SIDN’s RDAP service upgraded to the latest specification

Successor to Whois

RDAP, short for the Registration Data Access Protocol, provides a standardised mechanism for the online retrieval of registration data. It features a web service based on a RESTful interface. It’s therefore a modern successor to the traditional Whois protocol.

Besides using a different access method, the main difference between RDAP and Whois is that all the exchanged data is contained in clearly defined fields within a JSON data structure. With Whois, the data is in the form of unstructured text, and the individual data items within the text can be processed automatically only by means of scraping (on the basis of informal conventions that have developed over time). RDAP also supports access control, enabling different types of information to be made available to different users.

100 per cent compliant

On 7 August, our new RDAP implementation was enabled for the .politie, .amsterdam and .aw domains, all of which we administer. We’ll roll out the new implementation to the .nl domain in the first week of September 2025. ICANN made profile 2024 mandatory for its registries/registrars from 21 August 2025. For the last year, we’ve been in a transitional period, during which profile 2024 was permitted but not yet mandatory.

“Upgrading our software from profile 2019 to profile 2024 involved making numerous modifications to the code,” explains Product Owner Martijn Sanders. “A total of 30 changes were needed to meet all the requirements.”

“Thanks to those changes, our service is one of the first to pass all the RDAP implementation compliance tests supported by ICANN’s tools. We’ve also evaluated numerous other RDAP implementations, and discovered that most don’t pass all elements of the extended tests. That’s due to minor inconsistences in the RFCs, such as the use of capitals for the labels, which come to light when you send more complex queries. We therefore aligned our software with the compliance tools, which are much stricter than the RFCs where details of that kind are concerned.”

Following the upgrade, the main difference that RDAP service users will notice is that the new version sends much bigger responses. All the fields configured as “redacted” are included at the end of the response, so that it’s clear what information has been withheld.

Generic top-level domains

It’s worth noting that ICANN’s requirements apply only to generic top-level domains (gTLDs). Registries for country-code domains (ccTLDs) are free to define their own policies. In practice, ccTLD registries are normally guided by published RFCs, although they often follow ICANN policies as well (albeit at their own pace).

“The .politie and .amsterdam domains come under the ICANN regime,” Sanders points out. “But, where the .nl and .aw domains are concerned, we are in principle free to run whatever we like.”

Clear point of access

Although ICANN’s requirements don’t apply to the large .nl domain, the new version of the RDAP service will be enabled for .nl in the first week of September. “We want .nl to meet the latest technical standards as well,” says Sanders. “That has the added advantage that there’s a clear point of access for people in other countries.”

“For the .nl domain, we just had to make a handful of special exceptions in order to comply with the privacy rules and to fulfil our contractual obligations to certain of our partners. A further consideration is that, with us, not everything works the same as with ICANN-regulated domains. For example, our registration and quarantine periods don’t have end dates, meaning that our RDAP responses are a little different.”

Hello Registry

Our current profile 2024 implementation is still part of our existing DRS. Next year, however, we’ll be migrating to the Hello Registry software that we’re developing in partnership the Canadian registry CIRA. The new platform has its own RDAP implementation, which will of course be aligned with the latest protocols. An important additional feature is the access control, which enables users to be granted role-based access to data that isn’t visible to unauthorised visitors. For example, government agencies can be given access to registrant name and address data, and registrars will be able to view full details of their own registrations while logged on, but not information about other registrations.

At the moment, our RDAP and Whois services still control access to extra data by means of IP address whitelists. “Although we’ve developed various tools for whitelist management, maintaining them is quite labour-intensive,” says Sanders. “So switching to account-based access control is an attractive option for us.”

“However, we didn’t want to enable the functionality on the existing DRS platform, because that would have meant migrating all the accounts twice – first to the existing platform and then to Hello Registry next year. That felt like too much inconvenience for our users.”

Drop-catching

Another problem that the Hello Registry platform will soon resolve is undue system loading caused by drop-catching – a practice that involves continually checking whether a recently lapsed domain name has been released from quarantine. “Drop-catching was generating 100 to 150 million queries a day,” says Sanders. “That’s like a DDoS attack on the RDAP port, and it was impeding access for other service users several times a day.”

“Drop-catchers were finding ways around the limits in the SLA. So, in consultation with the Registrars’ Association Technical Committee, we introduced strict rate limiting. The arrangements have cut traffic by 90 per cent.”

“When Hello Registry comes in, it’ll feature a structural solution in the form of a dedicated environment, completely separate from SIDN’s normal infrastructure.”

Whois phase-out

Although our RDAP service is being expanded and is gaining popularity all the time, we’re not currently planning to phase out the classic Whois service. “It’s still very well used,” says Sanders. “More than 60 per cent of the traffic is still accounted for by Whois queries. However, people might be interested to know that the existing Whois service has been using RDAP in the background for a long time now. The Whois is simply a front end, which is connected to the RDAP infrastructure by means of middleware.”

Distinction should be made, however, between the Whois command-line tool and the domain name lookup function on the SIDN website. As Sanders points out, “At the moment, we still call the website tool a Whois, because the name is very familiar to people in the industry. In due course, we’ll probably change it to “domain name data lookup tool” or something.