RDAP lookup for domain expiration

rdap lookup domain expiration pulls registrar lifecycle events from structured JSON—when the registry publishes them—so you can track domain renewal separately from TLS certificate notAfter.

WHOIS text scraping was always fragile. RDAP (Registration Data Access Protocol) returns machine-readable records over HTTPS, aligned with registry policies and rate limits. SSL monitoring tools focus on handshakes; RDAP answers whether the name itself can still be delegated next month.

This guide helps operators, procurement, and SREs pair domain registration expiry with certificate expiry. Both clocks affect uptime: a valid cert on a lapsed domain eventually fails validation or disappears from DNS.

You need curl and jq (or any JSON parser). Respect registry terms; bulk harvesting belongs in sanctioned monitoring products, not aggressive crawling.

Procurement teams care about RDAP when SSL dashboards look green but registration invoices were missed. Pair lookups during annual vendor reviews, not only during sev-1 calls.

What to check

RDAP domain objects may include an events array with eventAction values such as registration, last changed, expiration, and sometimes registrar expiration. For rdap lookup domain expiration, prefer expiration when present, but read registry notes when dates are absent.

Distinguish registrable domain (example.com) from hostnames (www.example.com). TLS certs attach to hostnames; RDAP domain queries use the apex unless a registry exposes host objects separately.

TLS notAfter never substitutes for RDAP expiration: a renewed cert cannot fix a domain in redemption, and a paid domain does not auto-renew HTTPS.

rdap lookup domain expiration should hit the authoritative server when you automate. Redirectors are fine for manuals, but production jobs should cache IANA bootstrap JSON and honor registry rate limits with backoff.

Step-by-step

Discover the RDAP server (bootstrap)

ICANN’s bootstrap file maps TLDs to authoritative RDAP base URLs:

curl -s https://data.iana.org/rdap/dns.json | jq '.services[] | select(.[0][] | contains(".com"))'

For quick tests, many operators use a redirector:

DOM=example.com
curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/${DOM}" | jq .

rdap.org forwards to the correct registry; for production automation, call the authoritative server once you know the TLD routing.

Read expiration events

curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/${DOM}" \
  | jq '.events[] | select(.eventAction|test("expir")) | {action: .eventAction, date: .eventDate}'

Normalize eventDate to UTC in your scripts. Some registries emit registrar expiration separately from registry expiration.

Check status flags

curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/${DOM}" \
  | jq '{status: .status, events: [.events[]? | {action: .eventAction, date: .eventDate}]}'

Statuses like client hold or pending delete signal trouble before the expiration timestamp.

PowerShell variant

$dom = "example.com"
$resp = Invoke-RestMethod -Uri "https://rdap.org/domain/$dom" -Headers @{ Accept = "application/rdap+json" }
$resp.events | Where-Object { $_.eventAction -match 'expir' } | Format-Table eventAction, eventDate

Tie to TLS on the same portfolio row

echo | openssl s_client -connect "www.${DOM}:443" -servername "www.${DOM}" 2>/dev/null \
  | openssl x509 -noout -enddate

Store registrar expiration and TLS notAfter in one dashboard row per brand domain.

When scripting, persist full JSON responses for a quarter. Registries occasionally correct published dates; historical artifacts help finance reconcile auto-renew charges.

How to read the output

eventAction: expiration with a future eventDate means the registry recorded a domain-valid-until instant—still confirm auto-renew billing with your registrar portal.

Missing expiration event: Common on some ccTLDs or redacted RDAP policies. Document “not published” rather than inferring from WHOIS scraping. Supplement with registrar API exports.

last changed recently with distant expiration: May reflect contact updates, not renewal—do not treat as cert-style rollover.

TLS notAfter much sooner than RDAP expiration: Normal with 90-day public CAs. Alert on each independently.

Redemption / pending delete statuses: Act on registrar workflow immediately; TLS renewal alone will not restore public DNS.

Common mistakes

Assuming one RDAP field maps cleanly across every TLD. Event names and visibility vary; parse defensively and handle nulls.

Querying www.example.com in the domain endpoint when the registry expects example.com.

