WHOIS Lookup Guide: Find Who Owns a Domain & Read the Record

What Is a WHOIS Lookup?

A WHOIS lookup is a query to the public registration database for a domain name. Every domain under a generic top-level domain such as .com, .net or .org must have a record kept by its registry and registrar, and anyone can read the public part of that record. The lookup returns who the registrar is, when the domain was created, when it expires, which nameservers it uses, and a set of status codes that say whether it is locked, on hold or about to be deleted.

The name comes from the original Unix command. In 1982, RFC 812 described the ARPANET's NICNAME/WHOIS service on TCP port 43, queried by typing whois followed by a name; RFC 3912 is the current specification of that plain-text protocol. The word stuck even though the protocol underneath has changed: since 28 January 2025, ICANN no longer requires gTLD registries and registrars to run port-43 WHOIS (except for .com, .name and .post), and the same data is served over RDAP, a JSON API. Most tools, including DNS Robot's WHOIS Lookup, query RDAP first and still call the result a WHOIS record.

One thing a WHOIS lookup usually does not return any more is the owner's name, address and email. Since GDPR took effect in May 2018, registrars redact personal contact data by default worldwide. The rest of this guide shows you what is still there, how to read it, and how to reach an owner when the contact fields say REDACTED FOR PRIVACY.

What a WHOIS Record Contains

Here is a real registry record for example.com, fetched on 27 October 2026 with the whois command on macOS. Every gTLD record has the same shape, so once you can read this one you can read any of them:

Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2026-08-14T08:01:43Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2027-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority
Registrar IANA ID: 376
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Name Server: ELLIOTT.NS.CLOUDFLARE.COM
Name Server: HERA.NS.CLOUDFLARE.COM
DNSSEC: signedDelegation
DNSSEC DS Data: 2371 13 2 C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A
>>> Last update of whois database: 2026-10-26T19:13:27Z <<<

The record splits into five groups, and each answers a different question:

• Identity — Domain Name and Registry Domain ID. The ID is the registry's internal key and never changes, even when the domain changes hands.
• Registrar — the company the owner pays. Registrar IANA ID is the registrar's unique number in the IANA registrar list; Registrar WHOIS Server is where the contact fields live, because for .com and .net the registry itself stores no contacts.
• Dates — Creation Date, Updated Date and Registry Expiry Date. All three are UTC. Creation date is what a domain age checker reports.
• Status — one or more EPP status codes. These are the most useful and the most misread part of the record; they get their own section below.
• Delegation — the nameservers and DNSSEC flag. This is the bridge between WHOIS and DNS: change the nameservers here and every DNS record for the domain moves with them.

How to Do a WHOIS Lookup

There are three ways to run a lookup, and they return the same underlying data. Pick by how often you need it and whether you want raw output.

Method 1: Use an Online WHOIS Tool

Open DNS Robot's WHOIS Lookup, type a domain (a pasted URL or email address works too: it's read as the registered domain) and press Enter. The tool asks the registry's own RDAP server (from IANA's list, plus registries such as DENIC that run RDAP outside it), then the registrar's record for the contact fields; for TLDs with no RDAP, which is about two in three country codes (.jp, .ru, .it and .eu among them), it asks the registry's port-43 server instead. You get the registrar with its abuse contact, creation, update and expiry dates, status codes with plain-English meanings, nameservers, DNSSEC state, and how old the domain is.

ICANN Lookup is the official alternative. It is authoritative for every gTLD but covers only the country-code domains whose registry runs RDAP, and it has no history, no bulk mode and no links to DNS data. Registrar sites such as GoDaddy and Namecheap also offer WHOIS pages that read the same public records; they work, but they are built to sell you the domain if it is free.

