How domain availability checking actually works — and why checkers lie

You typed a name into a domain search box. It came back green. You felt the small lift of relief that every founder knows, and you started telling people the name.

Then you went to buy it and it was gone, or it cost $12,000, or the registrar said "unavailable" while the lookup tool still insisted it was free.

The green dot was not exactly lying. It was answering a different question from the one you asked, and almost no checker tells you which question it answered.

There is no single place to ask

Start with the fact that explains everything else: there is no authoritative, publicly accessible source for whether a domain can be registered.

The ground truth lives in EPP, the protocol registrars use to talk to registries. It is accurate, it is real-time, and you cannot use it: access requires registrar accreditation. Every public checker on the internet, including every one you have ever used, is therefore working from an approximation.

There are three approximations available, and they are not equally good.

DNS: fast, free, and only a hint

Ask the DNS system whether a domain has records. No records is a cheap signal that nobody is using the name.

It is a hint. A registered domain that nobody has configured (parked, defensive, bought and forgotten) looks exactly like an unregistered one. This is the single largest source of false "available" results on the internet, and the people who build on it know it. Beau, the CEO of Instant Domain Search, explained the tradeoff on Hacker News with admirable directness:

"We build our index based on zone files and DNS, so if a name is not configured, it will show as available." — Instant Domain Search, HN

That is the price of being fast, stated honestly. The problem is what happens when a different site makes the same tradeoff and does not say so.

RDAP: the actual public authority

RDAP is the IETF-standardized, JSON-based successor to WHOIS. You resolve the TLD to its registry's RDAP server, then ask that server directly. A 200 with a domain object means registered. A 404 means the registry has no record.

On 28 January 2025, ICANN made RDAP the definitive source for gTLD registration data and sunset the WHOIS requirement (announcement). Registries and registrars must provide RDAP; they are no longer required to provide WHOIS at all.

With three exceptions — and one of them is the punchline. .com, .name, and .post are explicitly carved out and still require WHOIS. The single most important TLD on the internet, the one every founder in this article actually cares about, is one of three exempted from the protocol's own retirement. If you build for the standard and assume WHOIS is dead, you have built for every TLD except the one that matters most.

Setting that aside, RDAP is structured, cacheable, and it rate-limits you politely with a 429 and a Retry-After instead of silently dropping your connection.

But a 404 does not mean you can have it. This is where careful checkers still get it wrong. A registry can return "no record" for a name that is:

• In redemption. The domain expired and entered the 30-day Redemption Grace Period, during which the previous owner can restore it, and after which it spends 5 more days in pendingDelete, where nobody can register or restore it; it is simply counting down. Before all that, most gTLDs give the owner an auto-renew grace period of up to 45 days. So a name can look unregistered for two and a half months while never once being available to you.
• In the drop zone. The registry is holding it back before re-release, often to return it as a registry premium at a price that has nothing to do with $12.
• Reserved or blocked. Registry-level holdbacks and trademark block services make a name unregisterable while the protocol shrugs.

So "the registry has no record of this" and "you can buy this" are different statements.

WHOIS: the legacy fallback that never wanted this job

WHOIS is what everyone used before RDAP, and it is still necessary because RDAP coverage is not universal. Country-code TLDs are the weak spot: ccTLDs are not governed by ICANN, so no mandate reaches them, and roughly 60% have deployed RDAP, up about 12 points over the preceding year, and counting "stealth" servers that are not even listed in IANA's bootstrap files (Andy Newton, APNIC, February 2026). Adoption is real, but four in ten country-code registries still have nothing to ask.

Its problem is that it was never designed for machines. As one developer put it in a thread about exactly this:

"Whois was never meant for automation. The format isn't standardized, servers don't guarantee reachability and their policies prevent scraping." — r/webdev

Unstandardized means every TLD's response is its own parsing problem. Ask about a Swiss domain and you may get a "not permitted" error for a name that is plainly registered.

So why do checkers say "available" when it isn't?

Four reasons, and they compound:

1. They asked DNS, not the registry. Fast, and wrong for anything parked.

2. They treated a 404 as a green light. Redemption, drop zones, and reserved names all look like nothing to the protocol.

3. They stitched together sources of uneven quality. This one is worth hearing from a registrar rather than from us. Namecheap's CEO, on Hacker News:

   "lookups are more complex than most think. We are querying so many different sources to give you availability status, some of which are less reliable than others… there can be false positives, resulting in the registrar showing a domain as 'available' when it is actually registered." — Tell HN: Never search for domains on Godaddy.com

4. The answer was true when they cached it. Availability is a fact with a timestamp. A checker that shows you a status without telling you when it checked is showing you a memory and calling it a fact.

The other half: why people won't search at a registrar

There is a widely held belief that searching for a domain at a commercial registrar gets it sniped: that the name you looked at gets registered by someone else, and you find it waiting for you at an auction price.

The belief is enormous. The canonical Reddit post has over five thousand points; the Hacker News version has over sixteen hundred. People route around registrar search entirely because of it.

The strong claim, that mainstream registrars systematically front-run their own search boxes, has never been demonstrated. It is hotly disputed, the accusations are almost entirely anecdotal, and at least two registrar executives have denied it publicly and specifically.

Two things that get read as evidence are usually not:

• A registrar's name appearing as the domain's owner is normally just their privacy proxy service. The registrant paid for redaction. That is the product working.
• A name you looked at getting registered days later is a coincidence you are now primed to notice. Separately, there are operations that hammer registry APIs for expiring names and would have caught it whether or not you ever typed it anywhere.

And yet: the recommended defense costs you nothing. Check against a neutral source, and go to a registrar when you are ready to buy that day. You give up no convenience, and you stop needing to have an opinion about whose motives are pure. A cheap precaution against an unproven risk is still rational. That is just what cheap precautions are for.

What we would say more strongly is the thing the folklore gets right for the wrong reason: a registrar's search box is optimized to sell you something. The upsells, the premium suggestions, the seventeen alternate TLDs: that is a selling surface, and using it as a research instrument is the actual mistake.

What honest checking looks like

If you are evaluating a tool, or building one, the shape is:

1. A cheap pre-filter to eliminate the obviously-taken without paying full latency, while remembering it is a filter, not an answer.
2. RDAP as the authority, resolved to the registry's own server.
3. WHOIS as a fallback for TLDs where RDAP is not deployed.
4. A live re-check at the moment of purchase. Everything before that is a snapshot.
5. Premium and reserved detection, because "registerable" and "$12" are different claims.

And then the part that is not a protocol at all: say which one you did.

A status without a method and a timestamp is not evidence. "Available" is a claim; "available, checked against the registry four minutes ago" is a claim you can act on.

What we promise, so you can hold us to it

Nabaname checks RDAP-first against the registry's own server, resolved through the IANA bootstrap, and falls back to WHOIS where RDAP is not deployed. Every availability claim we show carries the method that produced it, a confidence level, and the time it was checked. When a check cannot reach a conclusion we say "unknown" rather than guessing green.

We hold ourselves to under 2% false-available, cases where we said a name was gettable and it was not. And we do not query registrars while you are exploring; the first time a registrar hears about your name is when you have decided to buy it.

Those are testable claims.