_url": "https://rdap.arin.net/registry/ip/8.8.8.8",
  "result": {
    "abuse_email": "network-abuse@google.com",
    "abuse_phone": "+1-650-253-0000",
    "cidr": [
      "8.8.8.0/24"
    ],
    "conformance": [
      "nro_rdap_profile_0",
      "rdap_level_0",
      "cidr0",
      "arin_originas0"
    ],
    "contacts": {},
    "country": null,
    "end_address": "8.8.8.255",
    "entities": [],
    "events": {
      "last changed": "2023-12-28T17:24:56-05:00",
      "registration": "2023-12-28T17:24:33-05:00"
    },
    "handle": "NET-8-8-8-0-2",
    "in_redemption_period": false,
    "ip_version": "v4",
    "is_active": true,
    "is_locked": false,
    "is_on_hold": false,
    "is_pending_delete": false,
    "may_become_available": false,
    "name": "GOGL",
    "notices": [],
    "organization": "Google LLC",
    "parent_handle": "NET-8-0-0-0-0",
    "port43": "whois.arin.net",
    "range": "8.8.8.0 - 8.8.8.255",
    "redacted": [],
    "start_address": "8.8.8.0",
    "status": [
      "active"
    ],
    "status_descriptions": [
      "Registered and working normally"
    ],
    "summary": "8.8.8.0/24 - Google LLC",
    "type": "DIRECT ALLOCATION",
    "url": "https://rdap.arin.net/registry/ip/8.8.8.0"
  },
  "secure_transport": true,
  "server": "https://rdap.arin.net/registry/",
  "server_error": null,
  "server_host": "rdap.arin.net"
}

Look up domains in bulk

Look up many domains in one step and get one row per domain: whether it is registered, its registrar, its expiry date, how many days that is, its status and its nameservers. The step also names the domain expiring soonest, which is the whole answer for a renewal reminder. Use it for a portfolio, a spreadsheet column, or a list of names you are considering buying. RDAP publishes no bulk route, so this is one request per domain - but the registry directory is read once for the whole list, the requests are paced, and a domain that fails is reported on its own row instead of stopping the step. Up to 50 domains at a time. No API key required.

Inputs

DomainsdomainslistRequired
The domains to look up, one per line - or a list from an earlier step, such as a spreadsheet column. Up to 50. Duplicates are kept so the answers line up with the rows they came from.

Outputs

expiring_soonestobject
failedlist
failed_countnumber
messagetext
registeredlist
registered_countnumber
requestednumber
requests_madenumber
resultslist
unregisteredlist
unregistered_countnumber
Example output
{
  "expiring_soonest": {
    "days_until_expiry": 748,
    "domain": "google.com",
    "expiration_date": "2028-09-14T04:00:00Z"
  },
  "failed": [],
  "failed_count": 0,
  "message": "2 of 3 registered, 1 not registered",
  "registered": [
    "google.com",
    "nic.fr"
  ],
  "registered_count": 2,
  "requested": 3,
  "requests_made": 4,
  "results": [
    {
      "days_until_expiry": 748,
      "domain": "google.com",
      "error": null,
      "expiration_date": "2028-09-14T04:00:00Z",
      "nameservers": [
        "ns1.google.com",
        "ns2.google.com"
      ],
      "registered": true,
      "registrar": "MarkMonitor Inc.",
      "server": "https://rdap.verisign.com/com/v1/",
      "status": [
        "client delete prohibited",
        "client transfer prohibited"
      ]
    },
    {
      "days_until_expiry": 1222,
      "domain": "nic.fr",
      "error": null,
      "expiration_date": "2029-12-31T23:00:00Z",
      "nameservers": [
        "ns1.ext.nic.fr",
        "ns4.nic.fr"
      ],
      "registered": true,
      "registrar": "Registry Operations",
      "server": "https://rdap.nic.fr/",
      "status": [
        "server transfer prohibited"
      ]
    },
    {
      "days_until_expiry": null,
      "domain": "zzq12345-not-real.com",
      "error": null,
      "expiration_date": null,
      "nameservers": [],
      "registered": false,
      "registrar": null,
      "server": "https://rdap.verisign.com/com/v1/",
      "status": []
    }
  ],
  "unregistered": [
    "zzq12345-not-real.com"
  ],
  "unregistered_count": 1
}

Read a bootstrap registry

Read one of IANA's five RDAP directories whole: the top-level domains, the IPv4 and IPv6 address blocks, the autonomous system number ranges, or the entity handle suffixes - each with the servers that answer for them. This is where to see which regional registry holds which address ranges, or which operator runs RDAP for a group of top-level domains. The result carries the date IANA last published that directory, so a workflow can notice when it changes. No API key required.