Method 2: The whois Command (macOS, Linux, Windows)

macOS ships a whois client, and Linux distributions package one. It talks port-43 WHOIS, follows the referrals to the registrar automatically, and prints each record back to back (macOS starts at IANA, so you get three):

# Basic lookup (follows registry -> registrar referral)
whois example.com

# Query one specific server and skip the referral
whois -h whois.verisign-grs.com example.com

# Only the lines you usually care about
whois example.com | grep -iE 'Registrar:|Creation Date|Expiry|Domain Status|Name Server'

# Debian/Ubuntu: install if missing
sudo apt install whois

Windows has no built-in whois. The two clean options are Microsoft's own Sysinternals tool and querying RDAP with the curl that ships with Windows 10 and 11:

Windows: Sysinternals whois or curl

Download whois.exe from the Sysinternals suite and put it on your PATH. -v follows the referral to the registrar, and a specific server goes after the domain (whois example.com whois.verisign-grs.com) rather than after -h. If you would rather not install anything, ask the RDAP server directly and let PowerShell format the JSON:

# Sysinternals whois (after download)
whois -v example.com

# No install: query RDAP and pretty-print the JSON
curl.exe -sL -H "Accept: application/rdap+json" https://rdap.org/domain/example.com | ConvertFrom-Json | Select-Object ldhName, status, events, nameservers

Method 3: Query RDAP Directly (for Scripts)

If you need WHOIS data in a script, skip the text format and call RDAP. The response is JSON with a fixed schema, so you can extract fields without regex. The registry for .com answers at rdap.verisign.com; for any other TLD, rdap.org looks up the right server from the IANA bootstrap file and redirects you:

# Registry record for a .com, straight from Verisign
curl -s -H 'Accept: application/rdap+json' \
  https://rdap.verisign.com/com/v1/domain/example.com | jq '{status, events, nameservers: [.nameservers[].ldhName]}'

# Any TLD: let rdap.org find the authoritative server
curl -sL https://rdap.org/domain/example.org | jq '.events'

# Output of the first command (trimmed: Verisign also returns a "last update of RDAP database" event)
{
  "status": ["client delete prohibited", "client transfer prohibited", "client update prohibited"],
  "events": [
    { "eventAction": "registration", "eventDate": "1995-08-14T04:00:00Z" },
    { "eventAction": "expiration",   "eventDate": "2027-08-13T04:00:00Z" },
    { "eventAction": "last changed", "eventDate": "2026-08-14T08:01:43Z" }
  ],
  "nameservers": ["ELLIOTT.NS.CLOUDFLARE.COM", "HERA.NS.CLOUDFLARE.COM"]
}

The links array in a registry response contains a related link to the registrar's own RDAP server. Follow it and you get the contact objects, redacted or not. That is exactly what a well-built web tool does for you in one request. If you are building on this, the six-step method in how to test a public API endpoint applies to RDAP servers as much as to any other JSON API.

How to Read the Results (Field by Field)

Most people run a lookup to answer one of four questions. Here is where the answer sits in the record.

Is the domain taken? If a record comes back at all, yes. A registered domain always has a Creation Date. If the registry returns No match for domain or RDAP returns HTTP 404, the name is unregistered — or reserved by the registry, which is common for short and dictionary words. Use a domain availability checker to distinguish the two, because it also verifies over DNS.

When does it expire, and will it drop? Read the expiry date, then the status codes. A domain in autoRenewPeriod or redemptionPeriod has not been released; the owner can still renew or restore it. Only pendingDelete means it will be released, and that usually takes five more days. The expiry lifecycle section below walks the whole timeline. Don't judge by the registry's date alone: when a gTLD domain expires, the registry renews it automatically for a year, so Registry Expiry Date can already show next year while the registrar's own record (Registrar Registration Expiration Date) still shows the day the owner stopped paying. When they disagree, the status codes decide whether it drops.

Who manages it? Registrar is the company to contact, and the Registrar Abuse Contact Email and phone are published even when everything else is redacted. That is by design: ICANN's Registration Data Policy requires those fields to stay public.