Using RDAP as a certificate check. No notAfter for HTTPS appears in domain objects.

Hitting registries too aggressively from CI without backoff—blocked IPs stall automation.

Ignoring privacy/redaction: expiration may be absent while contacts are hidden—track renewal in billing systems anyway.

Confusing reseller-specific expiration with registry expiration when both appear. Your runbook should document which date triggers DNS removal for your TLD contracts.

When to use automation

RDAP belongs in scheduled jobs alongside live TLS monitoring. Alert at 30, 14, 7, and 1 day before registrar expiration where dates exist, and maintain a manual calendar where they do not.

Pair RDAP with certificate checks so OV revalidation and customer trust are not surprised by a domain in hold. ssldays monitors TLS notAfter from the outside; registrar dates should fill the adjacent column in your inventory, not be an afterthought when ACME suddenly cannot validate.

Scenario walkthrough

A startup relied on automatic domain renewal at the registrar while engineers monitored only TLS. The credit card expired quietly. RDAP expiration still showed a future date until the grace period ended, then statuses flipped to redemption while HTTPS briefly looked healthy on cached DNS. rdap lookup domain expiration in weekly automation would have surfaced the billing failure before redemption fees.

Global brands juggle ccTLDs with uneven RDAP coverage. A German subsidiary’s domain omitted expiration in JSON while the corporate .com published it. Legal owned renewal for the ccTLD; platform owned certs. The matrix lived in a spreadsheet until RDAP gaps were labeled explicitly, preventing engineers from assuming null meant unlimited.

An MSP scripted RDAP for three hundred client apex domains. Rate limits forced exponential backoff per registry. They staggered jobs by TLD and cached bootstrap files, turning a naive loop into sustainable monitoring. Clients received combined PDFs with RDAP dates and live TLS notAfter columns.

During M&A diligence, security analysts batch RDAP lookups on acquired domains and compare against certificate transparency names. Domains nearing registrar expiry but not present in TLS monitors become integration tasks, not surprises after closing.

Incident retrospectives for “ACME HTTP-01 failed mysteriously” sometimes end at registrar holds visible only in RDAP status arrays, not in expiration fields. Teaching responders to read status and events together shortens mean time to innocence for application teams.

Registrar and TLS alignment checklist

Before closing a renewal quarter, walk each production brand through the same questions. Does RDAP or the registrar portal show paid-through dates beyond the next planning cycle? Do live TLS checks on customer hostnames show notAfter beyond the same horizon? Does DNS delegation still point at the infrastructure you operate, not at a former agency? Are auto-renew billing instruments current? Affirmative answers on only one column mean work remains.

For portfolios with transferred domains, confirm the RDAP registrar object matches your authorized reseller. Stale registrar metadata misroutes billing reminders even when certificates look healthy. Capture registrar names from RDAP in your CMDB next to TLS issuer fields so reviews compare apples to apples.

When rdap lookup domain expiration returns null, create an explicit follow-up task in your ticketing system rather than silent optimism. Note the TLD, the last human confirmation date, and who owns the registrar login. Absence of machine-readable expiry is itself a risk category worth quarterly human review.

Train support desks to collect the apex domain early in SSL calls. A single RDAP pull during the call prevents escalation when the real issue is redemption hold, not cipher suites. Scripts can live in a guarded internal wiki with copy buttons for curl and PowerShell examples from this guide.

Finally, archive RDAP JSON alongside ACME renewal logs for the same change. Years later, forensic accountants and security auditors reconstruct intent faster when machine artifacts align across domain and certificate workflows.

International transfers introduce lag between RDAP registrar objects and billing reality. Schedule human confirmation after transfers even when JSON looks updated; escrow periods confuse automation.

For brands using privacy services, pair RDAP with registrar API tokens that expose billing contacts. Privacy is not an excuse to skip renewal accountability—it shifts responsibility to internal relationship owners.

rdap lookup domain expiration complements, never replaces, TLS monitoring in RFP responses. Enterprise buyers ask about both clocks; proposals should mention RDAP explicitly where registry data is reliable and note TLD-specific gaps honestly.

