The protocols behind a domain name

WHOIS is still the only answer available for many country-code TLDs, so it remains the fallback rather than a legacy curiosity. Its weakness is the format: there is no standard, so every registry's output has to be parsed against its own conventions, and a registry changing its wording can break a parser that read it correctly the day before. Since privacy rules tightened, most registrant contact fields are redacted, so a modern WHOIS answer tells you about the domain's status and dates far more reliably than about its owner. RDAP is its structured successor, and where a registry offers both, the RDAP answer is the one to trust.

RDAP answers the same questions as WHOIS and answers them in a format that does not have to be guessed at, which is why it is queried first wherever it exists. It is mandatory for generic TLDs and increasingly common among country-code registries, but adoption is not universal and some registries publish an RDAP endpoint whose data is thinner than their WHOIS. That is why a reliable lookup tries RDAP first and falls back to WHOIS rather than choosing one, which is exactly what our engine does on every check.

These are two different things that produce the same blank. A privacy service substitutes a proxy's details and forwards mail to the real owner, and is optional and usually paid for. Redaction is not optional: since GDPR, registrars serving registrants in scope withhold personal contact fields from public output by default, which is why a record shows a registrar and a set of dates but a generic or masked email. The consequence for anyone trying to reach an owner is that the contact form or forwarding address on the record is the route, not a name and a phone number. The consequence for anyone monitoring a domain is that the facts worth watching, the status codes, the dates and the nameservers, were never redacted and are still there.

You never speak EPP yourself, but you read its vocabulary constantly. Every status on a domain is an EPP status code, and their prefix tells you who set it: client codes come from your registrar and can be changed there, server codes come from the registry and cannot. That single distinction answers most of the "why can I not fix this" questions about a stuck domain.

Most registrars call this the EPP code, which is why people searching that phrase are usually after this rather than the protocol. It is a password, so treat it as one: it is worth having only for as long as the transfer takes, and a good registrar lets you regenerate it. Getting one is the second step, not the first, because a domain under a transfer prohibition will refuse the transfer whatever code you present, and a name registered or transferred in the last 60 days is locked by ICANN policy regardless of what either registrar wants. Once the code is accepted the losing registrar has five days to respond, and doing nothing lets the transfer through.

DNSSEC protects against forged answers, which ordinary DNS accepts without question. The cost is operational: the chain of trust runs from the registry through a record set at your registrar down into your zone, so changing DNS provider without updating that link produces total, immediate failure rather than a degraded service. Validating resolvers refuse a broken chain outright, which means the domain stops resolving for everyone using one.

TTL is the dial that decides how long a mistake lasts and how quickly a planned change takes effect. A long TTL is cheap and stable; a short one costs more lookups and lets you move fast. The practical rule is to lower the TTL on the records you are about to change a day ahead, make the change, then raise it again. Lowering it at the moment of the change does nothing, because the old, long value is already cached everywhere.

The registrant is the party with the claim on the name, which matters most at the two moments people get it wrong. Registering a domain through an agency or a developer who puts their own details in the registrant field means the agency holds the name, and recovering it later is a negotiation rather than an account change. And the registrant contact email is the address ICANN verification, transfer confirmations and expiry notices go to, so a registrant address nobody reads is how a domain is lost quietly. Changing registrant details is a material change at most registrars and can impose a transfer lock of its own.

The registrar is the party with the most direct effect on your domain's day-to-day life: it sets the client status codes, decides the restore fee after an expiry, and chooses whether an expiring name goes to its own auction or is allowed to drop. Two registrars selling the same TLD can therefore treat an expired name very differently, which is why an expiry timeline is only ever approximately predictable.

The registry decides the lifecycle: how long grace lasts, whether there is a redemption period at all, how long a name sits in pending delete, and when in the day deletions happen. This is why timelines differ so much between extensions, and why a rule you learned from .com does not carry across to a country-code TLD. Registry-set server status codes are also the ones your registrar cannot lift for you.

The distinction is not cosmetic, because it decides whose rules apply. Generic TLDs run under ICANN contracts, which is why their lifecycles match: the same grace period, the same redemption window, the same pending delete. Country-code registries set their own policy, so a ccTLD can skip redemption entirely, release names on a schedule of its own, or restrict who may register at all by requiring a local presence. A second-level suffix such as co.uk behaves as the registrable suffix even though it is not the last label, which is why tools that split a name on the final dot get it wrong.

ICANN's rules are the reason the generic TLD lifecycle looks the same across .com, .org and .net, and the reason registrars must verify your contact details and offer a redemption window. Its authority is narrower than people assume: country-code registries set their own policy, which is why a ccTLD can release a name weeks earlier than any generic TLD would.