The RDAP CLI supports three output formats: colorized text (default), compact JSON, and pretty-printed JSON.
Text Output (Default) The default format displays human-readable, colorized output with intelligent formatting.
Features
Color Coding
Server URLs in cyan/green
Headers in bold
Values formatted for readability
Status indicators highlighted
Abuse Contacts Automatically extracts and displays abuse contact information at the top for:
Domain queries
IP address queries
AS number queries
Smart Tables Contact information and structured data displayed in formatted tables
Multi-Layer For domain queries, shows both registry and registrar data when available
Domain Output Example Abuse contact for `google.com` is `abusecomplaints@markmonitor.com` Query from https://rdap.verisign.com/com/v1/domain/google.com Domain Name: GOOGLE.COM Handle: 2138514_DOMAIN_COM-VRSN Object Class: domain Status: client delete prohibited Status: client transfer prohibited Status: client update prohibited Nameserver: NS1.GOOGLE.COM Nameserver: NS2.GOOGLE.COM Nameserver: NS3.GOOGLE.COM Nameserver: NS4.GOOGLE.COM Delegation Signed: no Registration: 1997-09-15T04:00:00Z Expiration: 2028-09-14T04:00:00Z Last Changed: 2019-09-09T15:39:04Z Entity Handle: 292 Role: registrar Name: MarkMonitor Inc. IANA Registrar ID: 292 Query from https://rdap.markmonitor.com/rdap/domain/GOOGLE.COM [Registrar data follows...]
IP Output Example Abuse contact for `8.8.8.8` is `network-abuse@google.com` Query from https://rdap.arin.net/registry/ip/8.8.8.8 Handle: NET-8-8-8-0-2 Start Address: 8.8.8.0 End Address: 8.8.8.255 IP Version: v4 Name: GOGL Type: DIRECT ALLOCATION Parent Handle: NET-8-0-0-0-0 Status: active Port43: whois.arin.net last changed: 2023-12-28T17:24:56-05:00 registration: 2023-12-28T17:24:33-05:00
AS Number Output Example Abuse contact for `AS8888` is `abuse@xtom.com` Query from https://rdap.db.ripe.net/autnum/8888 AS Number: AS8888 Name: XTOM Handle: AS8888 Object Class: autnum Status: active Port43: whois.ripe.net Registration: 1970-01-01T00:00:00Z Last Changed: 2024-08-17T11:00:40Z Entity Handle: ORG-XPL3-RIPE Role: registrant Name: xTom Pty Ltd Phone: +61280066886 Address: 81 Campbell St 2010 Surry Hills AUSTRALIA
JSON Output Output the raw RDAP response as JSON for programmatic processing.
Compact JSON Minified JSON on a single line:
{ "objectClassName" : "domain" , "handle" : "2138514_DOMAIN_COM-VRSN" , "ldhName" : "EXAMPLE.COM" , "status" :[ "client delete prohibited" , "client transfer prohibited" ], ... }
Compact JSON is ideal for piping to other tools like jq or storing in logs.
Pretty-Printed JSON Formatted JSON with indentation:
rdap -f json-pretty example.com
{ "objectClassName" : "domain" , "handle" : "2138514_DOMAIN_COM-VRSN" , "ldhName" : "EXAMPLE.COM" , "status" : [ "client delete prohibited" , "client transfer prohibited" , "client update prohibited" ], "nameservers" : [ { "objectClassName" : "nameserver" , "ldhName" : "NS1.EXAMPLE.COM" } ], "entities" : [ { "objectClassName" : "entity" , "handle" : "292" , "roles" : [ "registrar" ], "vcardArray" : [ "vcard" , [ [ "version" , {}, "text" , "4.0" ], [ "fn" , {}, "text" , "MarkMonitor Inc." ] ] ] } ] }
JSON Source Selection For domain queries that return both registry and registrar data, you can choose which data to output as JSON.
Registry Data Output data from the TLD registry (e.g., Verisign for .com):
rdap -f json --json-source registry google.com
Registry data typically includes basic domain information, nameservers, and registrar reference.
Registrar Data (Default) Output data from the registrar (e.g., MarkMonitor):
rdap -f json --json-source registrar google.com
This is the default for JSON output. If no registrar data is available, falls back to registry data.
Registrar data typically includes detailed contact information and additional domain details.
Registry vs Registrar
Text Format Behavior
Registry data comes from the TLD operator (e.g., Verisign for .com):
Basic domain information
Nameservers
Domain status
Registrar reference
Registrar data comes from the domain registrar (e.g., MarkMonitor):
Detailed contact information
Additional domain metadata
Privacy-redacted or full contact details
Registration/expiration dates
In text format, the tool automatically shows:
Abuse contact from registrar (if available)
Registry server URL and data
Registrar server URL and data (if available)
This gives you the complete picture of the domain registration. Piping with jq Combine JSON output with jq for powerful data extraction:
Extract Domain Name
List Nameservers
Get Registrar Name
Extract Abuse Email
Get IP Range
rdap -f json example.com | jq -r '.ldhName' # Output: EXAMPLE.COM
Best for:
Interactive terminal use
Quick lookups
Human reading
Getting abuse contacts quickly
Features:
Color-coded output
Formatted tables
Abuse contacts highlighted
Multi-layer domain data
Best for:
Piping to jq or other tools
Logging and storage
Minimal file size
Automated processing
Features:
Single-line output
Raw RDAP response
Machine-readable
Compact format
Best for:
Reading JSON structure
Debugging
Documentation
Understanding RDAP format
Features:
Indented output
Raw RDAP response
Human-readable JSON
Easy to parse visually
Text Format
Compact JSON
Pretty JSON
Next Steps
Basic Queries Learn basic RDAP query syntax
Advanced Options Explore timeouts, custom servers, and more