Inputs

DirectoryregistrytextRequired
Which of IANA's five RDAP directories to read.One of: dns (dns - top-level domains), ipv4 (ipv4 - IPv4 address blocks), ipv6 (ipv6 - IPv6 address blocks), asn (asn - autonomous system number ranges), object-tags (object-tags - entity handle suffixes). Default: dns.
Maximum resultslimitnumber
How many service blocks to return, from 1 to 1,000. The result says when more exist than were returned.From 1 to 1000. Default: 50.

Outputs

countnumber
descriptiontext
limitnumber
messagetext
publishedtext
registrytext
resultslist
totalnumber
truncatedtrue/false
versiontext
Example output
{
  "count": 2,
  "description": "IPv4 address blocks and the RDAP server for each",
  "limit": 2,
  "message": "5 service blocks in IANA's ipv4 bootstrap registry",
  "published": "2019-06-07T19:00:02Z",
  "registry": "ipv4",
  "results": [
    {
      "contacts": [],
      "key_count": 3,
      "keys": [
        "41.0.0.0/8",
        "102.0.0.0/8",
        "105.0.0.0/8"
      ],
      "secure_transport": true,
      "server": "https://rdap.afrinic.net/rdap/",
      "server_host": "rdap.afrinic.net",
      "urls": [
        "https://rdap.afrinic.net/rdap/",
        "http://rdap.afrinic.net/rdap/"
      ]
    },
    {
      "contacts": [],
      "key_count": 3,
      "keys": [
        "1.0.0.0/8",
        "14.0.0.0/8",
        "27.0.0.0/8"
      ],
      "secure_transport": true,
      "server": "https://rdap.apnic.net/",
      "server_host": "rdap.apnic.net",
      "urls": [
        "https://rdap.apnic.net/"
      ]
    }
  ],
  "total": 5,
  "truncated": true,
  "version": "1.0"
}

Read a server's terms and capabilities

Read one RDAP server's own help response: its terms of use, any rate limit it publishes, its copyright notice, and which optional extensions it implements. Every RDAP server has to serve this, and it is the only place a server states its own rules, so it is worth reading once before building against a registry you have not used. The extensions list is what says whether a server offers search, reverse search or history at all. No API key required.

Inputs

RDAP serverregistrytextRequired
Which RDAP server to ask. A search runs against one server rather than across the internet, so this decides what it can find. The five regional internet registries are listed first and are the ones that answer entity searches; every domain registry IANA knows about follows, labelled with the top-level domains it serves.

Outputs

conformancelist
extensionslist
foundtrue/false
messagetext
noticeslist
query_urltext
servertext
server_errortext
server_hosttext
terms_of_service_urltext
Example output
{
  "conformance": [
    "rdap_level_0",
    "nro_rdap_profile_0",
    "cidr0",
    "rirSearch1",
    "reverse_search"
  ],
  "extensions": [
    "nro_rdap_profile_0",
    "cidr0",
    "rirSearch1",
    "reverse_search"
  ],
  "found": true,
  "message": "rdap.arin.net publishes 3 notices and 11 conformance identifiers",
  "notices": [
    {
      "description": [
        "By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use"
      ],
      "links": [
        {
          "href": "https://www.arin.net/resources/registry/whois/tou/",
          "rel": "terms-of-service",
          "type": "text/html"
        }
      ],
      "title": "Terms of Service"
    }
  ],
  "query_url": "https://rdap.arin.net/registry/help",
  "server": "https://rdap.arin.net/registry/",
  "server_error": null,
  "server_host": "rdap.arin.net",
  "terms_of_service_url": "https://www.arin.net/resources/registry/whois/tou/"
}

Search domains by name

Search one registry for domains whose name matches a pattern, with at most one '' in it: 'nic.fr' finds that exact domain, 'exam.fr' finds every .fr domain starting 'exam'. The registry is worked out from the pattern's top-level domain unless you choose one. Search is optional in RDAP and most registries do not offer it - ICANN does not permit public domain search at gTLD registries at all - so the step reports 'this registry does not offer that search' as a result rather than an error, and a workflow can carry on. No API key required.

