WHOIS Lookup Guide: Find Who Owns a Domain & Read the Record

What Is a WHOIS Lookup?

A WHOIS lookup is a query to the public registration database for a domain name. Every domain under a generic top-level domain such as .com, .net or .org must have a record kept by its registry and registrar, and anyone can read the public part of that record. The lookup returns who the registrar is, when the domain was created, when it expires, which nameservers it uses, and a set of status codes that say whether it is locked, on hold or about to be deleted.

The name comes from the original Unix command. In 1982 the ARPANET directory could be queried by typing whois followed by a name, and RFC 3912 later standardised that plain-text protocol on TCP port 43. The word stuck even though the protocol underneath has changed: since 28 January 2025, ICANN no longer requires gTLD registries and registrars to run port-43 WHOIS at all, and the same data is served over RDAP, a JSON API. Most tools, including DNS Robot's WHOIS Lookup, query RDAP first and still call the result a WHOIS record.

One thing a WHOIS lookup usually does not return any more is the owner's name, address and email. Since GDPR took effect in May 2018, registrars redact personal contact data by default worldwide. The rest of this guide shows you what is still there, how to read it, and how to reach an owner when the contact fields say REDACTED FOR PRIVACY.

What a WHOIS Record Contains

Here is a real registry record for example.com, fetched today with the whois command on macOS. Every gTLD record has the same shape, so once you can read this one you can read any of them:

• Identity — Domain Name and Registry Domain ID. The ID is the registry's internal key and never changes, even when the domain changes hands.

• Registrar — the company the owner pays. Registrar IANA ID is the registrar's unique number in the IANA registrar list; Registrar WHOIS Server is where the contact fields live, because for .com and .net the registry itself stores no contacts.

• Dates — Creation Date, Updated Date and Registry Expiry Date. All three are UTC. Creation date is what a domain age checker reports.

• Status — one or more EPP status codes. These are the most useful and the most misread part of the record; they get their own section below.

• Delegation — the nameservers and DNSSEC flag. This is the bridge between WHOIS and DNS: change the nameservers here and every DNS record for the domain moves with them.

Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2026-08-14T08:01:43Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2027-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority
Registrar IANA ID: 376
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Name Server: ELLIOTT.NS.CLOUDFLARE.COM
Name Server: HERA.NS.CLOUDFLARE.COM
DNSSEC: signedDelegation
DNSSEC DS Data: 2371 13 2 C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A
>>> Last update of whois database: 2026-09-18T01:28:30Z <<<

The record splits into five groups, and each answers a different question:

How to Do a WHOIS Lookup

There are three ways to run a lookup, and they return the same underlying data. Pick by how often you need it and whether you want raw output.

Method 1: Use an Online WHOIS Tool

Open DNS Robot's WHOIS Lookup, type the bare domain (example.com, not https://www.example.com/page) and press Enter. The tool queries the registry's RDAP server directly for common TLDs, falls back to the rdap.org bootstrap for the rest, and shows the parsed record: registrar with abuse contact, creation, update and expiry dates, status codes with plain-English meanings, nameservers, DNSSEC state, and how old the domain is. A lookup for dnsrobot.net came back in 387 ms in testing.

ICANN Lookup is the official alternative. It is authoritative for every gTLD but returns nothing useful for most country-code domains, and it has no history, no bulk mode and no links to DNS data. Registrar sites (GoDaddy, Namecheap, Cloudflare) also offer WHOIS pages; they work, but they are built to sell you the domain if it is free.

Method 2: The whois Command (macOS, Linux, Windows)

macOS and almost every Linux distribution ship a whois client. It talks port-43 WHOIS, follows the referral from the registry to the registrar automatically, and prints both records back to back:

# Basic lookup (follows registry -> registrar referral)
whois example.com

# Query one specific server and skip the referral
whois -h whois.verisign-grs.com example.com

# Only the lines you usually care about
whois example.com | grep -iE 'Registrar:|Creation Date|Expiry|Domain Status|Name Server'

# Debian/Ubuntu: install if missing
sudo apt install whois

Windows has no built-in whois. The two clean options are Microsoft's own Sysinternals tool and querying RDAP with the curl that ships with Windows 10 and 11:

Windows: Sysinternals whois or curl

Download whois.exe from the Sysinternals suite, put it on your PATH, and the syntax matches Unix. If you would rather not install anything, ask the RDAP server directly and let PowerShell format the JSON:

