RDAP and WHOIS data source
The registry service these registration figures were read from — RDAP where the registry runs one, WHOIS where it does not.
The service the registration figures above were read from. The row label says which protocol it was, "RDAP source" or "WHOIS source", and the value names the server that answered.
RDAP and WHOIS. RDAP (Registration Data Access Protocol) is the structured JSON successor to WHOIS. ICANN made it the official source for generic domains such as .com, .org and .net, and most country registries offer it too. SiteScan finds the right RDAP server through the public bootstrap at rdap.org, or asks the registry directly where it is missing from the bootstrap (DENIC for .de, EURid for .eu). WHOIS is the older plain-text protocol. The registries of .ru, .рф, .su and .by publish only on WHOIS, and a .eu whose RDAP server does not answer falls back to whois.eu.
Why a field may be missing
Registries decide what they publish. Since the GDPR, many hide owner data; DENIC shows neither the registrar nor any dates, and EURid's WHOIS has no dates. A missing row means the source did not publish it, not that something is wrong with your domain. When the expiry could not be read, a "Reason" row explains why, for example the error RDAP returned.
What to do
Nothing, as a rule: the row tells you where the figures come from and how far to trust them. For anything missing, your registrar account has the authoritative dates, including the registration expiry.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Domain registration”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data