4

Looking at the DNS bootstrap for RDAP, it appears that the only supported TLDs are:

  • .com
  • .net
  • .ar
  • .cr
  • .cz
  • .br

As RDAP gives similar data to WHOIS, but in a structured form, and accessible in a secure way, why is it not more widely supported. The relevant RFC (7482), has been around since 2015, but it is still not widely supported.

Example Google RDAP

4

Because RDAP adoption started in fact with IP addresses registries (RIRs), where it is really used in production whereas the cases you cite are not all real production ones. See this recent presentation at a RIPE meeting about RDAP in RIRs (and also a little in domain name registries): https://ripe76.ripe.net/presentations/6-RIPE_76_RDAP.pdf and a related other presentation at https://pc.nanog.org/static/published/meetings/NANOG72/1601/20180220_Griswold_Death_To_Whois_v1.pdf that will show you that there is still work before having RDAP completely replacing whois, even in RIRs.

So, why it is like that for domain name registries?

For gTLDs, registries do either need to implement what ICANN says is mandatory to implement or, for any new "service" they have to ask permission from ICANN, following a specific process, the Registry Service Evaluation Process (RSEP).

ICANN never said anything mandatory for now in RDAP, and they have a specific page on RDAP: https://www.icann.org/rdap You will see there that there is a pilot program underway.

They also started to work on a "registries and registrars profile" but this never really went further than some initial design discussions.

And even if the core protocol is old there are still some issues to address and features needed, like proper authentication for tiered access, a problem ICANN never started to address while it is absolutely mandatory nowadays in a world with GDPR. For example, you can go at the IETF REGEXT working group and you will see many exchanges on RDAP and new internet-drafts that may become soon RFCs. It is in fact also in the agenda of their next face to face meeting in Montreal in mid-july.

As for ccTLDs, there are in no way constrainted by ICANN policies or rules, so they could freely implement RDAP if they so wish.

But still, why is there no adoption?

I think it is economical/business reasons, not technical ones.

There is a huge ecosystem around whois, which is currently abused in so many ways. However the registries by themselves, once they apply some basic rate limiting on their whois server, does not feel any of the problems, they all go to others, and the entities described in whois, specifically the individuals. So implementing RDAP, besides prototypes and being pioneers on the technical front has no real positive consequences today for registries, while they will incur at least development costs for it, and if they also decide to shutdown the whois access they will need to manage the evolution of the whole community currently circling aroung it. So a lot of work, both technical, in communication, etc.

I am sure registries will find a lot of people telling them not to touch anything around whois as they depend on it for service X or Y, and at the same time very few people pushing them to implement RDAP.

It is also true that RDAP being using a formatted structure makes it more easy to parse and reuse the data... which was the idea but which also can be seen as a problem when sponsors of data (registries, registrars) do not wish it to be reused. You then have the problem of licensing, and enforcing it (even if noone reads it you will see in all whois output some legal mumbo-jumbo that tells you what you can and can not do with this data... but whois was for human consumption where RDAP is clearly for machine consumption, so no ideas of contracts and law terms there)

But things may change now with GDPR, as this clearly mandates change in what is displayed in whois, and instead of messing with it even more, it makes sense now to switch to something more structured and with more features.

The situation there currently is not clear, and again ICANN instructions are more or less inexistent. But if you read the "Temporary Specification for gTLD Registration Data" that were drafted at the last minute because ICANN did not realize they would not be exempt from GDPR consequences right now, you will see a lot of references to RDAP.

Today (September 4th 2018) ICANN started a comment period at https://www.icann.org/public-comments/proposed-rdap-profile-2018-08-31-en for people to express themselves on the gTLD RDAP profile (https://www.icann.org/en/system/files/files/gtld-registration-data-temp-spec-17may18-en.pdf). This has obvious consequences for GDPR compliance, and we will see in November what comes out of it.

It is sad indeed that ccTLDs, especially European ones, did not already jumped to do it, but like I said above I fear it is sadly for economical reasons.

  • RDAP has been made mandatory by ICANN: icann.org/rdap "gTLD registries and registrars are required to implement an RDAP service by 26 August 2019." – Patrick Mevzek Jun 20 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.