# Sysinternals whois (after download)
whois -v example.com

# No install: query RDAP and pretty-print the JSON
curl.exe -s -H "Accept: application/rdap+json" https://rdap.org/domain/example.com | ConvertFrom-Json | Select-Object ldhName, status, events, nameservers

Method 3: Query RDAP Directly (for Scripts)

If you need WHOIS data in a script, skip the text format and call RDAP. The response is JSON with a fixed schema, so you can extract fields without regex. The registry for .com answers at rdap.verisign.com; for any other TLD, rdap.org looks up the right server from the IANA bootstrap file and redirects you:

# Registry record for a .com, straight from Verisign
curl -s -H 'Accept: application/rdap+json' \
  https://rdap.verisign.com/com/v1/domain/example.com | jq '{status, events, nameservers: [.nameservers[].ldhName]}'

# Any TLD: let rdap.org find the authoritative server
curl -sL https://rdap.org/domain/example.org | jq '.events'

# Sample output
{
  "status": ["client delete prohibited", "client transfer prohibited", "client update prohibited"],
  "events": [
    { "eventAction": "registration", "eventDate": "1995-08-14T04:00:00Z" },
    { "eventAction": "expiration",   "eventDate": "2027-08-13T04:00:00Z" },
    { "eventAction": "last changed", "eventDate": "2026-08-14T08:01:43Z" }
  ],
  "nameservers": ["ELLIOTT.NS.CLOUDFLARE.COM", "HERA.NS.CLOUDFLARE.COM"]
}

The links array in a registry response contains a related link to the registrar's own RDAP server. Follow it and you get the contact objects, redacted or not. That is exactly what a well-built web tool does for you in one request. If you are building on this, the six-step method in how to test a public API endpoint applies to RDAP servers as much as to any other JSON API.

How to Read the Results (Field by Field)

Most people run a lookup to answer one of four questions. Here is where the answer sits in the record.

Is the domain taken? If a record comes back at all, yes. A registered domain always has a Creation Date. If the registry returns No match for domain or RDAP returns HTTP 404, the name is unregistered — or reserved by the registry, which is common for short and dictionary words. Use a domain availability checker to distinguish the two, because it also verifies over DNS.

When does it expire, and will it drop? Read Registry Expiry Date, then read the status codes. A domain past its expiry date with status autoRenewPeriod or redemptionPeriod has not been released; the owner can still renew it. Only pendingDelete means it will be released, and that usually takes five more days. The expiry lifecycle section below walks the whole timeline.

Who manages it? Registrar is the company to contact, and the Registrar Abuse Contact Email and phone are published even when everything else is redacted. That is by design: ICANN's Registration Data Policy requires those fields to stay public.

Has it changed recently? Updated Date moves whenever the registrar pushes a change: a renewal, a nameserver switch, a lock added or removed. A domain that changed nameservers last week and expires next month is a different risk profile from one untouched since 2015. If the nameservers changed, a NS lookup shows where DNS now lives.

Domain Status Codes Explained (EPP)

Status codes are the single most valuable line in a WHOIS record, and the most misread. They are defined by the EPP protocol, and each code has a fixed meaning published by ICANN. A code beginning with client was set by the registrar, usually at the owner's request; a code beginning with server was set by the registry and only the registry can remove it.

The pattern to remember: clientTransferProhibited + clientUpdateProhibited + clientDeleteProhibited is healthy and boring. A domain that suddenly resolves to nothing and shows clientHold needs its owner to check their inbox, not their DNS. And if you are waiting to buy a domain someone let lapse, nothing before pendingDelete is worth watching.

Why WHOIS Shows "REDACTED FOR PRIVACY"

Until 2018 a WHOIS record for a .com typically listed the registrant's full name, postal address, phone number and email. Registrars sold WHOIS privacy as an add-on that replaced those fields with a proxy service's details. Then the EU's GDPR took effect on 25 May 2018, ICANN issued a Temporary Specification within days, and registrars began redacting personal data for everyone rather than trying to decide who was in scope. That interim rule was replaced by ICANN's Registration Data Policy, which took full effect on 21 August 2025 and makes the redaction permanent.

