RDAP bootstrap coverage
Where RDAP answers, measured from one shortener's domain-age lookups
tg.pe asks how old a destination's domain is before letting a short link go live. Answering that for every submission means asking RDAP for a registration date, and recording what happens when RDAP does not answer. Three months of those lookups are an incidental measurement of something the DNS-abuse community argues about with little field data: where is RDAP actually deployed and answering?
This page reports that measurement and everything wrong with it. The headline split is wide (gTLDs 99.1%, ccTLDs 30.7%), but the population is one shortener's traffic rather than a sample of the DNS, and six further limits all push the true miss rate higher than shown. Treat it as one real-world input to a question that deserves a proper study, not as a result to cite on its own. The methodology page holds the definitions, the rest of the data tables, and what is still unmeasured.
What is measured, and from where
For every destination, tg.pe resolves the age of the registrable parent domain and records which source answered. RDAP is tried first; when RDAP is silent (typically a ccTLD outside the IANA bootstrap), CIRCL Passive DNS first-seen serves as a second tier; and a VirusTotal WHOIS-derived creation date is a further fallback in the background pass. The synchronous resolver (resolveDomainAge()) tags its answer as rdap or pdns; the background VirusTotal pass records its own source=virustotal in malicious_detections separately.
The source tag turns a routine safety check into a small live instrument for a DNS-abuse-governance question: where is RDAP actually answering, and where does the ecosystem still fall back to weaker signals? All of it is preliminary and open: a curiosity this tooling could be extended into a study, not a settled result.
The two-population domain-age picture
Observed in practice, on a small sample: the destinations split into two populations. Freshly-registered throwaway domains are caught early, at submission, by the new-domain and smartlink honeypots; they never reach a human. The destinations that instead reach an operator takedown after an external report tend to be compromised, established sites, where the registration date says nothing useful about intent. This is an observation, not a rate: the usable sample is small, partly because legacy removals scrubbed the destination before the registration date was retained (see the gaps list). Treat it as a shape worth probing, not a finding.
Bootstrap coverage (preliminary)
RDAP coverage observed in practice is uneven. gTLDs are essentially complete in the IANA RDAP bootstrap; ccTLD coverage is patchy. The Peru .pe ccTLD (tg.pe's own TLD) is absent from the bootstrap, which is precisely why CIRCL Passive DNS first-seen is needed as a second tier at all. And bootstrap presence understates real deployment: several registries run RDAP servers that are not listed in the bootstrap (unlisted or "stealth" servers), so a TLD can be answering RDAP while reading as uncovered.
What the instrument actually shows
Snapshot 2026-08-16 · observation window 2026-05-16 to 2026-08-16 · read from the on-disk RDAP and pDNS lookup caches, one entry per registrable domain, not from a database column (see the disclosures below) · n = 566 domains.
The shape the prose above predicted holds. “Answered” here means rdap.org returned a response carrying a registration event; a two-letter TLD counts as a ccTLD.
When RDAP does not answer, the second tier picks up most but not all of the slack. Of the 154 misses:
- pDNS first-seen date 111 (72.1%)
- Never observed by CIRCL 25 (16.2%)
- No record written 18 (11.7%)
Per-ccTLD, where at least four domains were looked up
| ccTLD | Answered | Looked up |
|---|---|---|
.ru | 0 | 52 |
.tw | 17 | 20 |
.in | 14 | 14 |
.io | 0 | 14 |
.me | 0 | 12 |
.cc | 8 | 8 |
.uk | 7 | 7 |
.de | 0 | 7 |
.co | 0 | 5 |
.ee | 0 | 4 |
The split is close to all-or-nothing per registry, which is what a bootstrap-presence effect looks like rather than a flakiness effect. .ru is the largest single population here and never answered once; .io, .me, .de and .co are commercially common and answered on none of this path either. Below the four-lookup threshold the tail is mostly noise: 45 ccTLDs were looked up exactly once. .pe, tg.pe's own TLD, is 0 of 2, which is the observation the second tier was built for in the first place.
Method disclosures, and what the denominator leaves out (six limits this figure cannot be cited without)
Each of these biases what "covered" means here:
- The resolver follows rdap.org, not a self-maintained bootstrap parse. Lookups go to
rdap.org, a bootstrap-following aggregator that redirects to the authoritative server. The coverage tg.pe sees is therefore mediated by rdap.org's behaviour, not by a first-hand reading of the IANA bootstrap file. - eTLD+1 is a hardcoded two-level-suffix list, not the Public Suffix List. The registrable-domain extraction (
rdapRegistrableDomain()) recognises a fixed set ofco.uk/com.tw-style suffixes and otherwise falls back to the last two labels. On an unlisted multi-label ccTLD this can query the wrong parent, which biases coverage exactly on the TLDs the measurement is most interested in. - The pDNS first-seen proxy is biased. CIRCL first-seen is the earliest time CIRCL's sensors observed the domain in DNS, not its registration date. A long-dormant domain only recently observed reads as "new". This is acceptable in the pipeline (pDNS only fires on an RDAP miss, and a hit creates an operator-reviewed honeypot, not a hard block) but it is a real bias in any measurement built on the same datum.
Three further limits sit on top, and they all point the same way, toward the true miss rate being higher than shown:
- The population is tg.pe's submissions, not a TLD sample. 52 of the 218 ccTLD lookups are
.rualone. These percentages describe what this shortener was asked to resolve; they are not a survey of the DNS. - Only definitive outcomes are counted. A cache entry is written on an HTTP 404 or on a response with no registration event. Transient failures, 5xx, and unparseable responses deliberately write nothing, so they are absent from the 566. At least 16 further domains are known to have taken that path, because pDNS cached a result for them while RDAP left no file at all.
- The snapshot keeps the latest outcome per domain, and misses are retried sooner. A miss is cached for 1 day, a hit for 30, so a domain that missed once and answered later reads as a hit. 3 current hits are known to have missed earlier, from the same pDNS-record cross-check. The bias runs toward over-reporting coverage.
Two miss causes are also conflated: “no such domain or no RDAP server” (404) and “a server answered but returned no registration event” both write the same null. Separating conformance failures from absent servers needs instrumentation that does not exist yet.
The open direction this points at: a per-ccTLD study joining stealth-inclusive RDAP deployment (probing for unlisted servers, not just reading the bootstrap) with response conformance (does the server actually return a usable registration event?). What is above is one small, real-world input to that, no more.