What Is WHOIS?

WHOIS shows who registered a domain, when it expires and which nameservers it uses. The fields in a record, why most of it is redacted now, and RDAP.

What Is the WHOIS Protocol?

WHOIS is a plain question-and-answer protocol for finding out who registered a domain name, an IP block or an autonomous system number. For a domain it returns the registrar, the registration and expiry dates and the nameservers. It dates from the early 1980s, is written down in RFC 3912, and a WHOIS server listens on TCP port 43 for anyone who asks.

Expect redactions: since GDPR took effect in 2018, most registrars strip personal details from WHOIS output. Where the owner's name and email used to be, you will usually see "REDACTED FOR PRIVACY".

What Data Does WHOIS Show?

Field	Description	Example
Domain Name	The registered domain	`example.com`
Registrar	Company where the domain was registered	GoDaddy, Namecheap, Cloudflare
Registrant	Person or organization that owns the domain	Name, org, email (may be redacted)
Creation Date	When the domain was first registered	1997-09-15
Expiration Date	When the registration expires	2025-09-14
Updated Date	Last modification to the WHOIS record	2024-08-14
Nameservers	DNS servers authoritative for the domain	`ns1.example.com`
Status	Domain status codes (locks, holds)	clientTransferProhibited

WHOIS vs RDAP

RDAP (Registration Data Access Protocol) is the replacement. It fixes what makes WHOIS painful:

Structured data. RDAP answers in JSON. WHOIS answers in free text that every registry formats differently.
One format from every registry and registrar.
Security. Runs over HTTPS and supports authentication, so different users can get different levels of access.
Internationalization. Non-ASCII characters and IDN domains work properly.
Privacy. Access control is built in, which makes GDPR compliance simpler.

ICANN requires every registry and registrar to support RDAP and the switch is under way. Plain WHOIS is still widely used meanwhile.

WHOIS Privacy Protection

Registering a domain can put your name, email, phone and address in the public record. Three ways to keep them out:

WHOIS privacy / ID protection. The registrar swaps your details for its own proxy contact. Usually free or cheap.
GDPR redaction. Registrars redact personal data by default for EU registrants, and many do it for everyone.
Privacy/proxy registration. A service registers the domain for you through its own entity.

How to Perform a WHOIS Lookup

Online: our Domain/WHOIS Lookup shows the record in a clean layout.
Linux or macOS: whois example.com in a terminal.
Windows: no built-in whois command. Install Sysinternals whois.exe from Microsoft, or call a web API from PowerShell.
RDAP: open https://rdap.org/domain/example.com directly.

Look up an IP instead of a domain and you get the owner of the block (usually the ISP or organization), the RIR that allocated it and the ASN it belongs to. People use WHOIS to see who owns a domain, check whether a name is free, verify a business is real, report abuse, research trademarks and investigate security incidents.

Domain/WHOIS Lookup
Try it on a real address. Free, no account needed.