Has it changed recently? Updated Date moves whenever the registrar pushes a change: a renewal, a nameserver switch, a lock added or removed. A domain that changed nameservers last week and expires next month is a different risk profile from one untouched since 2015. If the nameservers changed, a NS lookup shows where DNS now lives.

Domain Status Codes Explained (EPP)

Status codes are the single most valuable line in a WHOIS record, and the most misread. They are defined by the EPP protocol, and each code has a fixed meaning published by ICANN. A code beginning with client was set by the registrar, usually at the owner's request; a code beginning with server was set by the registry and only the registry can remove it.

The pattern to remember: clientTransferProhibited + clientUpdateProhibited + clientDeleteProhibited is healthy and boring. A domain that suddenly resolves to nothing and shows clientHold needs its owner to check their inbox, not their DNS. And if you are waiting to buy a domain someone let lapse, nothing before pendingDelete is worth watching.

Why WHOIS Shows "REDACTED FOR PRIVACY"

Until 2018 a WHOIS record for a .com typically listed the registrant's full name, postal address, phone number and email. Registrars sold WHOIS privacy as an add-on that replaced those fields with a proxy service's details. Then the EU's GDPR took effect on 25 May 2018, the same day as a Temporary Specification ICANN had adopted a week earlier, and registrars began redacting personal data for everyone rather than trying to decide who was in scope. That interim rule was replaced by ICANN's Registration Data Policy, in full effect since 21 August 2025: registrars must redact personal data where privacy law requires it and may redact it for everyone else too.

This is what the registrar-level RDAP record for cloudflare.com returns for its registrant today (trimmed):

{
  "objectClassName": "entity",
  "roles": ["registrant"],
  "vcardArray": ["vcard", [
    ["fn",  {}, "text", "DATA REDACTED"],
    ["org", {"type": "work"}, "text", "DATA REDACTED"],
    ["adr", {"cc": "US", "type": "work"}, "text",
      ["", "", ["DATA REDACTED", "DATA REDACTED"], "DATA REDACTED", "CA", "DATA REDACTED", ""]],
    ["contact-uri", {}, "uri", "https://domaincontact.registrar.cloudflare.com/cloudflare.com"]
  ]],
  "remarks": [{ "title": "REDACTED FOR PRIVACY",
                "description": ["Some of the data in this object has been removed"] }]
}

The policy is precise about what stays public. These fields must always be published for a gTLD domain: the domain name, registrar name and IANA ID, registrar URL, the registrar's abuse email and phone, creation date, expiry date, nameservers and status codes. Redaction is also never complete: the policy requires the registrant's state/province and country to be published, and the organisation name too when the registrant agreed to publish it, so a redacted record can still tell you the owner is in California or in Bavaria. In the record above, that's CA and US, plus a contact-uri link to Cloudflare's contact form.

The practical difference between privacy and redaction: a paid WHOIS privacy service still forwards mail sent to its proxy address, whereas plain redaction removes the email and replaces it with a contact form link or an anonymised forwarding address, depending on the registrar. Either way, an outsider gets a way to write to the owner without learning who they are.

How to Find Who Owns a Domain When WHOIS Is Redacted

Redaction closed the front door, but a domain leaves fingerprints everywhere else. Work through these in order; each takes a minute.

