WHOIS Lookup, Explained
After reading this you will know what a WHOIS record holds, how to read registrar, dates, status codes and nameservers, and where the answers stop because of privacy redaction.
What WHOIS is and one quick example
WHOIS is a plain text lookup protocol. You send a domain name to a server on TCP port 43, and the server sends back a text record describing who registered that domain, when, through which registrar, and where it points. The protocol is old and simple. It predates the web and was standardized in RFC 3912 (2004), which is barely four pages long and defines almost nothing beyond "connect, send a line, read the reply".
Type example.com into the tool and you get back a block of text. Near the top you see the registrar (IANA, for this reserved demo domain), the creation date 1995-08-14, an expiry date, and a set of nameservers like a.iana-servers.net. That single query answers three practical questions at once: who controls the domain, when it expires, and which DNS servers are authoritative for it.
The lookup runs on the server side because browsers cannot open raw TCP sockets. A page loaded over HTTPS speaks HTTP, not port 43. The tool relays your one domain to the correct WHOIS server and returns the text.
When to use it and when not
Reach for WHOIS when you need registration facts: is this domain about to expire, who is the registrar you would contact to recover it, when was it first registered (a domain created three days ago behaves differently in spam filters than one created in 2003), and is it locked against transfer.
Do not use WHOIS to answer "where does this domain resolve right now". That is a DNS question, and the nameservers listed in WHOIS are only the delegation, not the live records. For A, AAAA, MX and TXT records use the DNS Lookup tool instead. WHOIS tells you which nameservers are in charge; DNS tells you what those servers currently answer.
Also do not expect WHOIS to reveal a human name and address for most domains today. Since the GDPR took effect in May 2018, registrars redact personal contact fields for the vast majority of records. You will still see the registrar and the dates, but the registrant name is usually a placeholder like REDACTED FOR PRIVACY.
How the query actually works
There is no formula here, but there is a lookup chain worth understanding, because it explains why some answers are thin and others are complete. WHOIS is hierarchical, and a full answer often needs two hops.
The first hop goes to the registry for the top level domain (TLD). For .com that is Verisign, whose server whois.verisign-grs.com knows the sponsoring registrar, the status codes and the nameservers, but often not the full record. The registry reply names a registrar WHOIS server. A second query to that registrar returns the richer per domain detail. This tool follows that referral for you when the registry provides one.
The whole exchange is one request line and one reply per hop. You send the domain followed by carriage return and line feed (\r\n), the server streams back text, then closes the connection. There is no authentication, no query language, no pagination.
Reproducing the demo: example.com
Click the demo button, which fills the field with {"domain": "example.com"}, and run the lookup. Here is what happens step by step.
- The tool determines the TLD is
.comand connects towhois.verisign-grs.comon port 43. - It sends the line
example.com\r\nand reads the reply. - The reply reports the creation date
1995-08-14, the most recent update, and the expiry date. It also lists status codes and nameservers. - Because
example.comis an IANA reserved domain used for documentation (RFC 2606), the registrar shown is IANA itself, and the contact fields are institutional rather than redacted.
The parsed panel groups these into registrar, dates, status and nameservers, while the raw panel shows the untouched server text. When a field looks wrong in the parsed view, check the raw text: WHOIS output is not standardized across registries, so parsers occasionally mislabel a line.
Reading the record field by field
A typical .com record has these fields. The labels vary by registry, but the meanings are stable.
- Registrar
- The company that manages the registration. This is who you contact for transfers, renewals or disputes, not the registry.
- Creation Date
- When the domain was first registered. A very recent date is a mild risk signal for phishing and spam.
- Registry Expiry Date
- When the current registration term ends. After this the domain enters a grace and redemption sequence before it drops.
- Updated Date
- The last time any registry field changed, including nameserver edits or status changes.
- Name Server
- The authoritative DNS servers for the domain. Usually two to four entries.
- Domain Status
- EPP status codes that describe locks and pending operations. See the next section.
