Domain whois

Your browser asks the registry of the extension (.fr, .com…) directly, over RDAP, the successor of whois that answers in JSON over HTTPS. The server of r-no.fr is not involved: it never sees what you look up.

Who sees your lookup

Each lookup goes to the registry of the extension, and to it alone: Afnic for .fr, Verisign for .com, Nominet for .uk… It receives the name and your IP address, and learns that the request comes from r-no.fr (the Origin header, which browsers send and pages cannot remove). No cookie is sent. For a name such as www.bbc.co.uk, the page asks for www.bbc.co.uk, then bbc.co.uk, until the registry knows one: three names at most.

Which registries

The address of each registry comes from the official list of IANA (the RDAP bootstrap file, RFC 9224), embedded in registres.js. A registry is only asked if it lets web pages read its answers (the Access-Control-Allow-Origin header): your browser requires it. This was checked from r-no.fr for each registry on 28 September 2026: more than a thousand extensions can be looked up here. Others answer, but not to web pages (.biz, .tv…), and some have no RDAP at all (.de, .eu, .be, .it…): the page says so, and sends nothing.

Enforced by your browser

This page's Content Security Policy only allows these registries' RDAP services, a few hundred destinations: the same list as registres.js. A redirection to any other destination is blocked by your browser, and the page says so. No form submission (form-action 'none'). One more destination is allowed, as on every page of the site: https://stats.r-no.fr, the audience measurement (see below). You can read the policy at the top of the page source.

Audience measurement

Like every page of the site, this one counts its visit with Umami, installed on R-no’s own server (stats.r-no.fr). It receives the address of the page, without parameters or anchor, the site you came from (its domain only), your browser, system, language and screen size, and the country, region and city deduced from your IP address, which is not kept. It never receives what you type, nor the result of the tool. No cookie, nothing stored in your browser; if your browser asks not to be tracked (Do Not Track), nothing is measured. The data is erased after 25 months.

• /commun/mesure.js: the filter applied before each sending, written for R-no Toolbox. 1.4 kB
  SHA-256 225eec74fd12623d82fc05ee7d222be629ce454d081c129e8d1e249ed37ee716
• https://stats.r-no.fr/m.js: Umami’s tracker, open source (MIT), served by the measurement server. Its fingerprint is not shown here: it changes with each version of Umami, and you cannot check from your browser that it is the published code. For that part, you have to trust R-no.

The registrar's record is not opened

The whois of a domain often has two levels: the registry's record, then the registrar's, the company through which the name was bought. This page only reads the first: registrars are counted by the hundred, and this page's policy cannot name them all. The address of the registrar's record is shown when the registry gives it.

Personal data shown

Registry records are public. Since the GDPR, most registries hide the holder's details when the holder is a person; companies and organisations are often shown. This page displays what the registry publishes, and keeps nothing once you leave the page.

What is never sent

Names reserved for local networks (.local, .lan, .home.arpa, .internal…), names without an extension, and names whose registry does not answer web pages are recognised in your browser and never sent. An IP address is not sent either: the page points to ip/whois.

Guardrail

This page makes at most 20 lookups per minute. The requests leave from your address, not from the server, but they carry the r-no.fr origin: the limit keeps r-no.fr welcome at the registries. Some registries also limit the lookups of each address on their own side.

What is stored

No cookie, and nothing in the address of this page: a lookup cannot be found in the server's logs. What you type is not kept. Your language is given by the address itself (/en/ or /fr/): nothing is stored to remember it. Like any website, the server records the download of the page and its files in its access logs (IP address, date and time, address requested, browser name).

Code that runs here

• app.js: checks the name, finds its registry, asks it, and reads its answer. Written for R-no Toolbox, not minified, no third-party library. 28.7 kB
  SHA-256 1f076bb3fd6baee286dd683c88463cceb382220d5cde933a0751d79ebb55ad3d
• registres.js: data only: for each extension, the address of its registry, and whether it answers web pages. Built from the IANA file and the check made from r-no.fr, compared byte for byte on every deployment. 36.3 kB
  SHA-256 bc6fdac37e8487906499dd8c31472e48fbd9dad16f3260d0bd71f9137f11ee11
• textes.js: the French messages of the tool, shown by its script (the rest of the French page is written into its HTML when the site is built). It only defines texts, with no logic. 12.9 kB
  SHA-256 4fb8153e710cac088e53787aa32a47f83b00baf69a332129c95f2f3fad75ac00
• /commun/langue.js: the language helper, the same on every page of the site. It reads the language of the page and gives the tool its messages in that language. It stores nothing. 1.6 kB
  SHA-256 80f76f69773ef628d36d09bf8387cfedebda4529210d7120649b6f5603310631

Tested

Checking the name, choosing the registry, the names asked and the reading of the answers are covered by automated tests, run on every deployment, on real answers recorded from several registries.

Check it yourself

Download the script and compare its fingerprint with the one above:
curl -s https://r-no.fr/domains/whois/app.js | shasum -a 256

Limits

• Extensions without RDAP, or whose registry does not answer web pages, cannot be looked up here. Their whois answers on port 43, which only a program or a server can reach.
• “No record” means the registry does not know the name: it is probably free, but a name reserved or blocked by the registry answers the same way. Only a registrar can say whether it can be bought.
• The page does not know where the registered part of a name starts (co.uk, gouv.fr…): it asks the registry, from the longest name to the shortest.
• Which registries answer web pages was checked on a given day: a registry may change its mind. The list is updated with the site.