What is a WHOIS lookup and how to read the results

A WHOIS lookup answers a simple question: who is behind a domain name? Every domain registration is recorded in a public database, and WHOIS is the protocol you use to query it. The result tells you the registrar, the important dates, the name servers, and the domain's current status. It's one of the first checks any developer, sysadmin or buyer runs on a domain.

What WHOIS actually queries

When a domain is registered, the registrar publishes a record to a WHOIS server run by the registry that manages that top-level domain (Verisign for .com, for example). A WHOIS lookup connects to that server and asks for the record. Modern registries increasingly serve the same data over RDAP (Registration Data Access Protocol), a structured JSON successor to plain-text WHOIS, but the information is the same.

Reading a WHOIS record field by field

A typical record looks intimidating, but only a handful of fields matter most of the time.

• Domain Name — the domain itself, normalised to uppercase.
• Registrar — the company you'd buy or transfer the domain through (GoDaddy, Namecheap, Cloudflare, and so on). If you want to contact the current owner, the registrar is your route.
• Creation Date / Registered On — when the domain was first registered. A domain created fifteen years ago carries more trust than one registered last week.
• Registry Expiry Date — when the registration lapses if not renewed. This is the field to watch if you're hoping to catch a dropping domain, or making sure your own doesn't expire.
• Updated Date — the last time the record changed. A recent update can signal a transfer or a name-server change.
• Name Servers — the DNS servers authoritative for the domain (e.g. ns1.example-dns.com). These tell you who actually runs the domain's DNS, which is often more revealing than the registrar.
• Domain Status — one or more EPP status codes (see below).
• Registrant / Admin / Tech Contact — historically the owner's name, email and address. Since GDPR and ICANN's privacy rules, these are usually redacted or replaced with a privacy-service proxy.

Understanding status codes

The status codes are the most misread part of a WHOIS record. They describe locks on the domain:

• clientTransferProhibited — the registrar has locked the domain against transfers. This is normal and good; it prevents hijacking.
• clientHold — the domain is not being published in DNS, often due to non-payment or a dispute. A live-looking domain in clientHold will not resolve.
• pendingDelete / redemptionPeriod — the domain is on its way to being released after expiry. If you're waiting to register a name, these tell you roughly where it is in the drop cycle.
• ok (or active) — no restrictions.

Why privacy redaction is everywhere now

If you look up a domain and see "REDACTED FOR PRIVACY" or "Data Protected" in the contact fields, that's expected. Registrars mask personal data by default to comply with privacy law, and many sell WHOIS privacy that replaces your details with a forwarding proxy. You can still reach the owner through the registrar's anonymised contact form, but you won't see a raw email or home address the way you could a decade ago.

Practical things a WHOIS lookup tells you

• Is this domain available? No record usually means it's unregistered.
• When does it expire? Useful for renewals or for backordering a name you want.
• Who runs its DNS? The name servers reveal the DNS provider even when contacts are hidden.
• Is it a fresh domain? A brand-new creation date on a domain sending you email is a classic phishing red flag.
• Which registrar handles it? You'll need this to transfer a domain you're buying.

Common gotchas

• WHOIS data can be cached; a change you just made may take time to appear.
• Some ccTLDs (country domains like .de or .uk) run their own WHOIS with different fields and stricter privacy.
• The registrar and the DNS host are often different companies. Don't assume the registrar runs the DNS.

Try it yourself

Run a WHOIS lookup on any domain — your own, a competitor's, or one you're thinking of buying — with our free tool at /tools/whois. It parses the raw record into clean fields so you can read the dates, registrar, name servers and status at a glance, no command line required.

And once you've got the domain you want, you'll need somewhere to point it. Nxeon deploys a fast NVMe VPS with full root access in about a minute — the perfect home for the site behind your new domain. See plans at /vps.