WHOIS Lookup

A WHOIS lookup shows the public registration record of a domain name: which registrar manages it, how to report abuse, when it was created, last changed and when it expires, which status codes are set, which nameservers it uses and whether DNSSEC is switched on. Our tool reads that record straight from the registry for the extension, using RDAP where the registry offers it and classic WHOIS where it does not, then explains every field in plain English and shows the raw record underneath.

How to use the WHOIS lookup

1. 1 Enter the domainType a domain such as example.com, paste a full web address, or enter an internationalised name. Subdomains are fine: the tool works back to the registered domain.
2. 2 Run the lookupSign in to your free account and start the lookup. We find the registry for the extension through IANA and request the record.
3. 3 Read the recordCheck the registrar, abuse contact, dates and nameservers. Every status code is listed with what it means, and anything that takes the domain offline is highlighted.
4. 4 Open the raw record if you need itExpand the raw RDAP JSON or WHOIS text at the bottom to see exactly what the registry returned, for example to quote it in a support ticket.

What a WHOIS lookup shows

Every domain name is registered through a registrar, and the registration is recorded by the registry that runs the extension: Verisign for .com and .net, Public Interest Registry for .org, Nominet for .uk, and hundreds of other operators for country codes and newer extensions. A WHOIS lookup reads that record. It is the quickest way to answer practical questions such as who to contact about abuse coming from a domain, which company you need to log in to in order to renew your own name, or whether a domain you want is already taken.

This tool presents the record in sections. The domain section shows the name in its ASCII form and, for internationalised names, its Unicode form, together with the RDAP or WHOIS server that answered. The registrar section gives the registrar name, its IANA Registrar ID when the registry publishes one, its website and the abuse email address and phone number. The dates section shows when the name was created, last updated and when the current registration expires, with a count of days to expiry. After that come the status codes, nameservers, DNSSEC state, any registrant details that are actually published, and the raw record.

If you mainly want to know how old a domain is and whether it is close to expiry or missing a transfer lock, our Domain Age Checker gives that verdict in a few rows. The WHOIS lookup is the fuller view: the complete record, every field explained, for research, support and troubleshooting.

WHOIS and RDAP: where the data comes from

WHOIS is a decades-old protocol that returns plain text over port 43, in a different layout for almost every registry. RDAP, the Registration Data Access Protocol, was standardised by the IETF as its replacement. It returns structured JSON over HTTPS, uses consistent field names, and has a defined way to mark which fields have been redacted. ICANN now treats RDAP as the authoritative source of registration data for generic top-level domains, and many country-code registries run it too.

When you run a lookup, the tool checks the list IANA publishes of RDAP servers for each extension and asks the right registry for the domain. Because it cannot always tell where the registrable part of a name starts, as in shop.example.co.uk, it asks for the longest name first and drops labels from the left until the registry recognises one. Where an extension has no RDAP service, the tool asks IANA which WHOIS server is responsible and queries that instead. Classic WHOIS output has no standard format, so a few fields may be missing for those registries, and the raw text is always shown so nothing is hidden.

Generic registries such as .com and .net keep a thin record that holds the registrar, dates, status and nameservers, while contact details stay with the registrar. When the registry links to the registrar's own RDAP record, the result includes that link.

Domain status codes explained

Status codes come from EPP, the protocol registrars use to talk to registries. A domain usually carries several at once, and they are set either by the registrar (codes starting with client) or by the registry (codes starting with server). ICANN keeps a public page that explains every EPP status code, and each code in the result links to its entry there. The most common ones are:

• ok or active: the normal state, with nothing pending and no restrictions.
• clientTransferProhibited: the registrar lock. The domain cannot be moved to another registrar until the owner removes it. This is a sensible default for most domains.
• clientUpdateProhibited and clientDeleteProhibited: the registrar refuses changes or deletion, often as part of a stronger lock.
• serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited: the same locks applied by the registry, either as a paid registry lock service or temporarily after a registration or transfer.
• clientHold and serverHold: the domain has been removed from DNS, so the website and email stop working. A registrar hold often follows non-payment or unverified contact details; a registry hold usually follows a legal or abuse action.
• autoRenewPeriod, renewPeriod, addPeriod and transferPeriod: short grace periods after an automatic renewal, a manual renewal, a new registration or a transfer.
• redemptionPeriod: the registration has expired and been deleted by the registrar, but the owner can still restore it for a limited time, usually for a substantial fee.
• pendingDelete: the domain is about to be released and can no longer be restored or renewed.
• pendingTransfer: a transfer to another registrar is in progress.

