RDAP registro.br: How to Query Domains and IPs via API and curl

For over three decades, the WHOIS protocol (specified by RFC 3912) served as the primary public directory for querying information about domain owners, name servers (DNS), IP address blocks, and Autonomous System Numbers (ASN). Operating as a minimalist text-based protocol over TCP Port 43, traditional WHOIS returns completely unstructured plain text blocks. This legacy design makes automated parsing complex, lacks robust internationalization, offers no native authentication, and directly conflicts with modern privacy regulations such as LGPD in Brazil and GDPR in the European Union.

To address these systems engineering shortcomings, the RDAP (Registration Data Access Protocol) was developed, standardized by a suite of IETF RFCs (primarily RFC 7480 to 7485). RDAP standardizes registration data queries using clean RESTful calls over HTTPS, returning structured payloads in JSON format.

In this cybersecurity and SRE guide, I analyze how RDAP works, provide direct endpoints to query Brazilian .br domains, IP blocks, and ASNs, and demonstrate practical CLI automation using curl and jq on Linux.

1. Quick reference: rdap.registro.br API endpoints#

Registro.BR, the national registrar responsible for managing .br domains in Brazil, operates its production RDAP service under the following base endpoint:

• Base API Server: https://rdap.registro.br/
• Official Information Portal: https://registro.br/rdap

The table below summarizes the exact syntax for each resource query supported by the API:

2. How to query domains on rdap.registro.br/domain#

To query any domain under the .br country code root, issue an HTTP GET request to /domain/ followed by the target domain name:

# Query the official NIC.br domain
curl -s https://rdap.registro.br/domain/nic.br | jq .

Querying registro.br#

# Query the Registro.br domain
curl -s https://rdap.registro.br/domain/registro.br | jq .

Example JSON response payload from Registro.BR#

Below is a typical structured response returned by the Registro.BR RDAP server:

{
  "objectClassName": "domain",
  "handle": "nic.br",
  "ldhName": "nic.br",
  "status": [
    "active"
  ],
  "nameservers": [
    {
      "objectClassName": "nameserver",
      "ldhName": "a.dns.br",
      "events": [
        {
          "eventAction": "delegation check",
          "eventDate": "2026-06-14T08:04:16Z",
          "status": ["ns aa"]
        }
      ]
    }
  ],
  "events": [
    {
      "eventAction": "registration",
      "eventDate": "1997-04-14T00:00:00Z"
    },
    {
      "eventAction": "expiration",
      "eventDate": "2028-12-31T00:00:00Z"
    }
  ],
  "entities": [
    {
      "objectClassName": "entity",
      "handle": "05506560000136",
      "roles": ["registrant"]
    }
  ]
}

Extracting Name Servers (DNS)#

curl -sf https://rdap.registro.br/domain/nic.br | jq -r '.nameservers[]?.ldhName'

Extracting expiration date#

curl -sf https://rdap.registro.br/domain/nic.br | \
  jq -r '.events[]? | select(.eventAction=="expiration") | .eventDate'

3. How to query IP addresses on rdap.registro.br/ip#

The /ip/ endpoint retrieves allocation details for IPv4 or IPv6 blocks delegated to Registro.br:

IPv4 Address Query (Example: 200.160.x.x block)#

The 200.160.0.0/16 subnet belongs to NIC.br core network infrastructure in São Paulo:

# Query IP allocation details for 200.160.2.3
curl -s https://rdap.registro.br/ip/200.160.2.3 | jq .

Extracting holder details with jq#

curl -sf https://rdap.registro.br/ip/200.160.2.3 | \
  jq '{handle: .handle, name: .name, cidr: .cidr0_cidrs, country: .country}'

IPv6 Prefix Query#

# Query IPv6 prefix allocation
curl -s https://rdap.registro.br/ip/2001:12ff::/32 | jq '{range: .handle, status: .status}'

4. How to query Autonomous Systems (ASN) on rdap.registro.br/autnum#

To identify the organization and BGP routing parameters of a Brazilian ASN, use /autnum/:

# Query ASN 22548 (NIC.br)
curl -s https://rdap.registro.br/autnum/22548 | jq .

Extracting organization name and status#

curl -sf https://rdap.registro.br/autnum/22548 | \
  jq '{asn: .handle, name: .name, entity: .entities[0].handle}'

5. Ten architectural advantages of RDAP over WHOIS#

The global transition from legacy WHOIS to RDAP is driven by fundamental systems engineering benefits:

1. Structured Responses (JSON): Predictable JSON payloads replace chaotic text formatting across all registries.
2. Speed and Efficiency: RESTful HTTP exchanges run smoothly over modern transport protocols.
3. HTTP Web Caching: Native support for Cache-Control, Expires, and ETag headers reduces registrar server load.
4. Lower Latency: Persistent HTTP/2 and HTTP/3 multiplexing reduces request round-trip overhead.
5. Role-Based Authentication: Registrars can expose restricted law-enforcement records using Bearer tokens while keeping public fields clean.
6. Internationalization (IDN): Native UTF-8 encoding properly handles international domain names.
7. Detailed Historical Records: Key events (creation, expiration, delegation checks) and vCard contacts are cleanly structured.
8. DevSecOps Integration: JSON output integrates seamlessly with SIEM, SOAR, and threat intelligence engines.
9. Pagination Support: Large datasets are traversed safely without buffer overflow risks.
10. Privacy Compliance (GDPR/LGPD): Standardized masking conceals sensitive personal information by default.