Inputs

Domain name patternpatterntextRequired
The name to match, with at most one '*' standing for any trailing characters. Include the top-level domain and the registry is chosen for you.
RDAP serverregistrytext
Optional. Which RDAP server to ask. Leave it empty and the server is worked out from the top-level domain in the pattern, which is what you want whenever the pattern carries one.
Maximum resultslimitnumber
How many matches to return, from 1 to 200. Servers apply their own cap as well, and the smaller of the two wins; the result says when the server cut its answer short.From 1 to 200. Default: 25.

Outputs

countnumber
foundtrue/false
limitnumber
messagetext
noticeslist
parametertext
querytext
query_urltext
resultslist
servertext
server_hosttext
supportedtrue/false
total_returnednumber
truncatedtrue/false
Example output
{
  "count": 1,
  "found": true,
  "limit": 25,
  "message": "1 domain matching nic.fr at rdap.nic.fr",
  "notices": [],
  "parameter": "name",
  "query": "nic.fr",
  "query_url": "https://rdap.nic.fr/domains",
  "results": [
    {
      "abuse_email": "support@afnic.fr",
      "conformance": [
        "rdap_level_0",
        "icann_rdap_technical_implementation_guide_1",
        "icann_rdap_response_profile_1"
      ],
      "contacts": {
        "registrant": {
          "address": "7, avenue du 8 mai 1945, Guyancourt, 78280",
          "address_lines": [
            "7, avenue du 8 mai 1945",
            "Guyancourt",
            "78280"
          ],
          "country_code": "FR",
          "email": "juridique@afnic.fr",
          "emails": [
            "juridique@afnic.fr"
          ],
          "entities": [],
          "events": {},
          "fax": "+33.139308301",
          "handle": "NF100-FRNIC",
          "iana_registrar_id": null,
          "kind": null,
          "name": "AFNIC",
          "organization": null,
          "phone": "+33.139308300",
          "phones": [
            "+33.139308300"
          ],
          "public_ids": [],
          "role_descriptions": [
            "The holder of the registration"
          ],
          "roles": [
            "registrant"
          ],
          "status": [],
          "title": null,
          "url": null,
          "vcard": null
        }
      },
      "days_until_expiry": 1222,
      "dnssec": {
        "ds_records": [
          {
            "algorithm": 13,
            "algorithm_name": "ECDSA Curve P-256 with SHA-256",
            "digest": "10029d7a06eb202c21618090866a1e5b3f5ec65b11451671516a934e50873915",
            "digest_type": 2,
            "key_tag": 30098
          }
        ],
        "key_records": [],
        "signed": true,
        "zone_signed": false
      },
      "domain": "nic.fr",
      "entities": [],
      "events": {
        "expiration": "2029-12-31T23:00:00Z",
        "last changed": "2026-06-05T07:20:46.286415Z",
        "registration": "1995-01-01T00:00:00Z"
      },
      "expiration_date": "2029-12-31T23:00:00Z",
      "expired": false,
      "handle": "DOM000000000001-FRNIC",
      "in_redemption_period": false,
      "is_active": false,
      "is_locked": true,
      "is_on_hold": false,
      "is_pending_delete": false,
      "last_changed_date": "2026-06-05T07:20:46.286415Z",
      "last_database_update": "2026-08-27T20:24:47Z",
      "may_become_available": false,
      "nameserver_names": [
        "ns1.ext.nic.fr",
        "ns4.nic.fr",
        "ns6.ext.nic.fr",
        "ns7.ext.nic.fr"
      ],
      "nameservers": [],
      "notices": [],
      "port43": null,
      "redacted": [],
      "registrant": "AFNIC",
      "registrant_country": "FR",
      "registrar": "Registry Operations",
      "registrar_id": null,
      "registrar_url": "https://www.afnic.fr",
      "registration_date": "1995-01-01T00:00:00Z",
      "status": [
        "server transfer prohibited",
        "server delete prohibited"
      ],
      "status_descriptions": [
        "The registry has locked the domain against transfer",
        "The registry has locked the domain against deletion"
      ],
      "summary": "nic.fr - registered through Registry Operations - expires in 1222 days",
      "unicode_name": null,
      "url": "https://rdap.nic.fr/domain/nic.fr"
    }
  ],
  "server": "https://rdap.nic.fr/",
  "server_host": "rdap.nic.fr",
  "supported": true,
  "total_returned": 1,
  "truncated": false
}

Search domains by nameserver

Search one registry for the domains it has delegated to a nameserver. Use it to see what a hosting provider's nameserver is serving inside a registry, or to find what else moves if a nameserver changes. Very few registries implement this search, so the step reports 'this registry does not offer that search' as a result rather than an error. No API key required.

