How a domain check actually works, and where it quietly fails

Domain availability looks like the simplest question in this whole business. It is not, and the ways it goes wrong are worth knowing before you trust an answer.

Three ways to ask, in descending order of truth

The weakest method is a DNS lookup: ask whether the name resolves, and call it free if it does not. This is fast and wrong constantly. A registered domain that nobody has pointed anywhere resolves to nothing, so parked names, defensive registrations and everything held by a squatter all read as available.

The traditional method is WHOIS — a plain-text protocol on port 43, older than the web. You open a socket to the registry, send the domain, and read back a block of text. It works, but the format is not standardised: every registry answers in its own layout, and you detect a free name by pattern-matching phrases like "No match" or "NOT FOUND".

The current method is RDAP, the protocol built to replace WHOIS. It is ordinary HTTPS with JSON, so the answer is structured rather than parsed out of prose, and it has an unambiguous signal for a free name: HTTP 404. Namescope prefers RDAP wherever it exists.

Not every extension has RDAP

IANA publishes a bootstrap file listing which registry serves RDAP for which extension. It is comprehensive for gTLDs — .com, .net, .org, .app, .dev and the rest are all there. It is patchier for country-code extensions, and two of the most popular startup TLDs are absent:

• .io — no RDAP entry in the bootstrap file.
• .co — likewise absent; the registry answers over WHOIS on port 43 instead.

For those, a checker has to fall back to WHOIS — and that fallback is where things break in ways nobody notices, because port 43 is not HTTP. Plenty of hosting environments allow outbound HTTPS and nothing else, so the socket simply hangs until it times out. The check does not fail loudly; it just never answers.

We hit exactly this: .co resolved fine in development and timed out in production, because outbound port 43 was blocked there. The cell sat grey on every scan.

What an honest tool does with that

There are two ways to handle a source that will not answer. You can guess — assume no answer means available, which is what makes a checker look confident and occasionally sends someone to buy a name that is already taken. Or you can say you do not know.

Namescope says it does not know. An adapter that cannot verify something returns "unverified", never "available", and the report shows that state plainly with a link to check by hand. An unverified row is less satisfying than a green tick. It is also the only one of the two that is true.

Reading the answer you get

Even a solid RDAP answer needs a little interpretation:

• Available in the registry does not mean buyable at list price. Premium tiers are set by the registry and only appear at the registrar.
• A registered domain may still be for sale, and an expiry date within the next few weeks is worth noting — though renewal is the norm, not the exception.
• Registrar and creation date come back with the record. A domain registered fifteen years ago by a company still trading is a different prospect from one parked last month.

And a free domain is not a free name. The registry knows nothing about trademarks: a name can be available in every extension you want and still belong to somebody in the register that matters. That is why the domain check is one column of the report rather than the whole of it.