Visual Comparison: WHOIS vs. RDAP#

Legacy WHOIS (unstructured plain text over TCP port 43):#

% Copyright (c)nic.br
domain:      nic.br
owner:       NIC.br - Núcleo de Informação e Coordenação do Ponto BR
created:     1997-04-14
expired:     2028-12-31
status:      published

Modern RDAP (standardized JSON over HTTPS port 443):#

{
  "objectClassName": "domain",
  "ldhName": "nic.br",
  "status": ["active"],
  "events": [
    {"eventAction": "registration", "eventDate": "1997-04-14T00:00:00Z"},
    {"eventAction": "expiration", "eventDate": "2028-12-31T00:00:00Z"}
  ]
}

6. Linux automation script with rate limiting#

When querying multiple domains in monitoring pipelines, implement request throttling to comply with registry rate limits:

#!/bin/bash
# monitor_rdap.sh - Secure batch domain monitoring with rate limit controls

if [ "$#" -eq 0 ]; then
  echo "❌ Error: No domains provided for verification." >&2
  echo "Usage: $0 <domain1.com.br> [domain2.com.br ...]" >&2
  exit 1
fi

DOMAINS=("$@")
ALERT_DAYS=30

for domain in "${DOMAINS[@]}"; do
  RESPONSE=$(curl -sf "https://rdap.registro.br/domain/$domain")
  
  if [ $? -eq 0 ] && [ -n "$RESPONSE" ]; then
    EXPIRY=$(echo "$RESPONSE" | jq -r '.events[]? | select(.eventAction=="expiration") | .eventDate')
    
    if [ -n "$EXPIRY" ]; then
      EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
      NOW_EPOCH=$(date +%s)
      DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))
      
      if [ "$DAYS_LEFT" -le "$ALERT_DAYS" ]; then
        echo "⚠️  ALERT: $domain expires in $DAYS_LEFT days ($EXPIRY)"
      else
        echo "✅ $domain: OK ($DAYS_LEFT days remaining)"
      fi
    fi
  else
    echo "❌ Error querying $domain"
  fi
  
  # Courtesy delay to respect server-side rate limits
  sleep 1
done

7. International lookups via IANA bootstrap#

To query international domains outside .br (e.g., .com, .org), send queries to the IANA root server:

• IANA Base Server: https://rdap.iana.org/

The IANA router automatically resolves the authoritative registry for the target TLD:

# Query international domain via IANA bootstrap
curl -sL "https://rdap.iana.org/domain/example.com" | jq .

8. Frequently Asked Questions (FAQ)#

What is the rdap.registro.br/domain endpoint?#

It is the official REST endpoint hosted by Registro.BR to query public registration records for any .br domain. It accepts HTTP GET requests at https://rdap.registro.br/domain/{domain-name.br} and outputs structured JSON detailing name servers, status codes, and registration timestamps.

How do I query IP addresses via Registro.br RDAP?#

Send a GET request to https://rdap.registro.br/ip/{ip-address}. The API returns the allocated CIDR subnet block, managing entity details, and registration status (e.g., curl -s https://rdap.registro.br/ip/200.160.2.3 | jq .).

Does Registro.BR RDAP require authentication or an API key?#

No. Standard queries on public .br domains, IPv4/IPv6 address blocks, and ASNs do not require authentication or API keys.

What is the primary difference between WHOIS and RDAP?#

Legacy WHOIS runs on TCP port 43 returning unstructured plain text. RDAP runs over secure HTTPS port 443 with native support for web caching, standardized JSON schemas, and privacy regulations like GDPR and LGPD.

Official RDAP RFC references#

• RFC 7480: HTTP Usage in the Registration Data Access Protocol (RDAP)
• RFC 7481: Security Services for the Registration Data Access Protocol (RDAP)
• RFC 7482: Registration Data Access Protocol (RDAP) Query Format
• RFC 7483: JSON Responses for the Registration Data Access Protocol (RDAP)
• RFC 7484: Finding the Authoritative Registration Data Service
• RFC 7485: Inventory of Registration Data Decision Arguments

See also

Cybersecurity Investigating a hostile IP: BGP tracing, anonymous cloud VPS, and phishing triage

Cybersecurity From AI monorepos to OSINT reconnaissance: real troubleshooting in a Linux lab

Cybersecurity Lintriage: a Bash script for forensic triage and incident response on Linux

This post is licensed under CC BY-NC.