WHOIS Explained: How to Look Up Who Owns a Domain

A WHOIS lookup queries the public registration record behind a domain name. It tells you which registrar manages the domain, when it was created and when it expires, which name servers it uses, and, when the data is not redacted, who registered it. Think of it as the registration certificate for a domain, queryable by anyone.

WHOIS is one half of how you identify a domain. The other half is its DNS records, which describe where the domain points rather than who owns it. This guide covers what WHOIS returns and how to read it; the linked splinters below go deep on each common task.

You can run a parsed WHOIS lookup on any domain with our WHOIS tool, which turns the raw record into clean, labelled fields.

What a WHOIS record contains

WHOIS is a simple query-and-response protocol, originally standardised in RFC 3912. A typical record breaks down into a few groups of fields.

Field group	Examples	What it tells you
Registrar	Registrar name, IANA ID, abuse contact	Which company manages the registration
Dates	Created, Updated, Expires	Domain age and renewal deadline
Status	clientTransferProhibited, etc.	Locks and protections on the domain
Name servers	ns1.example.com	Which DNS servers are authoritative
Registrant	Name, org, country, email	Who registered it (often redacted)

The registrar and date fields are reliable because they come from the registry that operates the top-level domain. The contact fields are a different story, which is where redaction comes in.

Why so much WHOIS data is now hidden

If you ran a WHOIS lookup before 2018 you would usually see the registrant's name, address, email, and phone number. Today most of that is replaced with redaction notices. The change came from the EU's General Data Protection Regulation, which led ICANN to adopt a Temporary Specification (now the Registration Data Policy) requiring registrars to hide personal data by default.

The practical effect: you can still see the registrar, dates, status and name servers for almost any domain, but the human behind it is usually masked. Two related guides cover this in detail, WHOIS privacy explained (the opt-in service) and why WHOIS data is redacted (the legal default).

How a WHOIS lookup actually works

Knowing the mechanics explains most of the odd behaviour you will run into.

WHOIS is deliberately primitive. A client opens a TCP connection on port 43, sends the domain name followed by a newline, and reads back whatever text the server chooses to return. There is no authentication, no structure, and no schema. RFC 3912 is barely four pages long and explicitly notes the protocol's lack of security and internationalisation.

The part that surprises people is that there is no single WHOIS server. A complete lookup is usually two queries:

1. Ask IANA or the registry. Each top-level domain has its own registry (Verisign for .com, PIR for .org, and so on). The registry holds the authoritative record and returns a thin response for many gTLDs: the registrar, the dates, the status codes, the name servers, and a pointer to the registrar's own WHOIS server.
2. Ask that registrar. The registrar holds the thick data, including whatever contact information exists.

This thin-versus-thick split is why two WHOIS tools can show different results for the same domain, and why a lookup sometimes returns almost nothing useful. Country-code TLDs make it messier still, because each registry sets its own policy: some publish freely, some require a web form, some rate-limit aggressively, and a few (.de among them) return only a minimal stub over port 43.

Rate limiting is the other thing to expect. Registries throttle by IP, and the limits are low enough that a loop of a few dozen lookups will start returning errors or empty responses rather than data. If you need volume, RDAP over HTTPS is the supported path.

Reading the status codes

The Domain Status field is the most useful part of a WHOIS record that most people skip. Those codes are EPP status codes, standardised by ICANN, and they tell you what can and cannot currently happen to the domain.

Status	Meaning
ok / active	No restrictions. Perversely, this is the weakest state, since nothing is locked
clientTransferProhibited	Registrar lock is on, blocking transfers. Normal and desirable
clientDeleteProhibited / clientUpdateProhibited	Further locks against deletion or modification
serverTransferProhibited	Set by the registry rather than the registrar, often for a dispute or legal hold
pendingTransfer	A transfer to another registrar is in progress
pendingDelete	Deletion is under way. The name will be released shortly
redemptionPeriod	Expired and deleted, but still recoverable by the owner for a fee
autoRenewPeriod	Just renewed automatically, inside the window where it could be reversed
inactive	No name servers are set, so the domain resolves nowhere

The client prefix means the registrar set it; server means the registry did, and those are much harder to lift. A domain showing redemptionPeriod is not available to register no matter what a marketplace tells you: it is in a grace window, typically around 30 days, during which only the original registrant can restore it.

What WHOIS will not tell you

Setting expectations here saves a lot of wasted effort.

• Who owns it, usually. Redaction is the default, not the exception, for the reasons below.
• Whether the site is legitimate. WHOIS is registration data. A phishing domain has a perfectly ordinary WHOIS record.
• Who is hosting it. WHOIS gives you name servers, which hint at the DNS provider, but the actual web host comes from resolving the A record and looking up the IP.
• The real registration date, for a transferred domain. The creation date survives registrar transfers, but some records show an updated date that reflects the transfer rather than the original registration.
• Anything about subdomains. Registration happens at the domain level. Subdomains are a DNS concern, not a registry one.

Common things people use WHOIS for

• Finding the owner of a domain. Even with redaction there are still ways to make contact. See how to find who owns a domain.
• Checking how old a domain is. The creation date is a strong trust and SEO signal. See how to check a domain's age.
• Finding when a domain expires. Useful for acquisitions and for catching your own renewals. See how to find a domain's expiration date.
• Reading the raw record. The fields and their abbreviations can be cryptic. See how to read a WHOIS record.

Registrar, registrant, registry: not the same thing

WHOIS records reference several parties and they are easy to confuse. The registry operates the top-level domain, the registrar sells and manages registrations, and the registrant is the person or organisation that holds the domain. The distinction matters when you need to file a complaint or transfer a name. We untangle it in registrar vs registrant vs registry.

WHOIS is being replaced by RDAP

The classic WHOIS protocol returns unstructured text, which is awkward to parse and inconsistent across registrars. Its successor, RDAP, returns structured JSON and supports access control and internationalisation. ICANN has set RDAP as the standard for gTLD registration data. If you work with this data programmatically, read WHOIS vs RDAP.

Whichever protocol you use, the goal is the same: turn a domain name into a clear picture of who registered it, through whom, and when. Run a lookup on any domain with our WHOIS tool, or have an AI agent fetch it through the whois_lookup tool in our MCP server.