Checking Your Own Public Footprint Part 2: Reading Your Own WHOIS, RDAP, and Certificate History

16 August 2026 Security OSINT Privacy DNS WHOIS

Run this against your own domain, not someone else’s. Everything shown directly in this post either comes from infrastructure that’s already meant to be public, like a registry’s own record of itself, or is fabricated for illustration and clearly marked as such.

whois, still

whois is still the fastest way to check a domain, even mid-migration to RDAP. On Debian or Ubuntu it’s apt install whois; on macOS it ships with the OS; on Windows it’s not built in, but works fine under WSL.

$ whois yourdomain.co.uk

Nominet, the .uk registry, appends a banner to every single lookup right now that’s worth reading in full, because it tells you exactly how much runway is left before the tool stops working for this TLD:

********************************************************************************
* WHOIS service for .UK will cease on 9th of February 2027                     *
* For more information on the replacement RDAP services please see:            *
* https://theukdomain.uk/rdap                                                  *
********************************************************************************

That date is real and it’s specific to .uk. Generic top-level domains (.com, .net, and most others) largely finished their own WHOIS-to-RDAP transition back in January 2025, with a handful of legacy exceptions. If you’re auditing a mix of TLDs, don’t assume they’re all on the same clock.

What .uk WHOIS actually shows

Nominet’s privacy model is narrower than people expect. For an organisation registrant, the registrant name and registered address are shown by default, full stop. That’s by design: companies are expected to be contactable. Here’s a real, live example: Nominet’s own domain, registered to itself.

Registrant:
    Nominet UK

Registrant type:
    UK Limited Company, (Company number: 3203859)

Registrant's address:
    Minerva House
    Edmund Halley Road
    Oxford Science Park
    Oxford
    Oxon
    OX4 4DQ
    United Kingdom

For an individual registrant, it’s a different, narrower default: your name stays visible, but your address does not, unless you’ve explicitly opted in to publishing it. Here’s what an individual record looks like before privacy has been set, fabricated for this post, no real name or address:

Registrant:
    J. A. Fenwick

Registrant type:
    UK Individual

Registrant's address:
    14 Silverbirch Close
    Reading
    Berkshire
    RG6 7QF
    United Kingdom

And here’s the same fabricated registrant after opting out, which is the state you actually want if you registered as an individual and never touched the privacy setting:

Registrant:
    J. A. Fenwick

Registrant type:
    UK Individual

Registrant's address:
    Registrant's address hidden

The setting itself lives with your registrar, not with Nominet directly, though the effect shows up in Nominet’s WHOIS. Look for a “Registrant Type” field (UK Individual or Non-UK Individual) and an opt-out toggle, usually worded something like “keep my details private.” It’s only available for personal registrations, not domains used commercially. If your domain is registered as an individual and the address is showing in full, that’s the thing to fix, and Part 6 covers exactly how.

RDAP, and how it finds the right server

RDAP replaces the old flat-text WHOIS output with structured JSON, and it replaces a single fixed server with a bootstrapping system: a client looks up which RDAP server is authoritative for a given TLD from a registry IANA publishes, then queries that server directly. You can watch this happen:

$ curl -s "https://data.iana.org/rdap/dns.json" | python3 -c "
import json, sys
d = json.load(sys.stdin)
print([s for s in d['services'] if 'uk' in s[0]])
"
[['uk'], ['https://rdap.nominet.uk/uk/']]

That’s the entire bootstrap mechanism: a JSON file mapping TLDs to RDAP server URLs. A well-behaved RDAP client (or a public gateway like rdap.org) reads that file so it always knows where to ask, without hardcoding a server per TLD. Querying through the gateway:

$ curl -sL -H "Accept: application/rdap+json" "https://rdap.org/domain/nominet.uk"

returns a JSON document, not text, with a rdapConformance field that’s worth checking specifically. On a lookup like this one it included "redacted", which is RDAP’s standardised way of telling you a field exists in the record but has been withheld, rather than simply omitting the field and leaving you to guess whether it was never populated or deliberately hidden. That’s a real, structural improvement over WHOIS, where “blank” and “redacted” look identical.

Certificate transparency: the part that isn’t a privacy setting

Since 2018, every public certificate authority has been required to publish every certificate it issues to public, append-only Certificate Transparency logs, under RFC 6962. crt.sh is the most commonly used interface to search them. There’s no opt-out. It doesn’t matter what your registrar’s privacy defaults are, because this data isn’t coming from your registrar.

$ curl -s "https://crt.sh/?q=%25.yourdomain.co.uk&output=json"

The %25 is a URL-encoded %, so this queries for any certificate ever issued for any subdomain of yourdomain.co.uk. What you’re looking for is subdomains you don’t recognise or don’t remember standing up: an old staging environment, a test VPN endpoint, an internal tool that was briefly given a public certificate and never taken back down. Every one of those is now a permanent, searchable, public record of a hostname that existed, whether or not anything is still listening on it.

Part 3 moves from domains to identities: what a username on its own reveals, and why “account found” from an automated tool needs a second look before you trust it.