Free Domain Availability Checker

How a domain availability check actually works

Nothing on the internet holds a list of unregistered domains. The only authoritative record is the list of domains that are registered, held by each registry, and a checker works by asking for one name and seeing whether a record comes back. No record means nobody has claimed it. That inversion is why every honest checker reports a negative result rather than a positive one, and why "available" always carries slightly less certainty than "taken".

There are two protocols for asking, and the difference between them is the single biggest source of wrong answers in free availability tools.

RDAP is the modern replacement, and it is what this tool queries. It returns real JSON, so 404 versus 200 is an unambiguous signal instead of a per-registry text pattern you have to parse by hand.

The 404 trap that makes most checkers lie

A checker reads RDAP's 404 as "no record exists, so the name is free". That inference is only valid when the TLD actually runs an RDAP service, and hundreds do not.

ICANN's contracts bind gTLD registries to publish RDAP. Country-code TLDs sit outside that regime entirely, so a ccTLD publishes RDAP only if it feels like it. When the TLD has no RDAP endpoint, the bootstrap has nowhere to route the query and the answer is 404 for every name, registered or not.

Measured against the IANA RDAP bootstrap and the IANA TLD list (both pulled 2026-08-23): 238 of 1,438 delegated TLDs publish no RDAP service. The list is not obscure:

You can reproduce it in one line. curl -s -o /dev/null -w "%{http_code}" https://rdap.org/domain/github.io returns 404, and so does google.co, and so does about.me. All three are obviously registered.

We shipped that bug ourselves and fixed it on 2026-08-23. This tool now checks the IANA bootstrap first and only reads a 404 as availability when the TLD genuinely runs RDAP. For the 238 that do not, it falls back to a nameserver lookup: a delegated domain is a registered domain, so github.io and google.co correctly come back taken, and the result is labelled so you know which method produced it.

Why .io is the hardest TLD to check

.io is the interesting case because it is both extremely popular with developers and unusually closed. It publishes no RDAP endpoint, and from this machine on 2026-08-23 a port 43 query to whois.nic.io returned nothing at all: the local whois client fell back to IANA and reported facts about the .io TLD rather than about the domain. .com, by contrast, still answers port 43: whois.verisign-grs.com returns the full registry record for google.com immediately.

So for .io there is no public structured lookup left. DNS delegation is the honest signal available to any tool that is not a registrar, which is exactly what we fall back to.

What "taken" does not tell you

A 200 from RDAP means a record exists. It does not mean the domain is in use, and it does not mean it will stay unavailable. RDAP returns a typed status array and an events array, and those carry the detail:

status: ["client transfer prohibited", "server delete prohibited"]
events: registration 1997-09-15, expiration 2028-09-14, last changed 2019-09-09

That is the live record for google.com. The statuses are registrar locks, not signs of activity.

The states worth knowing are the ones on the way out. A domain in redemptionPeriod has expired and is inside the grace period where only the previous owner can restore it. A domain in pendingDelete is typically days from being released. Both report as taken. Neither is permanent, which is why domain age and expiry dates are worth reading before you give up on a name.

What "available" does not tell you either

Availability is not the same as registrability, and there are four ways a green result still fails at checkout:

• Premium pricing. Registries reserve desirable names and price them well above the standard rate. A one-word .ai or a short .com can be genuinely unregistered and still cost four or five figures. The registry decides, not the registrar.
• Registry-reserved strings. Every registry withholds a reserved list of country names, ICANN-mandated strings, single and two-character labels in many TLDs. These have no RDAP record, so they look available and cannot be bought.
• The race window. Between your check and your checkout, anyone can register the name. There is no reservation.
• Local eligibility rules. Several ccTLDs require a local presence, a company number, or a trademark. Unregistered does not mean available to you.

The honest read of a green result is "no registry record exists right now". Treat it as a strong signal, not a receipt.

Reading this tool's results

We check ten TLDs in parallel and label every result with the method behind it:

• Taken (rdap): the registry returned a record. Definitive.
• Available (rdap): the registry runs RDAP and has no record. Strong.
• Taken (dns): no RDAP for this TLD, but the domain has nameservers. Definitive, you cannot delegate a domain you do not hold.
• Available (dns): no RDAP and no delegation. Probable, and the weakest of the four. A registered-but-undelegated domain is the false positive here, so confirm at a registrar before you plan around it.
• Unknown: the registry timed out, throttled us, or the DNS lookup failed. Retry.

We do not redirect you through an affiliate link, and we do not log the names you check. That second point matters more than it sounds: front-running, where a checker registers a name you searched for, is rare among reputable services but the reason many people check availability directly at WHOIS or over DNS instead.

Checking availability from code

If you are checking one name, use the box above. If you are checking thousands, or building a name search into your own product, query RDAP yourself and cache the bootstrap. The pattern is short:

# 1. Which TLDs have RDAP at all?
curl -s https://data.iana.org/rdap/dns.json | jq '.services[][0][]' | wc -l

# 2. Ask about one domain
curl -s -H "accept: application/rdap+json" https://rdap.org/domain/example.dev

Two things will bite you. RDAP endpoints rate-limit anonymous clients aggressively, so a sequential sweep over a wordlist will start returning 429 well before it finishes. And the bootstrap file changes as registries come online, so pin a refresh interval rather than shipping a hardcoded TLD list. Ours refreshes daily.

Our own endpoint is documented at the domain availability API reference, and if you need registration rather than lookup, the buy-domain API handles search, pricing, and purchase in one call.

If you are building this into a SaaS

A name search is usually step one of a longer flow: the user picks a domain, buys it, and then points it at your product. The last step is the one that eats engineering months: DNS verification, certificate provisioning, SNI routing at the edge, and renewal forever after.

Domainee is a custom domains API for SaaS with a native MCP server — 50 domains and 100 GB free. It covers the part after the purchase: your users bring or buy a domain, and multi-tenant custom domains work without you running an edge. The cost calculator prices building it in-house against paying for it.