WHOIS Lookup
Look up the public registration record for any domain name. WHOIS data shows who registered a domain, when it expires, which registrar manages it, and which name servers it uses. This is essential for domain research, security investigations, and expiry monitoring.
Understanding WHOIS Fields
WHOIS records follow the ICANN standard format. Here is what each field means and why it matters: For a full background on the protocol, read our guide to how WHOIS works and what it reveals.
| Field | Description | Why It Matters |
|---|---|---|
| Domain Name | The fully qualified domain name being looked up. | Confirms you are viewing the correct record. |
| Registrar | The company through which the domain was registered. | Contact point for domain ownership transfers and disputes. |
| Creation Date | When the domain was first registered. | Older domains are generally more trustworthy than newly registered ones. |
| Expiration Date | When the domain registration expires if not renewed. | Domains that expire can be registered by others - Monitor this date. |
| Name Servers | The DNS servers authoritative for this domain. | Changing name servers is how you point a domain at a new host. |
| Status | EPP status codes indicating what operations are currently permitted. | clientTransferProhibited is standard; redemptionPeriod means it is about to expire. |
| DNSSEC | Whether DNS Security Extensions are active on this domain. | DNSSEC prevents DNS cache poisoning attacks. |
Why So Many Fields Say REDACTED
Since GDPR came into force in 2018, registrars have withheld personal contact details for most domains registered by individuals. A record that looks empty is usually not a privacy service - it is the registrar complying with data-protection law.
| Field | Usually visible? | Why |
|---|---|---|
| Registrar | Yes | Corporate data, never personal |
| Creation / expiry date | Yes | Operational, not personal - the single most useful field for spotting a brand-new scam domain |
| Nameservers | Yes | Technical infrastructure |
| Registrant name / email | Rarely | Personal data under GDPR; often replaced with a forwarding address |
| Registrant address | Rarely | Personal data; typically visible only for company-registered domains |
| Status codes | Yes | Registry state - clientTransferProhibited, pendingDelete and similar |
What Domain Age Tells You
The creation date is the field worth checking first when you are evaluating whether a site is trustworthy. Fraudulent domains are overwhelmingly young, because they get taken down and re-registered constantly.
- Registered in the last 30 days, offering deep discounts on branded goods - treat as high risk.
- Registered years ago with a consistent registrar and stable nameservers - a normal, established site.
- Recently transferred between registrars with a fresh nameserver change - possible ownership change; verify before trusting existing reputation.
- Expiry date only weeks away - the owner may be letting it lapse, which matters if you are relying on it for anything long-term.
WHOIS vs RDAP
WHOIS is a 1980s protocol that returns free-form text with no standard structure, which is why output differs between registries. RDAP is its structured JSON replacement: it returns consistent fields, supports internationalised data properly, and allows authenticated access to details that anonymous WHOIS redacts. Most registries now run both, and this tool reads whichever gives the more complete answer.
Frequently Asked Questions
Why is WHOIS data redacted or hidden?
Two reasons. Since GDPR took effect in 2018, registrars redact personal fields - Name, email, phone, address - For most registrations by default. Separately, many owners pay for WHOIS privacy or proxy services that substitute the contact details of a forwarding service. Non-personal data such as the registrar, registration and expiry dates, and nameservers remains public.
How do I find out who owns a domain?
Run a WHOIS lookup first: even redacted records reveal the registrar, creation and expiry dates, nameservers, and sometimes the owning organisation. If contacts are hidden, use the anonymised relay email or web form shown in the record, check the website itself for legal or imprint pages, or consult historical WHOIS snapshots from before redaction became standard.
What is the difference between a registrar and a registry?
The registry operates a top-level domain and maintains its master database - Verisign runs .com, for example. A registrar is the retailer: companies like GoDaddy or Namecheap that sell registrations to the public and pass the data to the registry. You always deal with a registrar; the registry works behind the scenes and sets the rules for its TLD.
Related Tools
Sources & Further Reading
The technical claims on this page are drawn from the primary specifications and vendor documentation below.
- RFC 3912 — WHOIS Protocol Specification RFC Editor
- RFC 9083 — JSON Responses for RDAP RFC Editor