How to look up a domain: RDAP, DNS and certificate transparency
Three public sources describe almost any domain: RDAP (the successor to WHOIS) gives the registrar, registration and expiry dates and status; DNS shows where the domain and its mail are hosted; certificate transparency logs list the hostnames that received TLS certificates, which often reveals subdomains.
RDAP: registration data
RDAP returns structured registration data from the registry and registrar: creation, update and expiry dates, the registrar, name servers and status codes such as clientTransferProhibited. Since January 2025 RDAP is the definitive source for generic top-level domains; WHOIS is being retired.
Personal registrant details are usually redacted for privacy (GDPR). A very recent creation date is a common sign of a phishing domain.
DNS: where it points
- A and AAAA records: the IP addresses that serve the website.
- MX records: which provider receives the domain's email.
- TXT records: SPF, DMARC and site-verification entries, which reveal the services a domain uses.
- NS records: who hosts the DNS zone.
Certificate transparency: subdomains
Every publicly trusted TLS certificate is logged in public certificate-transparency logs. Searching them for a domain lists hostnames such as mail., vpn. or staging. that the owner requested certificates for.
Doing it in one search
- Type the domain (for example example.com) into DuckINT.
- Read the registration panel (RDAP), the DNS records from two independent resolvers, and the certificate hostnames.
- For a single record type, search for example MX example.com.
Questions
- Why is the owner's name hidden?
- Most registrars redact personal registrant data under privacy law. Legitimate requests for it go through the registrar's disclosure process.
- Is a new domain always malicious?
- No, but phishing domains are typically days or weeks old. Combine the creation date with the content and the links that led you there.