WHOIS lookup: what a domain record tells you

What a WHOIS record contains

WHOIS is both a protocol and the set of databases it queries. Every registry keeps a record for the domains it manages, and every accredited registrar keeps its own copy of what it sold. The protocol dates back to the early 1980s, which is why the output still reads like a printed form rather than an API response. A typical record carries:

• Registrar: the company the domain was registered through, sometimes with its own WHOIS server address.
• Creation date: when the domain was first registered. A useful proxy for how established a site is.
• Registry expiry date: when the current registration period ends. Usually the single most important field.
• Updated date: the last time any detail on the record changed.
• Domain status: one or more codes describing the domain's current state.
• Name servers: the authoritative DNS servers the domain currently points to.
• Registrant, admin and technical contacts: name, organization, email and phone, where they have not been redacted.
• DNSSEC: whether the domain is signed.
• Abuse contact: where to report phishing, spam or other misuse tied to the domain.

Registries differ in how much they publish themselves. A "thin" registry holds only the registrar and a few dates and expects the registrar to answer for the rest; a "thick" registry holds the full record centrally. A good lookup tool follows the referral automatically so you do not have to.

How to run a lookup

The quick way is a web-based WHOIS tool: type the domain, read the formatted result. From a terminal, if a client is installed:

whois example.com
whois -h whois.verisign-grs.com example.com   # query a specific registry server

Most operating systems no longer ship a whois client by default, which is part of why the web tools exist. Note that you query a domain here. Running whois against an IP address asks a completely different database, a regional internet registry, and returns the network owner instead. Both are useful, but they answer different questions.

Reading expiry, registrar and nameservers

Three fields carry most of the practical value, and two of them are routinely misread.

Expiry. The registry expiry date is when the current registration period ends, not when the domain becomes available to someone else. After expiry most registrars run a grace period during which the original owner can still renew, followed by a redemption period with a higher fee, followed by deletion. Domains that people describe as "dropping" are weeks past the date on the record.

Status codes. These look alarming and usually are not. Codes like clientTransferProhibited are protective locks that stop an unauthorized transfer, and a healthy domain often carries several at once. The ones worth taking seriously are serverHold, which generally means the registry itself has suspended the domain over a policy or abuse issue, and pendingDelete, which means the deletion process has started. Anything with a client prefix was set by the registrar. Anything with a server prefix was set by the registry, and is harder to undo.

Nameservers. These are the domain's authoritative DNS servers, not the address of the web host. A domain can use one company's DNS while its content sits on an entirely different provider, so read the line as "who answers DNS queries for this domain".

Why the contact fields are hidden, and what you can still learn

Look up almost any domain today and the registrant, admin and technical contacts will point at a privacy or proxy service rather than a real name and address. That is policy, not a broken tool. Since the GDPR took effect in 2018, registrars have stopped publishing personal registrant data in the open response by default, and most apply the same redaction worldwide rather than running different rules per region. What you get instead is typically the registrar's proxy contact plus a web form or forwarding address that still reaches the real registrant.

The trade-off is real. It keeps individuals' home addresses off the open internet, and it also makes WHOIS a weaker investigative tool than it once was, because a legitimate researcher and a spammer receive the same redacted response. Some registrars operate a formal disclosure process for requests with a legitimate interest, though a reply is not guaranteed. Organization-registered domains are more often still visible than personally registered ones.

So the record will still tell you when a domain was registered and when it expires, who the registrar is, who runs its DNS, whether it is locked or suspended, and where to send an abuse report. It will usually not give you a personal name, email or address for the owner, and it will not identify the web host, which lives in the IP's record rather than the domain's, or show any history of past owners. A redacted record is not in itself suspicious. It is the default for nearly every domain now.

RDAP, the successor to WHOIS

RDAP, the Registration Data Access Protocol, is the IETF-standardized replacement. Instead of a loosely formatted text block whose layout varies by registry, RDAP returns structured JSON over HTTPS, which software can parse reliably. It was also designed for differentiated access from the start, so a registry can in principle return more detail to an authenticated requester with a legitimate need than to an anonymous one. Registries and registrars have been required to run RDAP services alongside WHOIS for years, and the ecosystem is steadily moving across. Most lookup tools now query RDAP first and fall back to classic WHOIS, so the record you read may already be RDAP data presented in the familiar layout.

Watching the expiry date

A lookup is a snapshot. The field that hurts when you miss it, the expiry date, matters on one specific day, and an expired domain takes down a website, its email and anything else that depends on the name at the same time. Scheduled monitoring re-runs the lookup for you and warns ahead of the expiry date, and it can watch for nameserver changes too, which is one of the earliest signs of an unauthorized transfer. The WHOIS check runs a lookup now. For the host rather than the registrar, the answer sits in the IP's record: how to find who hosts a website.