WHOIS Lookup

WHOIS lookup: read a domain's registration record and understand what is missing from it

Type a domain and this tool queries the public registration data for it, then lays the answer out in fields you can actually read: registrar, creation date, last update, expiry date, nameservers, DNSSEC state, and the raw status codes attached to the domain. You can paste a full URL — https://www.example.com/pricing — and the scheme, the www. and the path are stripped before the query runs.

The thing most WHOIS guides on the internet still get wrong is what comes back. If you learned WHOIS before 2018, you remember a record that named a human being, gave their street address, their phone number and an email you could write to. That record is largely gone. Almost every lookup you run today returns a record where the registrant fields are redacted and the technical fields are intact. That is not a failure of the tool and it is not a quirk of one registrar — it is now the default shape of the data, and the useful skill is knowing which half survived.

What you can still rely on, and what is usually withheld

After the GDPR took effect, ICANN's temporary specification for gTLD registration data pushed registries and registrars to stop publishing personal contact detail in the public record. Registrars also sell privacy and proxy services that substitute their own details for the customer's, and many now enable that by default. The combined effect is consistent enough to plan around.

When the registrant line in the result reads Redacted, that is the accurate answer, not an error. If you genuinely need the identity behind a domain — for a legal claim, a trademark dispute or a law-enforcement matter — the route is a request to the registrar, not a better lookup tool. No public WHOIS or RDAP query will return it.

Country-code TLDs behave differently

Every ccTLD registry sets its own disclosure policy, so results vary a lot by extension. Some publish organisation names for business registrations while hiding individuals. Some rate-limit queries aggressively or answer only through their own web form. Some publish very little at all. If a lookup for a ccTLD comes back thinner than you expected, that is the registry's policy rather than a gap in the query.

EPP status codes: the part people are actually trying to read

The status codes are the operational state of the domain, and they are the reason most technical users run a lookup in the first place. They come from the Extensible Provisioning Protocol used between registrars and registries. The prefix tells you who set the lock: client codes are set by the registrar, usually on the registrant's behalf, and the registrant can normally have them lifted. server codes are set by the registry and are far harder to move — they often signal a dispute, a court order or a policy action.

This tool prints each code returned for the domain with a plain-English explanation next to it. The ones that come up most:

• ok (sometimes shown as active) — no restrictions at all. Worth noticing rather than celebrating: a domain with no transfer lock is easier to hijack than one with clientTransferProhibited.
• clientTransferProhibited — the registrar lock. This is the normal, healthy state for a domain you own, and it is what you want to see on your own portfolio. It has to be lifted before an outbound transfer will succeed, which is why it is the code people hit when a transfer mysteriously fails.
• clientUpdateProhibited and clientDeleteProhibited — changes and deletion blocked at the registrar. Together with the transfer lock these are often bundled as a "registry lock" or "premium security" product on high-value domains.
• serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited — the registry-level equivalents. Seeing these on a domain you do not control usually means something unusual is happening to it.
• clientHold and serverHold — the domain is excluded from the zone. This is the code that explains "the domain exists, WHOIS answers, but nothing resolves." Registrars set clientHold for unpaid renewals and for abuse complaints; registries set serverHold for policy and legal action.
• redemptionPeriod — the domain expired and was deleted by the registrar, but the original registrant can still restore it by paying a redemption fee. This window is conventionally around 30 days. During it the domain will not resolve and it is not available to buy.
• pendingDelete — redemption is over. The domain runs out the last few days of this state and is then released to general availability, which is what drop-catch services queue on. If you are waiting for a name, pendingDelete is the code that says the wait is nearly over.

A worked reading: a domain showing clientHold plus an expiry date two weeks in the past is almost certainly an unpaid renewal, and the site being down has nothing to do with hosting or DNS configuration. A domain showing redemptionPeriod is not for sale yet no matter what a marketplace listing says. A domain showing only ok, a creation date from last week and nameservers at a free DNS provider is a brand-new, unlocked, disposable registration.

