domain.not_registered
RDAP has no registration record for this domain.
Also emitted by /v1/links (check link.destination_reputation, evaluated against the redirect chain’s final destination, not the submitted URL’s own host).
What it looks at#
An RDAP (Registration Data Access Protocol) lookup against the domain’s registry, routed to the correct registry per TLD using the IANA RDAP bootstrap file. If the registry responds that the domain has no registration record, this fires.
RDAP coverage varies by TLD. Some ccTLD registries don’t run a public RDAP server at all — those degrade to “unknown” with no network call and no finding either way, so this finding is never emitted based on a guess; it only fires when a registry actively confirmed there’s no record.
RDAP registries index at the apex/registrable-domain level, not per hostname — sending a
full hostname with a subdomain (www.cloudflare.com) triggers this finding even when the
apex domain (cloudflare.com) is registered and resolves cleanly. Send the registrable
domain, not a full hostname.
Why it matters#
An unregistered domain can’t be a legitimate, currently-reachable destination. This is either a dead or expired domain being reused as a lure, or a name that was never real to begin with.
What to do#
High severity blocks by default.