• Read what is not redacted. State/province and country are always published, and the organisation is too when the registrant agreed. The registrar itself narrows things: a domain at MarkMonitor or CSC is held by a large corporation; one at Cloudflare Registrar is likely a developer or startup.
• Use the registrar's contact relay. Every registrar must give you a way to reach the registrant: an anonymised email like abc123@contact.gandi.net, or a web form linked from the WHOIS output. Legitimate messages get forwarded.
• Check the SSL certificate. Organisation-validated (OV) and extended-validation (EV) certificates carry the legal company name in the Subject field. Run the domain through an SSL checker and read the certificate chain; the guide to SSL certificate chains shows where the organisation sits.
• Look at DNS. The SOA record's RNAME field is the zone administrator's email with the @ replaced by a dot. TXT records reveal the mail provider, verification tokens for Google, Microsoft and Facebook, and sometimes a company name outright. A DNS lookup on SOA and TXT takes seconds, and a subdomain finder surfaces hostnames like mail., crm. or jira. that name the tools a company runs.
• Check WHOIS history. Records before May 2018 were public and have been archived by several commercial services. A domain registered years before that often has an unredacted historical record showing the original registrant, unless it used a privacy service even then.
• Reverse WHOIS. If you have one known detail (a company name or a surviving email), reverse WHOIS services search for every domain that ever listed it. Expensive, but this is how brand-protection teams map a squatter's portfolio.
• File a request. For a legal need such as a trademark dispute, phishing or fraud, ICANN's Registration Data Request Service (RDRS) routes a formal disclosure request to the registrar. It works only for gTLDs and only with participating registrars. In its two-year pilot (28 November 2023 to 30 November 2025) it carried more than 3,700 requests, of which 26% were approved and 55% denied (ICANN); ICANN has kept it running while the community decides what comes next.

WHOIS vs RDAP: What Changed in 2025

RDAP (Registration Data Access Protocol) was designed by the IETF to fix everything that was broken about port-43 WHOIS, and it is what your lookup tool actually uses today. The differences matter if you build on the data:

Two practical consequences. First, if a script of yours scrapes whois text output, it is living on borrowed time: outside .com, .name and .post, registries and registrars can switch their port-43 service off at any point, and some already have. Google Registry's whois.nic.google, which served .app and .dev, no longer even resolves, and GoDaddy's registrar server answers every query with "This WHOIS server is being retired. Please use our RDAP service instead." (both checked on 27 October 2026).

Second, the RDAP bootstrap solves the problem WHOIS never did: given example.museum, a client downloads data.iana.org/rdap/dns.json once, finds the entry for museum, and queries the authoritative server without any hard-coded knowledge. The switch is visible in the traffic: ICANN's monthly reports show gTLD RDAP queries rising from about 7 billion a month in January 2025 to 65 billion in August 2025, overtaking port-43 WHOIS in June 2025 (APNIC).

Country-Code Domains: Every Registry Does It Differently

ICANN's policies bind gTLDs. Country-code TLDs (.de, .uk, .br, .jp and about 300 others) set their own rules, and a WHOIS lookup on a ccTLD can return anything from a full validated identity to almost nothing. Here is what a public lookup returned at eight registries on 27 October 2026:

At the far end of the scale, this is DENIC's whole port-43 answer for example.de:

% The DENIC whois service on port 43 doesn't disclose any information concerning
% the domain holder, general request and abuse contact.
% This information can be obtained through use of our web-based whois service
% available at the DENIC website:
% https://webwhois.denic.de/?lang=en

Domain: example.de
Nserver: ns1078.ui-dns.biz
Nserver: ns1078.ui-dns.com
Nserver: ns1078.ui-dns.de
Nserver: ns1078.ui-dns.org
Status: connect
Changed: 2018-08-10T05:24:12+02:00

No registrar, no creation or expiry date, no owner, and the status vocabulary (connect) is DENIC's own rather than EPP.

IP WHOIS Lookup: Who Owns an IP Address

The same whois command works on an IP address, but the answer comes from a different database. Domain names are managed by registries and registrars; IP address blocks are allocated by the five Regional Internet Registries (ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America and AFRINIC for Africa). An IP WHOIS record tells you which organisation holds the block, the block's size, the country of assignment and the abuse contact, which is what you need when an address is attacking your server or sending you spam.