Inputs

NameservernameservertextRequired
The nameserver's host name, with at most one '*' standing for any trailing characters.
RDAP serverregistrytextRequired
Which RDAP server to ask. A search runs against one server rather than across the internet, so this decides what it can find. The five regional internet registries are listed first and are the ones that answer entity searches; every domain registry IANA knows about follows, labelled with the top-level domains it serves.
Maximum resultslimitnumber
How many matches to return, from 1 to 200. Servers apply their own cap as well, and the smaller of the two wins; the result says when the server cut its answer short.From 1 to 200. Default: 25.

Outputs

countnumber
foundtrue/false
limitnumber
messagetext
noticeslist
parametertext
querytext
query_urltext
resultslist
servertext
server_hosttext
supportedtrue/false
total_returnednumber
truncatedtrue/false
Example output
{
  "count": 0,
  "found": false,
  "limit": 0,
  "message": "rdap.nic.fr does not offer a domain search by nsLdhName. That is not a failure: RDAP requires only lookups, and search is optional.",
  "notices": [],
  "parameter": "nsLdhName",
  "query": "ns1.nic.fr",
  "query_url": "https://rdap.nic.fr/domains",
  "results": [],
  "server": "https://rdap.nic.fr/",
  "server_host": "rdap.nic.fr",
  "supported": false,
  "total_returned": 0,
  "truncated": false
}

Search domains by nameserver IP address

Search one registry for the domains it has delegated to any nameserver answering at an IP address. Use it to find everything pointed at one server when that server is being retired or has been compromised. Very few registries implement this search, so the step reports 'this registry does not offer that search' as a result rather than an error. No API key required.

Inputs

IP addressip_addresstextRequired
A single IPv4 or IPv6 address. This search matches an address a nameserver actually answers on, so a network in CIDR notation is not accepted here.
RDAP serverregistrytextRequired
Which RDAP server to ask. A search runs against one server rather than across the internet, so this decides what it can find. The five regional internet registries are listed first and are the ones that answer entity searches; every domain registry IANA knows about follows, labelled with the top-level domains it serves.
Maximum resultslimitnumber
How many matches to return, from 1 to 200. Servers apply their own cap as well, and the smaller of the two wins; the result says when the server cut its answer short.From 1 to 200. Default: 25.

Outputs

countnumber
foundtrue/false
limitnumber
messagetext
noticeslist
parametertext
querytext
query_urltext
resultslist
servertext
server_hosttext
supportedtrue/false
total_returnednumber
truncatedtrue/false
Example output
{
  "count": 0,
  "found": false,
  "limit": 0,
  "message": "rdap.nic.fr does not offer a domain search by nsIp. That is not a failure: RDAP requires only lookups, and search is optional.",
  "notices": [],
  "parameter": "nsIp",
  "query": "192.134.4.1",
  "query_url": "https://rdap.nic.fr/domains",
  "results": [],
  "server": "https://rdap.nic.fr/",
  "server_host": "rdap.nic.fr",
  "supported": false,
  "total_returned": 0,
  "truncated": false
}

Search entities by handle

Search one registry for contacts and organisations whose handle matches a pattern, with at most one '*' standing for any trailing characters. Use it when you have part of a handle rather than all of it, or to list every handle a registry issued under a prefix. A tagged handle names its own registry, so the server field can be left empty for one of those. All five regional internet registries answer this search. No API key required.

Inputs

Handle patternhandletextRequired
The handle to match, with at most one '*' standing for any trailing characters. A tagged handle such as 'ORG-RIEN1-RIPE' picks its own registry.
RDAP serverregistrytext
Optional. Which RDAP server to ask. Leave it empty and the server is worked out from the top-level domain in the pattern, which is what you want whenever the pattern carries one.
Maximum resultslimitnumber
How many matches to return, from 1 to 200. Servers apply their own cap as well, and the smaller of the two wins; the result says when the server cut its answer short.From 1 to 200. Default: 25.