Why owner details are usually hidden

Before 2018, public WHOIS records commonly listed the registrant's name, postal address, email and phone number. When the European Union's General Data Protection Regulation took effect, registries and registrars began redacting personal data from public records, and ICANN changed its rules so that generic registries and registrars could do so worldwide. Many owners also use a privacy or proxy service, which replaces their details with those of the service.

As a result, most lookups show the registrar and an abuse contact but not the owner. Some registries still publish an organization name or country for business registrations, and the tool shows any field that carries real data, while ignoring placeholders such as REDACTED FOR PRIVACY. When an RDAP server lists which fields it has redacted, the tool names them so you know the gap is deliberate.

If you need to reach an owner, the registrar is the right route: many offer a contact form or a forwarding address. For legitimate needs that require the non-public data itself, such as a legal claim, ICANN runs the Registration Data Request Service (RDRS), which passes requests about generic domains to the participating registrar. The registrar decides whether to disclose, under its own policies and the law that applies to it. Country-code registries have their own disclosure processes.

Reading dates, nameservers and DNSSEC

The created date is when the current registration began. It stays the same when a domain is renewed or transferred between registrars, but resets if the name expires, is deleted and is registered again. The last updated date changes whenever the record is modified, for example when nameservers or contacts change, and some registries also update it on renewal. The expiry date is when the current registration period ends at the registry; your registrar's control panel may show an earlier billing date.

Nameservers show where the domain's DNS is hosted. If they are not the provider you expect, find out why before changing anything: it may be a legitimate move by a developer, or a sign that someone has gained access to the registrar account. A domain with no nameservers at all does not resolve.

The DNSSEC row shows whether the registry holds signed delegation details for the domain, and whether a DS record is present. Signed means resolvers that validate DNSSEC can check that answers for the domain have not been tampered with. If the registry has a DS record but the DNS host has stopped signing the zone, validating resolvers will fail to resolve the domain, so a mismatch is worth checking with your DNS provider.

Unregistered names, errors and limitations

When the registry answers that it has no record of a name, the tool reports that it is most likely available. That is a strong hint, not a guarantee: registries reserve some names, sell others at premium prices, and block some for policy reasons. Always confirm availability at a registrar before you plan around a name.

A different message appears when the extension itself is the problem. If IANA does not list the top-level domain, the tool says so, which usually means a typo such as .cmo. If a registry publishes neither RDAP nor WHOIS, the extension is not covered. Registries also limit how many lookups they answer, and occasionally time out. In those cases the tool shows a short message and you can try again a minute later. Results are cached briefly, so repeating a lookup straight away returns the same answer rather than querying the registry again.

Finally, the record only reflects what the registry publishes. It does not show past owners, the price paid for a domain, or anything about the website itself. For DNS records use our DNS Lookup, and for a vetting summary of age, expiry and transfer protection use the Domain Age Checker.

Examples you can copy

curl -s -H "Accept: application/rdap+json" https://rdap.verisign.com/com/v1/domain/example.com
whois -h whois.iana.org pk
whois -h whois.pknic.net.pk example.pk

"entities": [{
  "roles": ["registrar"],
  "publicIds": [{ "type": "IANA Registrar ID", "identifier": "292" }],
  "vcardArray": ["vcard", [["fn", {}, "text", "Example Registrar, Inc."]]],
  "entities": [{
    "roles": ["abuse"],
    "vcardArray": ["vcard", [
      ["email", {}, "text", "abuse@registrar.example"],
      ["tel", {"type": "voice"}, "uri", "tel:+1.5555550100"]
    ]]
  }]
}]

RDAP:   "status": ["client transfer prohibited", "server hold"]
WHOIS:  Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
        Domain Status: serverHold https://icann.org/epp#serverHold

Common mistakes to avoid

Frequently asked questions