WHOIS Lookup

Free WHOIS domain lookup: see who registered a domain and through which registrar, when it was created and when it expires, whether it's locked or at risk, its nameservers, and how to reach the owner or report abuse. Straight from the registry: RDAP first, WHOIS (port 43) where a registry has no RDAP.

What a WHOIS lookup shows

A WHOIS lookup asks a domain's registry for its registration record: who registered it and through which registrar, when, until when it's paid, its status codes and its nameservers. It's also called a domain lookup, a domain registration lookup, a WHOIS search or a "who is" search, and it works for IP addresses (IP WHOIS) and AS numbers too.

This tool asks the registry's RDAP server first, follows the link to the registrar's own record for the details the registry doesn't keep (.com's registry holds no contacts), and falls back to classic WHOIS on port 43 where a registry has no RDAP. Then it explains what the record means for you.

WHOIS lookup result: the registrar, creation and expiry dates on a lifecycle timeline, status codes and the abuse contactWHOIS lookup result: the registrar, creation and expiry dates on a lifecycle timeline, status codes and the abuse contactThe lifecycleRegistered, last changed, today and expiry in one journey, top to bottom, with the days left.The stateOne word for where the domain stands: locked, active, expiring soon, expired, on hold or being deleted.Status codesEach code in plain language, grouped by what it means for you, with who set it.If it isn't renewedThe latest date each stage can end after expiry; only the 30-day redemption is guaranteed.
A lookup of google.com: the state, the registrar, the dates from registration to the latest possible deletion, and the abuse desk. Select a number to see what each part shows.

What do domain status codes mean?

Every domain carries at least one EPP status code. Codes starting with client are set by the registrar, codes starting with server by the registry, and the registry's win when both are set. Most are good news: the prohibited codes are locks against hijacking.

Three groups matter. Locks (transfer, update, delete prohibited) are fine. Holds (clientHold, serverHold) take the domain out of the DNS, so its website and email stop working. Lifecycle codes (redemptionPeriod, pendingDelete) mean the domain is being deleted.

RDAP spells the same codes in words (client transfer prohibited); this tool shows one spelling for both.

Needs attention · 5

The domain is off the internet or on its way out. Act now if it's yours.

  • clientHoldRegistrarRemoved from the DNS: the website and email don't resolve.
  • serverHoldRegistryRemoved from the DNS by the registry: the website and email don't resolve.
  • inactiveRegistryNo nameservers: the domain doesn't resolve.
  • redemptionPeriodRegistryDeleted; the last owner can restore it for 30 days.
  • pendingDeleteRegistryAbout to be purged and released.
Protected · 5

Fine. These locks stop hijacking and accidental changes; the owner can lift them at the registrar.

  • clientTransferProhibitedRegistrarTransfers to another registrar are refused: the usual registrar lock.
  • serverTransferProhibitedRegistryThe registry refuses transfers, sometimes as a Registry Lock the owner bought.
  • clientUpdateProhibitedRegistrarThe record's details can't be changed.
  • clientDeleteProhibitedRegistrarThe domain can't be deleted.
  • clientRenewProhibitedRegistrarThe domain can't be renewed: often a dispute or an unpaid bill to fix.
Normal · 2

The ordinary states of a live or just-renewed domain.

  • autoRenewPeriodRegistryJust renewed automatically; the registrar can still cancel it.
  • okRegistryNormal, nothing pending. RDAP writes it as active.

What happens when a domain expires?

Less than most people think is guaranteed. ICANN's rules make a registrar send reminders about a month and a week before expiry and once after, but a registrar may delete an expired .com, .org or other generic name at any time after it expires.

The one guaranteed safety net comes after a deletion: 30 days of redemption, when only the last owner can restore the name, usually for a restore fee. Then 5 days of pending delete, and the name is free for anyone. For .com, the registry gives registrars up to 45 days to delete an unpaid auto-renewal, so a .com name can stay recoverable for about 80 days, or much less.

Country domains (.de, .uk, .jp…) follow their own registry's rules, so this tool shows their expiry date without projecting the stages after it.

How to check a domain's expiration date

Look up the domain above: the lifecycle shows the expiry date, the days left and, for generic domains, the latest date it could be deleted. Right after a .com expires, its registry renews it automatically while the registrar decides, so the date can jump a year ahead though nobody paid: the status then shows autoRenewPeriod.

Domain lifecycle

  1. RegisteredOct 26, 20206 years ago
  2. Last changedNov 16, 202511 months, 10 days ago
  3. TodayOct 27, 2026
  4. ExpiresNov 17, 2026in 21 days
  1. Registrar's graceJan 1, 20270–45 days · registrar's choice
  2. RedemptionJan 31, 202730 days · guaranteed
  3. Pending deleteFeb 5, 20275 days
  4. Free againFeb 5, 2027or earlier
Example: a .com domain 21 days before it expires
  1. 1

    Expires · Day 0

    Reminders before and after; the website may keep working for a while.

  2. 2

    Registrar's grace · 0–45 days

    The registrar decides how long the owner can still renew at the normal price.