Status codes are the part people misread
The status field uses EPP (Extensible Provisioning Protocol) status codes, defined in RFC 5731 and documented by ICANN. They look alarming but usually mean the domain is healthy and locked against accidental change. The table below covers the ones you will see most.
| Status | Set by | Meaning |
|---|---|---|
| clientTransferProhibited | Registrar | Transfers to another registrar are blocked. Normal and good. |
| clientDeleteProhibited | Registrar | The domain cannot be deleted. Normal protection. |
| serverHold | Registry | The domain is removed from the zone and will not resolve. A real problem. |
| pendingDelete | Registry | The domain is scheduled to be released. It expired and was not renewed. |
| redemptionPeriod | Registry | Expired, but the original owner can still recover it, usually for a fee. |
| ok | Registry | No restrictions set. Rare for active production domains. |
Codes that start with client are set by the registrar and can be lifted by you through your account. Codes that start with server are set by the registry and need registrar or registry action. That prefix tells you who holds the key.
The expiry timeline, with real dates
The single most useful number in a WHOIS record is the expiry date, so it is worth knowing what happens after it passes. The exact windows are ICANN policy for gTLDs, and they are generous by design so that an accidental lapse can be fixed.
Suppose a .com domain shows Registry Expiry Date: 2024-06-01 and it is not renewed. The stages run roughly like this:
So a domain that expired on 2024-06-01 is typically recoverable by the original owner until around 2024-07-31, drops near 2024-08-05, and could be registered by someone else the same day. If you rely on a domain, do not wait for the expiry date. Renew well before it.
Common mistakes
Four errors account for most confusion when reading WHOIS output.
- Typing a URL instead of a domain. Send
example.com, nothttps://example.com/path. The protocol accepts only the domain label. Strip the scheme, the path and any port. - Querying a subdomain. WHOIS registrations exist at the registered domain level. Looking up
blog.example.comwill not return a record; queryexample.com. - Reading redacted contact fields as empty. A missing registrant name does not mean the domain is unowned. It means GDPR redaction hid the field. The registrar and dates are the reliable signals.
- Expecting a WHOIS answer for a new TLD. Many recent TLDs answer over RDAP (Registration Data Access Protocol, RFC 7480), a JSON over HTTPS successor, and may return nothing useful on port 43. This tool queries classic WHOIS, so sparse results on a brand new TLD are expected.
Related tools
WHOIS is one piece of investigating a domain. Once you have the nameservers, resolve the live records with the DNS Lookup tool. If the domain serves HTTPS, inspect its certificate chain with the SSL Certificate Decoder to confirm the issuer and validity dates. When your investigation moves from names to addresses, the Subnet / CIDR Calculator breaks an IP range into network, broadcast and host bounds, and the MAC Address Lookup identifies hardware vendors on a local network.
Frequently asked questions
Why is the WHOIS record mostly redacted?
Since May 2018, ICANN policy under the GDPR requires registrars to hide personal contact fields by default. Registrar, creation and expiry dates, status codes and nameservers stay visible. To reach a redacted registrant you generally go through the registrar's abuse or legal contact.
What is the difference between WHOIS and RDAP?
WHOIS returns free form text over TCP port 43 and has no fixed schema. RDAP returns structured JSON over HTTPS and is the modern replacement, defined in RFC 7480 and following. Many new TLDs answer only over RDAP. This tool queries classic WHOIS.
Does a WHOIS lookup change or notify the domain owner?
No. A WHOIS query is a read only request to the registry or registrar server. The owner is not notified, and nothing about the domain changes.
The nameservers in WHOIS differ from what the site actually uses. Why?
WHOIS shows the delegation recorded at the registry, which changes only when someone edits it at the registrar. The live DNS records can point anywhere those nameservers are configured to answer. Use the DNS Lookup tool to see the current resolved values.
Can I look up an IP address instead of a domain?
IP WHOIS exists but is served by the regional internet registries (ARIN, RIPE, APNIC and others), not by domain registries. This tool is built for domain names. It queries the TLD registry, so a bare IP will not return a useful domain record.
Related tools
Subnet / CIDR Calculator
Network, broadcast, host range and mask from CIDR notation.
Chmod Calculator
Octal ↔ symbolic Unix permissions, with checkboxes.
DNS Lookup
A, AAAA, MX, TXT, NS, CNAME records via DNS-over-HTTPS.
SSL Certificate Decoder
Paste a PEM certificate, see subject, issuer, SANs, validity.
MAC Address Lookup
Vendor (OUI) lookup plus the meaning of every MAC bit.
Base64 / URL / HTML Encoder-Decoder
Encode and decode Base64, hex, URL percent-encoding and HTML entities — with auto-detect, bulk lines and file drop.