Every registered domain name on the internet has a publicly accessible record stored in the WHOIS database. This record contains essential information about who owns the domain, when it was registered, when it expires, and which registrar manages it. Whether you're researching a competitor, investigating a suspicious website, checking domain availability, or monitoring your own domain portfolio, WHOIS lookup is an indispensable tool for anyone working with domains and websites.
Try Our Free WHOIS Lookup Tool →WHOIS is a query and response protocol dating back to the early 1980s — making it one of the oldest internet protocols still in active use. Originally designed as a simple directory service for ARPANET users, it evolved into the standard method for querying domain registration information across all top-level domains (TLDs).
When you perform a WHOIS lookup, you're sending a query to a WHOIS server operated by the domain's registry or registrar. The server responds with a structured text record containing all available registration data for that domain. The protocol operates on TCP port 43, though modern web-based tools handle the connection for you behind the scenes.
A typical WHOIS response contains several key fields, each providing different information about the domain:
Status codes are critical for understanding a domain's current state. Here are the most common ones you'll encounter:
| Status Code | Meaning |
|---|---|
ok | No special restrictions. Domain can be transferred, modified, and deleted normally. |
clientTransferProhibited | The registrant has locked the domain to prevent unauthorized transfers. This is a security best practice. |
clientDeleteProhibited | The domain is locked against deletion, protecting it from accidental or malicious removal. |
clientUpdateProhibited | Changes to the domain's registrant contact information are restricted. |
serverHold | The registry has suspended the domain. The domain won't resolve in DNS. Often due to compliance issues or disputes. |
pendingDelete | The domain is in the deletion process. It will be removed from the registry after a 5-day waiting period. |
inactive | The domain has no nameservers delegated to it. It won't resolve in DNS even though it's registered. |
autoRenewPeriod | The domain is in its auto-renew grace period after the expiration date. The registrar may still renew it. |
Before May 2018, WHOIS records were largely public — you could find a domain owner's name, email address, phone number, and physical address with a simple query. The European Union's General Data Protection Regulation (GDPR) changed this dramatically. ICANN issued a Temporary Specification that required registrars to redact personal data from WHOIS output.
Today, when you perform a WHOIS lookup, you'll commonly see:
This doesn't mean the data is gone — it's still stored by registrars. Authorized parties (law enforcement, trademark holders with UDRP claims, and cybersecurity researchers with legitimate purposes) can request access through various channels. Some registrars offer a WHOIS Privacy service that replaces personal data with proxy contact information, providing an additional layer of protection.
Before launching a business or product, check WHOIS records for competing domains. You can see when competitors registered their domains, who their registrar is, and whether their domains are set to auto-renew. This intelligence helps with competitive analysis and brand protection strategy.
If a domain you want is already registered, WHOIS lookup helps you find the owner. Even with privacy protection, the registrar is visible. You can often reach the owner through the registrar's contact form or by using a domain brokerage service. Checking the expiration date also tells you if the domain might become available soon.
Security professionals use WHOIS to investigate phishing sites, scam websites, and malicious domains. A domain registered yesterday with privacy protection and hosted on a free hosting service is a strong red flag. WHOIS data helps build a threat profile and identify patterns across multiple malicious domains.
Regularly check WHOIS records for your domains to ensure nothing has changed unexpectedly. Verify that your contact information is accurate, your nameservers are correct, and no unauthorized status codes have been added. Set calendar reminders to check 60 days before expiration to avoid accidental domain loss.
Brand owners use WHOIS to identify cybersquatters — people who register domains containing trademarks in bad faith. WHOIS data provides evidence for UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaints filed with WIPO or other dispute resolution providers.
Understanding the domain lifecycle helps you make strategic decisions based on WHOIS data:
RDAP (Registration Data Access Protocol) is ICANN's designated replacement for WHOIS. While WHOIS uses plain text over an unencrypted protocol, RDAP delivers structured JSON data over HTTPS. Key advantages of RDAP include:
Most modern WHOIS lookup tools now query RDAP servers under the hood while presenting results in a familiar format. The transition is ongoing, with full RDAP adoption mandated by ICANN's latest registration data policy.
For developers and sysadmins, WHOIS queries can be run directly from the terminal:
A WHOIS lookup is a query to the public registration database for domain names. It returns details about who registered a domain, when it was created, when it expires, which registrar manages it, and the domain's current status. WHOIS has been a core internet protocol since the 1980s and remains the primary way to access domain registration information.
Since GDPR took effect in 2018, most personal information in WHOIS records has been redacted. You'll typically see "REDACTED FOR PRIVACY" instead of the registrant's name, email, and phone. However, administrative data like registration dates, expiration dates, nameservers, and domain status codes remain visible. Authorized parties can still access full data through specific legal channels.
Perform a WHOIS lookup and look for the "Registry Expiry Date" field. This shows the exact date and time when the current registration ends. If the owner doesn't renew, the domain enters a grace period (up to 45 days), then a redemption period (30 days with high recovery fees), and eventually becomes available for anyone to register.
Domain status codes (EPP status codes) indicate the current state and restrictions on a domain. "clientTransferProhibited" means the domain is locked against transfers. "serverHold" means the registry has suspended it. "pendingDelete" means it's being removed. "ok" means no restrictions. Multiple status codes can apply simultaneously.
Yes. If a WHOIS query returns "No match" or "Domain not found," the domain is likely available. However, some recently expired domains may still show as registered during their grace or redemption periods. For definitive availability checking, always verify with a domain registrar, as WHOIS data can have slight propagation delays.
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It uses JSON format over HTTPS instead of plain text over TCP port 43. RDAP provides structured, machine-readable data, built-in authentication, tiered access control for privacy compliance, and standardized error handling. Most modern tools use RDAP behind the scenes while displaying results in a user-friendly format.