  3. 3

    Redemption · 30 days

    Deleted, out of the DNS. Only the last owner can restore it, for a fee.

  4. 4

    Pending delete · 5 days

    Nothing can stop the deletion now.

  5. 5

    Free again · ≈ day 80 at the latest (.com)

    Anyone can register it, often a backorder service that was waiting for it.

How to find out who owns a domain

Look the domain up: if the owner agreed to publish it, the record shows the organisation and country. Most records now say REDACTED FOR PRIVACY instead, because the GDPR (since May 2018) and ICANN's Registration Data Policy (since 21 August 2025) let registrars hide the owner's name, address, phone and email.

Hidden doesn't mean unreachable. In order of effort:

  1. 1

    Use the registrar's relay

    When contact details are hidden, the registrar must publish an email relay or web form that forwards your message to the owner without revealing the address.

  2. 2

    Request the data

    Ask the registrar for the owner's details with a legitimate reason, directly or through ICANN's free RDRS form. They must acknowledge within 2 business days and answer within 30 days; a refusal is a valid answer.

  3. 3

    Check the country registry

    ccTLDs have their own rules: .jp publishes registrants as a rule, and DENIC's web lookup shows company holders of .de domains since December 2025.

  4. 4

    Dispute it

    If the domain copies your trademark in bad faith, a UDRP complaint can transfer or cancel it; the owner's identity comes out in the process.

What changed in 2025

  • ICANN's Registration Data Policy applies since 21 August 2025: the admin and billing contacts are gone, and the tech contact is optional.
  • Every generic domain must still publish its registrar, IANA ID, abuse email and phone, dates, statuses, nameservers and the owner's country.
  • RDRS, ICANN's request form, approved 26% of requests in its two-year pilot and refused 55%; it now runs until about late 2027.

WHOIS vs RDAP: what's the difference?

WHOIS (RFC 3912) is a plain-text protocol on port 43: one line of question, a page of free text back, in a layout every registry invents for itself. RDAP is its replacement: an HTTPS request with a JSON answer in one standard format, with fields marked when they're redacted.

Since 28 January 2025, generic-domain registries and registrars no longer have to run WHOIS at all, and ICANN calls RDAP the definitive source. .com is the exception: Verisign's contract still requires port 43. Many country registries have no RDAP yet, so a good lookup needs both.

whois -h whois.verisign-grs.com example.com
Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar: RESERVED-Internet Assigned Numbers Authority
Registrar IANA ID: 376
Updated Date: 2026-08-14T08:01:43Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2027-08-13T04:00:00Z
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: A.IANA-SERVERS.NET
Name Server: B.IANA-SERVERS.NET
DNSSEC: signedDelegation
GET rdap.verisign.com/com/v1/domain/example.com
{
  "objectClassName": "domain",
  "ldhName": "EXAMPLE.COM",
  "handle": "2336799_DOMAIN_COM-VRSN",
  "status": ["client delete prohibited",
             "client transfer prohibited"],
  "events": [
    { "eventAction": "registration", "eventDate": "1995-08-14T04:00:00Z" },
    { "eventAction": "expiration",   "eventDate": "2027-08-13T04:00:00Z" },
    { "eventAction": "last changed", "eventDate": "2026-08-14T08:01:43Z" }
  ],
  "secureDNS": { "delegationSigned": true },
  "nameservers": [{ "ldhName": "A.IANA-SERVERS.NET" }, …],
  "entities": [{ "roles": ["registrar"],
                 "publicIds": [{ "type": "IANA Registrar ID", "identifier": "376" }] }]
}
WHOIS (port 43)RDAP
FormatFree text, a layout per registryJSON, one standard
TransportPlain TCP, no encryptionHTTPS
Redacted fieldsPlaceholder textMarked as redacted (RFC 9537)
Finding the serverA list per TLDIANA's bootstrap file
Generic domainsOptional since January 2025 (.com still required)Required
Country domainsEach registry decides72 of 248 in IANA's bootstrap

Country domains: why .de, .jp or .es look different

ICANN's rules bind generic domains only. Each country registry sets its own, and IANA's RDAP file lists only 72 of the 248 two-letter country codes. The big ones you'll meet:

DomainHow it's looked upWhat the public record shows
.com, .netRDAP + the registrar's recordRegistry: registrar, dates, statuses, nameservers. Contacts only at the registrar.
.deRDAP (DENIC, not in IANA's file)Status, nameservers, DNSSEC and last change. No holder, no dates: those are on DENIC's web lookup.
.jpPort-43 WHOIS (JPRS)The registrant's name, dates and status; a general-use .jp name can hide its registrant since 2014.
.euPort-43 WHOIS (EURid)Registrar and nameservers; port 43 never shows the registrant.
.ukRDAP (Nominet)Registrar, dates, statuses and nameservers.
.esWeb only for the publicPort 43 answers only IP addresses registered with Red.es, 10 queries a minute.
.vnWeb onlyNo public WHOIS server is published; VNNIC offers a web lookup.