This is what the registrar-level RDAP record for cloudflare.com returns for its registrant today:

{
  "objectClassName": "entity",
  "roles": ["registrant"],
  "vcardArray": ["vcard", [
    ["fn",  {}, "text", "DATA REDACTED"],
    ["org", {}, "text", "DATA REDACTED"],
    ["adr", {}, "text", ["DATA REDACTED", "DATA REDACTED", "DATA REDACTED"]]
  ]],
  "remarks": [{ "title": "REDACTED FOR PRIVACY",
                "description": ["Some of the data in this object has been removed."] }]
}

The policy is precise about what stays public. These fields must always be published for a gTLD domain: the domain name, registrar name and IANA ID, registrar URL, the registrar's abuse email and phone, creation date, expiry date, nameservers and status codes. Redaction is also not always complete: many registrars still publish the registrant's organisation name when the domain was registered by a company (a legal person, which GDPR does not protect) and the registrant's state/province and country, so a redacted record can still tell you the owner is a company in Delaware or a person in Bavaria.

The practical difference between privacy and redaction: a paid WHOIS privacy service still forwards mail sent to its proxy address, whereas plain redaction removes the email and replaces it with a contact form link or an anonymised forwarding address, depending on the registrar. Either way, an outsider gets a way to write to the owner without learning who they are.

How to Find Who Owns a Domain When WHOIS Is Redacted

Redaction closed the front door, but a domain leaves fingerprints everywhere else. Work through these in order; each takes a minute and most owners are identified by step three.

• Read what is not redacted. Organisation, state and country fields often survive. The registrar itself narrows things: a domain at MarkMonitor or CSC is held by a large corporation; one at Cloudflare Registrar is likely a developer or startup.

• Use the registrar's contact relay. Every registrar must give you a way to reach the registrant: an anonymised email like abc123@contact.gandi.net, or a web form linked from the WHOIS output. Legitimate messages get forwarded.

• Check the SSL certificate. Organisation-validated (OV) and extended-validation (EV) certificates carry the legal company name in the Subject field. Run the domain through an SSL checker and read the certificate chain; the guide to SSL certificate chains shows where the organisation sits.

• Look at DNS. The SOA record's RNAME field is the zone administrator's email with the @ replaced by a dot. TXT records reveal the mail provider, verification tokens for Google, Microsoft and Facebook, and sometimes a company name outright. A DNS lookup on SOA and TXT takes seconds, and a subdomain finder surfaces hostnames like mail., crm. or jira. that name the tools a company runs.

• Check WHOIS history. Records before May 2018 were public and have been archived by several commercial services. A domain registered in 2012 almost certainly has an unredacted historical record showing the original registrant.

• Reverse WHOIS. If you have one known detail (a company name or a surviving email), reverse WHOIS services search for every domain that ever listed it. Expensive, but this is how brand-protection teams map a squatter's portfolio.

• File a request. For a legal need such as a trademark dispute, phishing or fraud, ICANN's Registration Data Request Service (RDRS) routes a formal disclosure request to the registrar. It launched on 28 November 2023 and works only for gTLDs; there is no equivalent for most ccTLDs.

WHOIS vs RDAP: What Changed in 2025

RDAP (Registration Data Access Protocol) was designed by the IETF to fix everything that was broken about port-43 WHOIS, and it is what your lookup tool actually uses today. The differences matter if you build on the data:

Two practical consequences. First, if a script of yours scrapes whois text output, it is living on borrowed time: registries can switch their port-43 service off at any point, and some already have: Google Registry's whois.nic.google, which served .app and .dev, no longer even resolves. Second, the RDAP bootstrap solves the problem WHOIS never did: given example.museum, a client downloads data.iana.org/rdap/dns.json once, finds the entry for museum, and queries the authoritative server without any hard-coded knowledge. ICANN reported RDAP handling more than 10 billion queries a month by December 2024.

Country-Code Domains: Every Registry Does It Differently

ICANN's policies bind gTLDs. Country-code TLDs (.de, .uk, .br, .jp and about 300 others) set their own rules, and a WHOIS lookup on a ccTLD can return anything from a full validated identity to almost nothing. Here is what the port-43 server for DENIC, the .de registry, returned today for example.de:

% The DENIC whois service on port 43 doesn't disclose any information concerning
% the domain holder, general request and abuse contact.
% This information can be obtained through use of our web-based whois service
% available at the DENIC website:
% https://webwhois.denic.de/?lang=en

Domain: example.de
Nserver: ns1078.ui-dns.biz
Nserver: ns1078.ui-dns.com
Nserver: ns1078.ui-dns.de
Nserver: ns1078.ui-dns.org
Status: connect
Changed: 2018-08-10T05:24:12+02:00

No registrar, no dates, no owner, and the status vocabulary (connect) is DENIC's own rather than EPP. Other registries sit at different points on the scale:

IP WHOIS Lookup: Who Owns an IP Address

The same whois command works on an IP address, but the answer comes from a different database. Domain names are managed by registries and registrars; IP address blocks are allocated by the five Regional Internet Registries (ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America and AFRINIC for Africa). An IP WHOIS record tells you which organisation holds the block, the block's size, the country of assignment and the abuse contact, which is what you need when an address is attacking your server or sending you spam.