Build playbooks for common registrar statuses: clientTransferProhibited, pendingDelete, and redemption each map to different procurement actions. Support macros that paste RDAP status snippets into tickets save minutes per call at scale.

Seasonal marketing domains (superbowl.example) should appear on combined dashboards weeks before campaigns, not only on certificate trackers. RDAP pulls during creative reviews catch forgotten microsites.

When legal demands domain shutdown, RDAP confirms public registration state before you declare victory. TLS may already be down while registration continues accruing fees or attracting typosquat watch alerts.

Educate finance that SSL line items and domain line items differ on invoices. Combined monitoring prevents paying for certificates while the domain underlying validation quietly lapses.

Building durable automation

Store IANA bootstrap JSON in your artifact repository with version tags. RDAP routing changes are infrequent but break naive hardcoded URLs overnight.

Wrap lookups in circuit breakers when registries publish maintenance windows. Retries should jitter to avoid synchronized thundering herds from thousands of tenants.

Normalize eventDate to ISO-8601 UTC in your database. Mixed string formats ruin sorted reports near year boundaries.

Attach TLD policy notes in your internal wiki: which registries redact, which delay transfers, which publish multiple expiration-like events.

For agencies, segregate client RDAP tokens and results per tenant. Cross-client leakage in dashboards is both a privacy incident and a contract breach.

Run shadow comparisons between legacy WHOIS scrapers and RDAP quarterly until WHOIS is retired. Disagreements highlight parser bugs before automation fully cuts over.

During domain audits, sample ten percent of portfolio for manual registrar login confirmation. Machine nulls plus human verification beat blind trust.

rdap lookup domain expiration should feed the same alerting router as TLS when both thresholds breach for one brand. Unified paging reduces duplicate wake-ups for related root causes.

Publish internal runbooks for redemption timers per registrar. Engineers act faster when grace-period lengths are documented beside RDAP status definitions.

Include RDAP training in onboarding for anyone who can repoint DNS. Delegation changes without registrar awareness cause more outages than cipher misunderstandings.

Plain-language summary

Domains and certificates renew on different calendars with different vendors. RDAP helps teams see registrar timing in machine-readable form when registries cooperate.

Finance and engineering should review domain lists together quarterly. RDAP pulls seed those conversations with dates instead of spreadsheets maintained by heroic individuals.

Null expiration fields are data, not errors. Track them explicitly so automation does not hallucinate comfort.

Transfer seasons create human process load. RDAP statuses like pending transfer explain odd TLS behavior that certificate monitors cannot decode.

Privacy regulations changed WHOIS habits; RDAP continues that trajectory. Adjust expectations about visible contacts and teach teams where billing truth lives now.

Customer-facing status pages rarely mention registrar expiry; internal runbooks should, especially for brands relying on domain-validated certificates.

RDAP complements certificate transparency. CT shows certs issued; RDAP shows whether the name remains registered to continue issuance next cycle.

International subsidiaries may require local language registrar portals even when RDAP is thin. Document human fallback paths respectfully and keep them in runbooks.

Teaching support to read RDAP JSON is optional; teaching them to request apex domain from callers is mandatory.

Long-term platform strategy merges RDAP and TLS signals in one ownership model. Siloed domain and certificate teams duplicate incidents unnecessarily.

Procurement should require registrar portals that expose API or RDAP-friendly data before multi-year contracts. Buying blind guarantees spreadsheet archaeology later.

Run RDAP education sessions for legal teams who sign domain sales agreements. They spot redemption risk language faster when JSON examples feel familiar.

Celebration emails when both RDAP and TLS checks pass after tough renewals reinforce cross-functional wins more than silent ticket closures.

Volunteer a rotating domain steward each quarter who sanity-checks null RDAP fields across the portfolio. Stewardship beats heroics.

Partner with finance to reconcile RDAP dates against invoices; mismatches often reveal unused domains burning budget annually.

During divestitures, RDAP timelines govern how quickly TLS names must migrate. Early legal clarity prevents midnight certificate scrambles.

Archive one anonymized RDAP JSON sample in your knowledge base so new engineers recognize normal shapes before on-call shifts.