WHOIS for an IP address or AS number

WHOIS API

The same lookup as JSON, free, with CORS for browsers: send a domain, URL, IP or AS number. Fields stay compatible with our older API; errors carry a code and, when the registry is busy, a Retry-After header.

A domain
$ curl "https://dnsrobot.net/api/whois?q=google.com"
{
  "kind": "domain", "domain": "google.com",
  "registeredOn": "1997-09-15T04:00:00Z", "expiresOn": "2028-09-14T04:00:00Z",
  "registrar": { "name": "MarkMonitor Inc.", "ianaId": "292", "abuseEmail": "abusecomplaints@markmonitor.com", … },
  "status": ["clientDeleteProhibited", "clientTransferProhibited", …],
  "nameServers": ["ns1.google.com", …], "dnssec": "unsigned",
  "source": "rdap", "servers": ["https://rdap.verisign.com/com/v1/", "https://rdap.markmonitor.com/"], …
}
An IP address
$ curl -X POST https://dnsrobot.net/api/whois \
    -H "Content-Type: application/json" -d '{"domain": "8.8.8.8"}'
{
  "kind": "ip", "ip": "8.8.8.8", "name": "GOGL", "cidr": "8.8.8.0/24",
  "organization": "Google LLC", "rir": "ARIN", "abuseEmail": "network-abuse@google.com", …
}

WHOIS Lookup FAQ

What is a WHOIS lookup?

A WHOIS lookup shows a domain's public registration record: the registrar, the creation and expiry dates, the status codes, the nameservers and whatever owner details are published. It comes from the domain's registry, today mostly over RDAP, the protocol that replaced WHOIS. It also works for IP addresses and AS numbers, whose records come from the regional internet registries.

How do I find out who owns a domain?

Look it up here first: published owners show their organisation and country. If the record says REDACTED FOR PRIVACY, write through the registrar's email relay or web form, which forwards your message to the owner. For a legal reason, request the data from the registrar or through ICANN's RDRS form; for a trademark dispute, the UDRP.

Why does WHOIS say "REDACTED FOR PRIVACY"?

Since the GDPR took effect in May 2018, registrars hide personal contact details, and ICANN's Registration Data Policy lets them redact the owner's name, address, phone and email for any domain. The organisation and country are published only with the owner's consent. The registrar, dates, statuses, nameservers and abuse contact stay public.

How can I check when a domain expires?

Enter the domain above: the lifecycle shows the expiry date, how many days are left and, for generic domains like .com, the latest dates of the grace, redemption and pending-delete stages if it isn't renewed. A registrar may delete an expired name early, so treat those dates as the latest possible, not a promise.

What does clientTransferProhibited mean?

It's the registrar lock: the registrar refuses any transfer of the domain to another registrar. It protects against hijacking and is normal on most domains. To move a domain, the owner unlocks it in the registrar's control panel, and a registrar that offers no self-service unlock must remove it within 5 days of the owner's request.

What is the difference between WHOIS and RDAP?

WHOIS is the old text protocol on port 43, with a different layout at every registry. RDAP is its replacement: HTTPS requests with standard JSON answers and redacted fields marked as such. Since January 2025 generic domains need only RDAP, but .com and many country registries still run WHOIS, so this tool reads both.

Is a WHOIS lookup the same as an availability check?

Not quite. A WHOIS lookup reads the registration record of a name that exists. When the registry has no record, the name is usually free, but registries also reserve names and sell premium ones at a higher price. For several extensions at once, use the Domain Checker, then confirm with a registrar before you rely on it.

Can I do a WHOIS lookup on an IP address?

Yes. Type the IP address or an AS number like AS15169 and the tool asks the regional internet registry that holds it: ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC. You get the network name, the holder, the address block, the registration date and the abuse contact. IP Lookup adds the location and the connection type.

How do I report a domain for phishing or abuse?

Use the abuse desk on the result: it's the registrar's abuse email and phone, and the Report abuse button opens an email with the domain filled in. Add the exact URLs, dates with time zone and evidence such as email headers. Registrars must confirm receipt, investigate and act on phishing and malware. The abuse desk is not the owner.

Why does the domain age look too young?

The creation date in a WHOIS record is the start of the current registration. Renewals and registrar transfers keep it, but if a domain expired, was deleted and was registered again, the record shows the new date, not the first time the name existed. Archive services can show older history.

Is this the same as an ICANN WHOIS lookup?

Close. ICANN Lookup (lookup.icann.org) is ICANN's own WHOIS and RDAP client: an ICANN domain lookup asks the same registry and registrar servers as this tool and shows what they return. This page adds the plain-language status, the lifecycle, the abuse report, and country domains without RDAP, read over port-43 WHOIS.

Is this WHOIS lookup free, and do you keep what I look up?

It's free, with no account and no CAPTCHA for normal use; to protect the registries we allow 20 lookups a minute per network. Our server asks the registry and keeps the answer cached for an hour so repeat lookups are fast. We don't log who looked up what.

Missing something?Suggest a feature or a new tool