What is WHOIS? Domain Registration Lookup Explained

What is WHOIS?

WHOIS(pronounced "who is") is an internet protocol used to query databases that store the registration information for domain names, IP address blocks, and autonomous systems. Think of it as the public record system for the internet — just as property records tell you who owns a house and when it was purchased, WHOIS records tell you who registered a domain name and when.

When someone registers a domain name like example.com, the registrar (the company providing the registration service, such as GoDaddy, Namecheap, or Cloudflare) is required to collect certain information about the registrant and submit it to the domain registry (the organization responsible for the top-level domain, like Verisign for .com). This data is then made available through WHOIS.

A typical WHOIS record includes:

• The registrar handling the domain registration
• Registration date (when the domain was first created)
• Expiration date (when the registration expires)
• Name servers (which DNS servers answer for the domain)
• Status codes (the domain's current state)
• Registrant contact information (often redacted for privacy)

History of WHOIS — From ARPANET to ICANN

WHOIS is one of the oldest protocols still in active use on the internet. Its origins trace back to the earliest days of computer networking.

How WHOIS Works

When you perform a WHOIS lookup, a chain of queries happens behind the scenes to find the authoritative source for a domain's registration data.

The WHOIS ecosystem involves several distinct organizations at different levels:

How to Read a WHOIS Record

A WHOIS record contains several categories of information. Here is what each field means and why it matters:

EPP Status Codes Explained

Every domain has one or more EPP (Extensible Provisioning Protocol) status codes that describe its current state. These codes control what operations can be performed on the domain. They fall into two categories: client codes (set by the registrar at the registrant's request) and server codes (set by the registry).

For maximum security, important domains should have clientTransferProhibited, clientDeleteProhibited, and clientUpdateProhibited status codes — collectively known as a "registrar lock." High-value domains should also request registry lock (the server* equivalents), which requires manual verification by the registry to modify.

WHOIS vs RDAP — The Modern Replacement

RDAP (Registration Data Access Protocol) was designed by the IETF to address the significant limitations of the legacy WHOIS protocol. Since 2024, ICANN requires all gTLD registries and registrars to support RDAP.

One of the biggest practical advantages of RDAP is its structured JSON output. With legacy WHOIS, every registry and registrar returned data in slightly different text formats, making automated parsing extremely fragile. RDAP solves this completely — every response follows the same JSON schema regardless of the provider.

The Domain Lifecycle

Understanding the domain lifecycle is essential for interpreting WHOIS records correctly. A domain moves through several phases from registration to potential deletion:

GDPR and WHOIS Privacy

The General Data Protection Regulation (GDPR), which took effect on May 25, 2018, fundamentally changed the WHOIS landscape. Before GDPR, WHOIS records typically included the registrant's full name, address, phone number, and email address. After GDPR, most of this personal data is redacted from public WHOIS records.

What Changed

• Personal contact data — Names, addresses, phone numbers, and email addresses are replaced with "REDACTED FOR PRIVACY" or similar notices.
• Organization names — May still be visible for registrations made under a company name, depending on the registrar's policies.
• Technical data — Registration dates, expiry dates, name servers, and status codes remain publicly available as they are not considered personal data.
• Anonymized contact — Some registrars provide a web form or anonymized email relay to contact the registrant without revealing their identity.

Real-World Use Cases

Domain Research & Purchasing

Before buying a domain from a third party, WHOIS lookup reveals the registrar, registration history, and expiry date. This helps verify ownership claims, negotiate prices (domain age correlates with value), and determine if a domain might soon become available.

Cybersecurity & Fraud Investigation

Security analysts use WHOIS data to investigate phishing domains, malware distribution sites, and spam campaigns. Key indicators include: very recent registration dates, privacy-protected registrations on suspicious domains, registrars known for lax abuse policies, and name servers associated with malicious infrastructure.

Trademark & Brand Protection

Companies monitor WHOIS registrations for domain names that infringe on their trademarks (typosquatting, cybersquatting). WHOIS data helps identify the registrant for legal action under the UDRP (Uniform Domain-Name Dispute-Resolution Policy).

SEO & Competitive Analysis

Domain age (derived from the creation date in WHOIS) is a ranking factor in search engines. SEO professionals use WHOIS data to analyze competitor domains, track domain history, and evaluate the trustworthiness of potential link sources.

DNS Troubleshooting

When a domain is not resolving correctly, WHOIS reveals the authoritative name servers, whether DNSSEC is enabled, and whether any status codes (like serverHold) are preventing resolution. This is a critical first step in DNS debugging.

Expiry Monitoring

Businesses track the expiry dates of their own domains and critical partner domains to prevent accidental lapses. WHOIS-based monitoring tools can alert you weeks before a domain expires, giving time to renew.

Best Practices