WHOIS Lookup

A WHOIS lookup retrieves registration data associated with a domain name or IP address. Depending on the registry, registrar, and privacy rules, the response may show the sponsoring registrar, registration dates, domain status codes, nameservers, and selected contact information. Personal details are often redacted.

What a WHOIS lookup shows

A typical result identifies the registrar that manages the domain and the registry that operates its top-level domain. It can include the creation date, last update date, expiration date, delegated nameservers, and status codes that restrict transfers, updates, renewals, or deletion.

Contact fields may identify the registrant, administrative contact, and technical contact. Privacy laws, registry policies, and proxy services frequently hide names, email addresses, phone numbers, and street addresses. Redaction does not mean the registrar lacks the data; it limits what the public directory discloses.

The response may also provide an abuse contact and a registrar referral URL. These details help users report phishing, malware, spam, trademark abuse, or other activity connected to the registration.

WHOIS and RDAP

WHOIS is an older text-based protocol. Its output format varies between servers, which makes automated interpretation difficult. It also lacks modern mechanisms for authentication, structured responses, internationalization, and differentiated access.

Registration Data Access Protocol, or RDAP, addresses many of those limitations. RDAP uses HTTPS and returns structured JSON data. It supports standardized queries, clearer referrals, internationalized data, and access controls that can provide different information to authorized users.

Many registries and registrars now treat RDAP as the primary source for generic top-level domain registration data. The ICANN RDAP information page explains the protocol and provides access to a lookup service. Users may still call either process a WHOIS lookup in everyday language.

Common reasons to perform a WHOIS lookup

Prospective buyers use registration data to check whether a domain appears registered, when it was created, and which registrar manages it. An unavailable domain may have public contact or brokerage information, although privacy protection often limits direct outreach.

Website owners use the records to confirm domain name status, nameserver delegation, renewal dates, and transfer restrictions. Security teams compare current data with historical records when investigating phishing, impersonation, malware, or an unauthorized registration change.

Support teams can identify the correct registrar before troubleshooting a transfer or renewal. The registrar shown in the authoritative registry record may differ from the hosting provider, website developer, or company that billed the customer for another service.

How to interpret domain status codes

Extensible Provisioning Protocol status codes describe restrictions applied by the registrar or registry. A clientTransferProhibited status usually means the registrar has locked the domain against transfer. A serverTransferProhibited status indicates a registry-level restriction.

Other codes can block updates, deletion, or renewal. PendingTransfer means a transfer request is in progress, while redemptionPeriod indicates that a deleted domain is in a recovery stage before final deletion. The exact response must be interpreted with the domain’s lifecycle and registry policy.

Status codes are operational signals, not proof of ownership or legitimacy. A locked domain can still host malicious content, and an active registration can still have incorrect contact data.

Limitations of WHOIS data

Public registration data may be incomplete, redacted, outdated, or protected by a proxy service. Expiration dates can also be misunderstood because registry auto-renewal processes may temporarily extend a date even when the registrant has not completed payment with the registrar.

A result does not show who controls the website’s hosting account, content management system, email service, or DNS provider. Nameservers can suggest the DNS operator, but they do not establish legal ownership or identify every service behind the domain.

Availability checks should use a registrar or registry service designed for registration attempts. A lookup response can lag behind a lifecycle change, and some top-level domains apply reservation, premium-name, or eligibility rules that affect whether a name can be registered.

How to run an accurate WHOIS lookup

Use an ICANN, registry, or reputable registrar lookup service. Enter the complete domain without a path, protocol, or email address. For internationalized domains, confirm whether the tool expects the Unicode form or its ASCII-compatible encoding.

Compare the response with the relevant registry when accuracy matters. Follow referral links rather than relying on a third-party database that may cache older results. Record the lookup time because registration details can change after transfers, renewals, contact updates, or security incidents.

Treat personal data responsibly. Registration information should support legitimate technical, legal, or security work, not unsolicited marketing, harassment, or identity profiling.