# Port-43 WHOIS: the client finds the right RIR automatically
whois 1.1.1.1

# RDAP: rdap.org redirects to the right RIR (APNIC here)
curl -sL https://rdap.org/ip/1.1.1.1 | jq '{name, handle, startAddress, endAddress, country, type}'

# Output
{
  "name": "APNIC-LABS",
  "handle": "1.1.1.0 - 1.1.1.255",
  "startAddress": "1.1.1.0",
  "endAddress": "1.1.1.255",
  "country": "AU",
  "type": "ASSIGNED PORTABLE"
}

An IP record never tells you which websites are hosted on the address; a single cloud IP can front thousands of domains. It also does not tell you the physical location of the user, only where the block was registered. For a quick answer without the command line, IP Lookup combines the RIR data with geolocation, and ASN Lookup shows which network the block is announced from. To go from an IP back to a hostname, use reverse DNS, which reads the PTR record rather than WHOIS.

Reading Expiry Dates: The Domain Lifecycle

The status codes only make sense against the timeline a gTLD domain follows after its owner stops paying. ICANN's Expired Registration Recovery Policy sets the minimums, registries and registrars add their own margins, and the result is a longer road than most people expect:

• About 30 days and again about 7 days before expiry — the registrar must email the owner. A third notice follows within 5 days after expiry.

• Day 0 (expiry) — the registry auto-renews the domain and sets autoRenewPeriod. The registrar has up to 45 days to keep it or delete it. The registrar must break DNS resolution for at least 8 days before deleting, so the site goes dark; many registrars park it on a page that says the domain has expired.

• Day 1–45 (registrar grace) — the owner can renew at the normal price. Most registrars cut this to 30 days or less.

• Deletion → `redemptionPeriod` (30 days) — the registrar deleted it. The owner can still restore it, typically for a fee of $80–$200 on top of renewal. Nobody else can register it.

• `pendingDelete` (5 days) — restoration is no longer possible. At the end of this window, at a time the registry does not announce, the name is purged and becomes available.

• Drop — the domain is free to register, and drop-catching services that have been polling the registry compete for it within milliseconds.

So a domain whose WHOIS shows an expiry date two weeks ago is usually 60 to 75 days from actually being available, and it may never be: the owner can pull it back at any point until pendingDelete. Set a watch on the status line, not the expiry date. Running a WHOIS lookup once a day and noting the status transition is enough.

What People Actually Use WHOIS Lookups For

Beyond "is this name free", a handful of jobs come up again and again in support queues and security teams.

Verifying a website before you trust it. A shop claiming ten years in business whose domain was created three weeks ago is telling you something. Creation date, registrar and nameservers take ten seconds to check and are impossible to fake in the registry record.

Troubleshooting a site that stopped resolving. Before touching DNS, confirm the domain is not expired or on clientHold; if it is, no DNS change will help. After a nameserver migration, the WHOIS Name Server lines confirm the registrar actually applied the change, which can take up to 48 hours to propagate.

Buying a domain that is taken. WHOIS tells you the registrar (which usually has a broker service), whether the domain is locked, how long the current owner has held it, and whether it is drifting toward expiry.

Investigating phishing or abuse. The Registrar Abuse Contact Email is published precisely so you can report a malicious domain to the party that can suspend it. Pair it with the IP WHOIS abuse contact for the hosting provider.

Auditing your own portfolio. Companies lose domains to expired credit cards more often than to hackers. A quarterly WHOIS sweep of every domain you own, checking expiry dates and lock status, is cheap insurance.

WHOIS Field Reference

A quick reference for every field you will see in a gTLD record, with its RDAP equivalent for anyone parsing the JSON:

If a record you are looking at does not fit this table, you are almost certainly looking at a ccTLD, and the registry's own documentation is the reference.