# Port-43 WHOIS: the client finds the right RIR automatically
whois 1.1.1.1

# RDAP: rdap.org redirects to the right RIR (APNIC here)
curl -sL https://rdap.org/ip/1.1.1.1 | jq '{name, handle, startAddress, endAddress, country, type}'

# Output
{
  "name": "APNIC-LABS",
  "handle": "1.1.1.0 - 1.1.1.255",
  "startAddress": "1.1.1.0",
  "endAddress": "1.1.1.255",
  "country": "AU",
  "type": "ASSIGNED PORTABLE"
}

An IP record never tells you which websites are hosted on the address; a single cloud IP can front thousands of domains. It also does not tell you the physical location of the user, only where the block was registered. For a quick answer without the command line, IP Lookup combines the RIR data with geolocation, and ASN Lookup shows which network the block is announced from. To go from an IP back to a hostname, use reverse DNS, which reads the PTR record rather than WHOIS.

Reading Expiry Dates: The Domain Lifecycle

The status codes only make sense against the timeline a gTLD domain follows after its owner stops paying. ICANN's Expired Registration Recovery Policy sets the minimums, registries and registrars add their own margins, and the result is a longer road than most people expect:

• About 30 days and again about 7 days before expiry — the registrar must email the owner. A third notice follows within 5 days after expiry.
• Day 0 (expiry) — the registry auto-renews the domain and sets autoRenewPeriod. The registrar has up to 45 days to keep it or delete it. Before deleting it, the registrar must stop it resolving for at least the last 8 days (or from expiry, if it deletes sooner), so the site goes dark; many registrars park it on a page that says the domain has expired.
• Day 1–45 (registrar grace) — the owner can still renew. ICANN only guarantees this while the domain is interrupted (ERRP); how long the registrar allows beyond that, and at what price, is its own policy, and it must publish its post-expiry fees on its website.
• Deletion → redemptionPeriod (30 days) — the registrar deleted it. The owner can still restore it, for a restore fee the registrar must show on its website, on top of the renewal. Nobody else can register it.
• pendingDelete (5 days) — restoration is no longer possible. At the end of this window, at a time the registry does not announce, the name is purged and becomes available.
• Drop — the domain is free to register, and drop-catching services that have been polling the registry compete for it within milliseconds.

So a domain whose registrar record shows an expiry date two weeks ago can still be anywhere from about 35 to 66 days from actually being available, and it may never be: the owner can pull it back at any point until pendingDelete. Set a watch on the status line, not the expiry date. Running a WHOIS lookup once a day and noting the status transition is enough.

What People Actually Use WHOIS Lookups For

Beyond "is this name free", a handful of jobs come up again and again in support queues and security teams.

Verifying a website before you trust it. A shop claiming ten years in business whose domain was created three weeks ago is telling you something. Creation date, registrar and nameservers take ten seconds to check and are impossible to fake in the registry record.

Troubleshooting a site that stopped resolving. Before touching DNS, confirm the domain is not expired or on clientHold; if it is, no DNS change will help. After a nameserver migration, the WHOIS Name Server lines confirm the registrar actually applied the change; resolvers can keep the old nameservers cached for up to 48 hours, the TTL of .com's delegation records. A NS lookup shows what the world sees now.

Buying a domain that is taken. WHOIS tells you the registrar (some run a broker service), whether the domain is locked, how long the current owner has held it, and whether it is drifting toward expiry.

Investigating phishing or abuse. The Registrar Abuse Contact Email is published precisely so you can report a malicious domain to the party that can suspend it. Pair it with the IP WHOIS abuse contact for the hosting provider.

Auditing your own portfolio. Domains are lost to expired credit cards as well as to hackers. A quarterly WHOIS sweep of every domain you own, checking expiry dates and lock status, is cheap insurance.

WHOIS Field Reference

A quick reference for every field you will see in a gTLD record, with its RDAP equivalent for anyone parsing the JSON:

If a record you are looking at does not fit this table, you are almost certainly looking at a ccTLD, and the registry's own documentation is the reference.