Outputs

countnumber
foundtrue/false
limitnumber
messagetext
noticeslist
parametertext
querytext
query_urltext
resultslist
servertext
server_hosttext
supportedtrue/false
total_returnednumber
truncatedtrue/false
Example output
{
  "count": 1,
  "found": true,
  "limit": 25,
  "message": "1 entity matching ORG-RIEN1-RIPE at rdap.db.ripe.net",
  "notices": [],
  "parameter": "handle",
  "query": "ORG-RIEN1-RIPE",
  "query_url": "https://rdap.db.ripe.net/entities",
  "results": [
    {
      "address": "P.O. Box 10096, 1001 EB, Amsterdam, NETHERLANDS",
      "address_lines": [
        "P.O. Box 10096",
        "1001 EB",
        "Amsterdam",
        "NETHERLANDS"
      ],
      "conformance": [
        "cidr0",
        "rdap_level_0",
        "nro_rdap_profile_0",
        "redacted"
      ],
      "country_code": null,
      "email": "ncc@ripe.net",
      "emails": [
        "ncc@ripe.net"
      ],
      "entities": [],
      "events": {},
      "fax": null,
      "handle": "ORG-RIEN1-RIPE",
      "iana_registrar_id": null,
      "kind": "org",
      "name": "Reseaux IP Europeens Network Coordination Centre (RIPE NCC)",
      "notices": [],
      "organization": null,
      "phone": "+31205354444",
      "phones": [
        "+31205354444"
      ],
      "public_ids": [],
      "redacted": [],
      "role_descriptions": [],
      "roles": [],
      "status": [],
      "title": null,
      "url": "https://rdap.db.ripe.net/entity/ORG-RIEN1-RIPE",
      "vcard": null
    }
  ],
  "server": "https://rdap.db.ripe.net/",
  "server_host": "rdap.db.ripe.net",
  "supported": true,
  "total_returned": 1,
  "truncated": false
}

Search entities by name

Search one registry for contacts and organisations by name, with at most one '*' standing for any trailing characters. This is the search that actually works across the internet: all five regional internet registries answer it, so searching ARIN for a company name returns every contact record it holds for them, each with an email address and a handle you can follow. Use it to find an organisation's network contacts without knowing a single one of its addresses. No API key required.

Inputs

NamenametextRequired
The name to match, which may contain spaces and at most one '*' standing for any trailing characters.
RDAP serverregistrytextRequired
Which RDAP server to ask. A search runs against one server rather than across the internet, so this decides what it can find. The five regional internet registries are listed first and are the ones that answer entity searches; every domain registry IANA knows about follows, labelled with the top-level domains it serves.
Maximum resultslimitnumber
How many matches to return, from 1 to 200. Servers apply their own cap as well, and the smaller of the two wins; the result says when the server cut its answer short.From 1 to 200. Default: 25.

Outputs

countnumber
foundtrue/false
limitnumber
messagetext
noticeslist
parametertext
querytext
query_urltext
resultslist
servertext
server_hosttext
supportedtrue/false
total_returnednumber
truncatedtrue/false
Example output
{
  "count": 1,
  "found": true,
  "limit": 25,
  "message": "1 entity matching Google LLC at rdap.arin.net",
  "notices": [],
  "parameter": "fn",
  "query": "Google LLC",
  "query_url": "https://rdap.arin.net/registry/entities",
  "results": [
    {
      "address": "P.O. Box 10096, 1001 EB, Amsterdam, NETHERLANDS",
      "address_lines": [
        "P.O. Box 10096",
        "1001 EB",
        "Amsterdam",
        "NETHERLANDS"
      ],
      "conformance": [
        "cidr0",
        "rdap_level_0",
        "nro_rdap_profile_0",
        "redacted"
      ],
      "country_code": null,
      "email": "ncc@ripe.net",
      "emails": [
        "ncc@ripe.net"
      ],
      "entities": [],
      "events": {},
      "fax": null,
      "handle": "ORG-RIEN1-RIPE",
      "iana_registrar_id": null,
      "kind": "org",
      "name": "Reseaux IP Europeens Network Coordination Centre (RIPE NCC)",
      "notices": [],
      "organization": null,
      "phone": "+31205354444",
      "phones": [
        "+31205354444"
      ],
      "public_ids": [],
      "redacted": [],
      "role_descriptions": [],
      "roles": [],
      "status": [],
      "title": null,
      "url": "https://rdap.db.ripe.net/entity/ORG-RIEN1-RIPE",
      "vcard": null
    }
  ],
  "server": "https://rdap.arin.net/registry/",
  "server_host": "rdap.arin.net",
  "supported": true,
  "total_returned": 1,
  "truncated": true
}

Search nameservers by IP address

Search one registry for the nameservers registered at an IP address. This is the reverse of a nameserver lookup: it turns a server's address into the host names the registry knows are answering on it, which is how to find every name a machine is serving under before decommissioning it. AFNIC's .fr registry answers this one; most others do not, and the step reports that as a result rather than an error. No API key required.

