After GDPR shutting down the whois protocol, how can i get information relative to the expiry date to any domain?

  • 1
    The WHOIS protocol isn't being "shut down". ICANN administrates reporting under the WHOIS protocol, and what's under consideration, and currently in the German courts, is how they should adhere to the GDPR in countries regulated by it. On May 25th 2018, they issued a Temporary Specification for gTLD Registration Data that details how registrars should report this data, which only pertains to contact information, not the expiration date and other required data for Registrars to be able to function.
    – dan
    Jun 3, 2018 at 6:50
  • The only mention of "expiration date" in that specification is in Appendix F, and states that registry operators must provide it.
    – dan
    Jun 3, 2018 at 6:55

2 Answers 2


What needs to change with WHOIS

At the moment the private details of registrants are included in the publicly accessible WHOIS data.

The argument for nobody having access is that people like their privacy, and do not like spam and unwanted phone calls. This is covered by the GDPR, as users have the right to object, which the ICO describes with regards to direct marketing like this:

Individuals have an absolute right to stop their data being used for direct marketing.


The argument for governments and copyright holders is that they want to be able to find out who runs sites that are illegal, and shut them down quickly.

Will this affect the accessability of expiry date information

At the moment, the full changes are not fully clear, but the main consideration is who, if anyone, should be able to have access to the personal details held in WHOIS.

The GDPR changes will, in a sense, shield every registrant from disclosure almost as fully as proxy registrations. Under the GDPR-compliance program currently being implemented by the Internet Corporation for Assigned Names and Numbers (ICANN), full information will be collected by the registrar when a domain name is sold. But the WHOIS database available to the public will show the registrant’s name only for organizations, not for natural persons. Instead of physical address, the public database will show only State or Province and Country. And instead of the registrant’s true email address, an anonymized email will be displayed to allow the registrant to be contacted.


Short of if WHOIS was scrapped entirely, which does not seem to be suggested at the moment, expiry data would still be publicly accessible, the changes would only affect the fields which are considered personal data.

  • 1
    "At the moment the private details of registrants are included in the publicly accessible WHOIS data." - FWIW, since GDPR "most" of my domains now suppress the "private details" from the public WHOIS records. Either because the Registry (eg. Nominet) now suppress this information or because the Registrar has implemented "privacy protection" (at no additional cost and opt-in by default). Namecheap don't appear to have done anything for existing domains, but have stated that all new registrations/renewals will get free privacy protection as default.
    – DocRoot
    Jun 4, 2018 at 11:23

GDPR is not shutting down the whois protocol, this is a far fetched idea. They will be changes to whois for sure, and this was long due. It may get replaced by RDAP.

The whois protocol does not define in any way the content received, nor its format. Per the protocol the server replies with a bunch of lines, that is all.

GDPR may have consequences on the content of the reply and/or who can access what, but technically the protocol could work as is. However RDAP is a far better alternative nowadays because it is built on HTTP and hence delivers immediately features about authentication and authorization which are sadly missing in whois (because these were not problems at the time the whois protocol was defined).

Also the expiration date is something you can today only get through whois (be it at registry whois or registrar one, in gTLDs that are thick registries) as a public. The registrars have privileged access to registries, typically using the EPP protocol and through it they can get access to expiration times, at least for the domains they sponsor and sometimes for others too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.