Registry WHOIS versus registrar WHOIS

There are two records for most gTLD domains, and they do not contain the same thing. The registry — Verisign for .com, for example — holds the authoritative thin record: the domain name, the sponsoring registrar, the creation, update and expiry dates, the nameservers and the status codes. The registrar holds the thick record, which adds whatever contact data it is willing to publish. The registry record is the one you should trust for dates and status; if a registrar's own page shows a different expiry date to the registry, the registry is right and the registrar is often showing an internal grace-period date instead.

Some registries are thick rather than thin and hold the contact data themselves. That distinction used to matter enormously for research; with contacts redacted, it matters far less than it did.

RDAP is the successor protocol

Classic WHOIS is defined by RFC 3912, and it is barely a protocol: connect to port 43, send a string, receive unstructured text. There is no defined encoding, no defined field names and no defined error signalling, which is why every WHOIS parser is a pile of regular expressions that break whenever a registrar changes its output format.

RDAP — the Registration Data Access Protocol — replaces that with HTTPS and structured JSON, with a defined response format (RFC 9083) and a bootstrap mechanism for finding the right server for a given TLD. It supports proper authentication, which is the mechanism by which accredited requesters may eventually get access to data the public response redacts. ICANN has been moving gTLD registries and registrars off port-43 WHOIS onto RDAP as the required service, so RDAP is what new tooling should target.

This tool queries a WHOIS data service first and falls back to RDAP when that does not answer, and it tells you which one produced the result in the metadata line at the bottom of the output. In practice the two return the same technical fields; the field names differ, not the facts.

Using the creation date to judge a suspicious domain

Domain age is the most valuable single number in a modern WHOIS record, precisely because it is one of the fields redaction left alone. Campaigns that use throwaway domains — invoice fraud, brand-impersonation phishing, fake stores, courier-delivery scams — need names that have never been reported, so the domains are almost always young. The tool computes the age from the creation date and displays it in years and months, alongside a timeline bar showing where today sits between creation and expiry.

What to weigh when a domain looks wrong:

• Age in days or weeks. A brand claiming to be a decade-old company on a two-week-old domain is the clearest contradiction you will get. Legitimate new domains exist, so this is a strong prior, not a verdict.
• Registered for exactly one year. Compare creation and expiry. Businesses that intend to stick around commonly register for multiple years; disposable domains are registered for the minimum.
• A recent update date on an old domain. An old creation date with an update from last week can mean an expired domain that was re-registered by someone new, which is a common way to inherit a clean reputation. The creation date alone will mislead you here.
• Nameservers that do not match the story. A supposed enterprise on free consumer DNS, or nameservers at a provider you can tie to other suspect domains.
• No transfer lock. Established owners lock their domains; hurriedly registered ones often are not.

None of this is proof. WHOIS gives you a set of facts that either fit the claimed story or do not, and the value is in the contradiction, not in any single field. After a lookup the tool offers one-click hand-offs to a DNS lookup, an SSL/TLS check, a security-headers scan, a certificate-transparency search and a domain risk check for the same domain, because the follow-up questions are almost always about DNS and certificates rather than registration.

How this lookup works, and its honest limits

The query runs on our server rather than in your browser, because port-43 WHOIS and RDAP cannot be reached from client-side JavaScript. That means the domain you type is sent to our API, which queries the upstream source and caches the result so repeated lookups of the same domain do not hammer the registries. Only the domain name goes out. Your recent-lookup list is a separate thing: it is kept in your browser's local storage and never leaves your device, and you can clear it by clearing site data.

Other things worth knowing before you rely on a result:

• Cached results can be slightly stale. If you have just changed nameservers or completed a transfer, a cached answer may show the previous state for a while.
• DNSSEC and registrant may show as unknown on a cached hit. Those two fields are not stored in the cache, so a cached response reports them as unavailable rather than guessing.
• "Not registered" is a soft answer. If the upstream sources do not return a record, the tool reports the domain as unregistered. For an obscure ccTLD that can also mean the registry simply does not answer public queries.
• WHOIS says nothing about content. The record describes the registration, not the website. A perfectly clean record sits behind plenty of compromised sites, because the attacker took over hosting rather than the domain.
• Registration data is not identity. Even in the pre-redaction era the fields were self-declared and frequently false.

Results export as JSON, CSV or plain text, which is the fastest way to attach a lookup to a ticket or an incident write-up, and the domain is encoded into the page URL so you can share or bookmark a specific lookup and have it re-run on load.