Inputs

IP addressip_addresstextRequired
A single IPv4 or IPv6 address. This search matches an address a nameserver actually answers on, so a network in CIDR notation is not accepted here.
RDAP serverregistrytextRequired
Which RDAP server to ask. A search runs against one server rather than across the internet, so this decides what it can find. The five regional internet registries are listed first and are the ones that answer entity searches; every domain registry IANA knows about follows, labelled with the top-level domains it serves.
Maximum resultslimitnumber
How many matches to return, from 1 to 200. Servers apply their own cap as well, and the smaller of the two wins; the result says when the server cut its answer short.From 1 to 200. Default: 25.

Outputs

countnumber
foundtrue/false
limitnumber
messagetext
noticeslist
parametertext
querytext
query_urltext
resultslist
servertext
server_hosttext
supportedtrue/false
total_returnednumber
truncatedtrue/false
Example output
{
  "count": 1,
  "found": true,
  "limit": 25,
  "message": "1 nameserver matching 192.134.4.1 at rdap.nic.fr",
  "notices": [],
  "parameter": "ip",
  "query": "192.134.4.1",
  "query_url": "https://rdap.nic.fr/nameservers",
  "results": [
    {
      "conformance": [
        "rdap_level_0"
      ],
      "entities": [],
      "events": {
        "last update of rdap database": "2026-08-27T20:24:31Z"
      },
      "handle": null,
      "has_glue": true,
      "hostname": "a.iana-servers.net",
      "in_redemption_period": false,
      "ip_addresses": [
        "199.43.135.53",
        "2001:500:8F:0:0:0:0:53"
      ],
      "ipv4": [
        "199.43.135.53"
      ],
      "ipv6": [
        "2001:500:8F:0:0:0:0:53"
      ],
      "is_active": true,
      "is_locked": false,
      "is_on_hold": false,
      "is_pending_delete": false,
      "may_become_available": false,
      "notices": [],
      "redacted": [],
      "status": [],
      "status_descriptions": [],
      "summary": "a.iana-servers.net (199.43.135.53, 2001:500:8F:0:0:0:0:53)",
      "unicode_name": null,
      "url": "https://rdap.verisign.com/net/v1/nameserver/a.iana-servers.net"
    }
  ],
  "server": "https://rdap.nic.fr/",
  "server_host": "rdap.nic.fr",
  "supported": true,
  "total_returned": 1,
  "truncated": false
}

Search nameservers by name

Search one registry for nameserver records whose host name matches a pattern, with at most one '*' in it. The registry is worked out from the pattern's top-level domain unless you choose one. Very few registries implement this search; to read one nameserver you already know the name of, use Look up a nameserver instead, which every registry answers. The step reports an unsupported search as a result rather than an error. No API key required.

Inputs

Nameserver patternpatterntextRequired
The host name to match, with at most one '*' standing for any trailing characters. Include the top-level domain and the registry is chosen for you.
RDAP serverregistrytext
Optional. Which RDAP server to ask. Leave it empty and the server is worked out from the top-level domain in the pattern, which is what you want whenever the pattern carries one.
Maximum resultslimitnumber
How many matches to return, from 1 to 200. Servers apply their own cap as well, and the smaller of the two wins; the result says when the server cut its answer short.From 1 to 200. Default: 25.

Outputs

countnumber
foundtrue/false
limitnumber
messagetext
noticeslist
parametertext
querytext
query_urltext
resultslist
servertext
server_hosttext
supportedtrue/false
total_returnednumber
truncatedtrue/false
Example output
{
  "count": 0,
  "found": false,
  "limit": 0,
  "message": "rdap.nic.fr does not offer a nameserver search by name. That is not a failure: RDAP requires only lookups, and search is optional.",
  "notices": [],
  "parameter": "name",
  "query": "ns1.nic.fr",
  "query_url": "https://rdap.nic.fr/nameservers",
  "results": [],
  "server": "https://rdap.nic.fr/",
  "server_host": "rdap.nic.fr",
  "supported": false,
  "total_returned": 0,
  "truncated": false
}

On this page