How domain availability checking actually works — and why checkers lie

You typed a name into a domain search box. It came back green. You felt the small lift of relief that every founder knows, and you started telling people the name.

Then you went to buy it and it was gone, or it cost $12,000, or the registrar said "unavailable" while the lookup tool still insisted it was free.

The green dot was not exactly lying. It was answering a different question from the one you asked, and almost no checker tells you which question it answered.

There is no single place to ask

Start with the fact that explains everything else: there is no single public source that can promise a domain will make it through checkout.

The final registration decision happens through EPP, the protocol registrars use to talk to registries. Public tools can inspect registration records, but only a registrar attempting the purchase can confirm that the registry will accept it at that moment. A public checker is evidence, not a reservation.

There are three approximations available, and they are not equally good.

DNS: fast, free, and only a hint

Ask the DNS system whether a domain has records. No records is a cheap signal that nobody is using the name.

It is a hint. A registered domain that nobody has configured (parked, defensive, bought and forgotten) looks exactly like an unregistered one. This is a common source of false "available" results, and the people who build on it know it. Beau, the CEO of Instant Domain Search, explained the tradeoff on Hacker News with admirable directness:

"We build our index based on zone files and DNS, so if a name is not configured, it will show as available." — Instant Domain Search, HN

That is the price of being fast, stated honestly. The problem is what happens when a different site makes the same tradeoff and does not say so.

RDAP: the actual public authority

RDAP is the IETF-standardized, JSON-based successor to WHOIS. You resolve the TLD to its registry's RDAP server, then ask that server directly. A 200 with a domain object means registered. A 404 means the registry has no record.

On 28 January 2025, ICANN made RDAP the definitive source for gTLD registration data and sunset the WHOIS requirement (announcement). Registries and registrars must provide RDAP; they are no longer required to provide WHOIS at all.

Three registries sit outside the WHOIS retirement: .com, .name, and .post must continue to provide WHOIS as well as RDAP. That is an exception to the retirement rule, not to RDAP itself. .com has a production RDAP service. A checker can use it and keep WHOIS as a fallback rather than treating the most important TLD as a protocol gap.

RDAP is structured and cacheable. A server may signal rate limits with a 429 and Retry-After, although clients still need to handle timeouts and less tidy failures.

But a 404 does not mean you can have it. It means the RDAP service has no registration object for that domain. A domain in redemption or pendingDelete normally remains a registry object with that status until it is purged. After purge, or for a name that has never been registered, other rules can still stop the purchase:

• Reserved or blocked. Registry holdbacks, premium-name rules and trademark blocks can make an unregistered string unavailable for ordinary registration.
• Restricted. Some TLDs require a local presence, membership, professional credential or other eligibility a public record cannot test for you.
• Racing you. A clean answer is a snapshot. Someone else can register the domain before your checkout reaches the registry.

So "the registry has no record of this" and "you can buy this" are different statements.

WHOIS: the legacy fallback that never wanted this job

WHOIS is what everyone used before RDAP, and it is still necessary because RDAP coverage is not universal. Country-code TLDs are the weak spot: ccTLDs are not governed by ICANN, so no mandate reaches them, and roughly 60% have deployed RDAP, up about 12 points over the preceding year, and counting "stealth" servers that are not even listed in IANA's bootstrap files (Andy Newton, APNIC, February 2026). Adoption is real, but four in ten country-code registries still have nothing to ask.

Its problem is that it was never designed for machines. As one developer put it in a thread about exactly this:

"Whois was never meant for automation. The format isn't standardized, servers don't guarantee reachability and their policies prevent scraping." — r/webdev

Unstandardized means every TLD's response is its own parsing problem. Ask about a Swiss domain and you may get a "not permitted" error for a name that is plainly registered.

So why do checkers say "available" when it isn't?

Four reasons, and they compound:

1. They asked DNS, not the registry. Fast, and wrong for anything parked.

2. They treated a 404 as a green light. Redemption, drop zones, and reserved names all look like nothing to the protocol.

3. They stitched together sources of uneven quality. This one is worth hearing from a registrar rather than from us. Namecheap's CEO, on Hacker News:

   "lookups are more complex than most think. We are querying so many different sources to give you availability status, some of which are less reliable than others… there can be false positives, resulting in the registrar showing a domain as 'available' when it is actually registered." — Tell HN: Never search for domains on Godaddy.com

4. The answer was true when they cached it. Availability is a fact with a timestamp. A checker that shows you a status without telling you when it checked is showing you a memory and calling it a fact.

The other half: why people won't search at a registrar

There is a widely held belief that searching for a domain at a commercial registrar gets it sniped: that the name you looked at gets registered by someone else, and you find it waiting for you at an auction price.

The belief is enormous. The canonical Reddit post has over five thousand points; the Hacker News version has over sixteen hundred. People route around registrar search entirely because of it.

The strong claim, that mainstream registrars systematically front-run their own search boxes, has not been established by the evidence reviewed for this page. The accusations are largely anecdotal, and industry executives have disputed them publicly.

Two things that get read as evidence are usually not:

• A registrar's name appearing as the domain's owner is normally just their privacy proxy service. The registrant paid for redaction. That is the product working.
• A name you looked at getting registered days later may be coincidence or the result of independent monitoring. Operations scan registry data for expiring and newly interesting names without needing access to your search.

And yet: the recommended defense costs you nothing. Check against a neutral source, and go to a registrar when you are ready to buy that day. You give up no convenience, and you stop needing to have an opinion about whose motives are pure. A cheap precaution against an unproven risk is still rational. That is just what cheap precautions are for.

What we would say more strongly is the thing the folklore gets right for the wrong reason: a registrar's search box is optimized to sell you something. The upsells, the premium suggestions, the seventeen alternate TLDs: that is a selling surface, and using it as a research instrument is the actual mistake.

What honest checking looks like

If you are evaluating a tool, or building one, the shape is:

1. A cheap pre-filter to eliminate the obviously-taken without paying full latency, while remembering it is a filter, not an answer.
2. RDAP as the authority, resolved to the registry's own server.
3. WHOIS as a fallback for TLDs where RDAP is not deployed.
4. A live re-check at the moment of purchase. Everything before that is a snapshot.
5. Premium and reserved detection, because "registerable" and "$12" are different claims.

And then the part that is not a protocol at all: say which one you did.

A status without a method and a timestamp is not evidence. "Available" is a claim; "available, checked against the registry four minutes ago" is a claim you can act on.

What we promise, so you can hold us to it

Nabaname checks RDAP-first against the registry's own server, resolved through the IANA bootstrap, and falls back to WHOIS where RDAP is not deployed. Every availability claim we show carries the method that produced it, a confidence level, and the time it was checked. When a check cannot reach a conclusion we say "unknown" rather than guessing green.

Exploratory checks use registry RDAP and WHOIS rather than registrar availability endpoints. When you click Register or explicitly ask Nabaname to compare registrar prices, the exact domain is sent to the configured registrars. That is the handoff from evidence to a purchase path.