WHOIS is a query and response protocol and directory service that returns registration data about domain names and other internet resources. For domain names, a WHOIS lookup typically shows the registrar, creation and expiry dates, domain status codes, nameservers and, where privacy rules allow, contact details of the registrant.
The protocol is one of the oldest on the internet and is deliberately simple: a client opens a TCP connection to port 43, sends a query string and receives unstructured plain text. That simplicity is also its weakness, which is why gTLD registration data is now provided primarily through its structured successor, RDAP, while the name WHOIS remains the everyday word for looking up who holds a domain.
How a WHOIS lookup works
A WHOIS query follows the referral chain of the domain name system’s registration model. The client first determines which registry operates the top-level domain, queries that registry’s WHOIS server, and, for some TLDs, follows a referral to the registrar’s WHOIS server for fuller contact data.
- The client identifies the TLD of the queried domain, for example
.comor.de. - It finds the registry WHOIS server for that TLD, often through a known list or the IANA WHOIS service.
- It opens a TCP connection to port 43 and sends the domain name followed by a line break.
- The server returns plain text and closes the connection.
- If the response names a registrar WHOIS server, the client may query it as well.
The protocol, specified in RFC 3912, defines only this transport. It defines no data format, no character encoding, no authentication and no standard fields, so each registry formats responses differently, and parsers must handle many variations.
What WHOIS data contains
Registration data falls into technical data, which is always public, and contact data, which is often redacted. The table lists the fields commonly found in domain WHOIS output.
| Field | Content | Usually public |
|---|---|---|
| Domain name and registry ID | Name and internal identifier | Yes |
| Registrar | Accredited company that manages the registration | Yes |
| Creation, update and expiry dates | Lifecycle timestamps | Yes |
| Domain status codes | EPP statuses such as clientTransferProhibited | Yes |
| Nameservers | Authoritative DNS servers for the domain | Yes |
| DNSSEC indicator | Whether the delegation is signed | Yes |
| Registrant, admin and tech contacts | Name, organization, address, email, phone | Often redacted |
Registries differ in model. A thin registry stores only technical data and points to the registrar for contacts, while a thick registry keeps the full record centrally. Most gTLD registries now operate the thick model, while country-code registries follow their own national policies.
Privacy, redaction and the shift to RDAP
For decades, WHOIS published registrants’ names, addresses and phone numbers openly, which fed spam, scams and harassment. Privacy and proxy services emerged to replace personal details with those of an intermediary. Data protection law, in particular the EU General Data Protection Regulation from 2018, then led registries and registrars to redact personal data by default.
The Registration Data Access Protocol (RDAP) addresses the technical weaknesses of WHOIS. It runs over HTTPS, returns JSON, supports internationalized text and allows differentiated access, so authorized parties can see more than anonymous users. ICANN contracts made RDAP the authoritative service for gTLD registration data and removed the obligation to operate port 43 WHOIS in early 2025.
| Aspect | WHOIS | RDAP |
|---|---|---|
| Transport | Plain TCP, port 43 | HTTPS |
| Response format | Free text, varies by server | Standardized JSON |
| Encryption | None | TLS |
| Internationalization | Not defined | Full Unicode support |
| Server discovery | Ad hoc lists | IANA bootstrap registry |
| Access control | Same data for everyone | Tiered access possible |
Redaction created a new problem: security researchers, trademark holders and law enforcement lost easy access to contact data. Requests for non-public registration data now go through registrar disclosure procedures or centralized request systems, where the requester must state a legitimate purpose. Response times range from days to weeks, so investigators increasingly rely on historical records and technical data such as nameservers and creation dates.
Practical uses of WHOIS lookups
Even with redacted contacts, WHOIS and RDAP data answer many operational questions. The table matches common tasks with the fields that serve them.
| Task | Relevant data | What to look for |
|---|---|---|
| Checking domain availability | Registration status | No record or not found response |
| Preparing a domain transfer | Status codes, registrar, dates | No transfer lock, not within 60 days of registration |
| Diagnosing DNS problems | Nameservers, DNSSEC flag | Delegation matches the intended provider |
| Avoiding accidental expiry | Expiry date | Renewal well before the date |
| Investigating phishing domains | Creation date, registrar | Very recent registration, abuse contact |
| Contacting a domain holder | Registrar contact form or privacy email | Relay address instead of personal data |
The term WHOIS also covers lookups for IP address blocks and autonomous system numbers run by regional internet registries, but in the context of domain names it refers to domain registration data.
Limitations and common misunderstandings
- WHOIS data is not verified identity: registrants supply it, and accuracy checks are limited, so false details are common in abusive registrations.
- The registrant is not the hosting provider; a domain can be registered with one company and hosted with another.
- Redacted is not the same as hidden ownership for authorities, who can request disclosure through legal channels.
- Rate limits restrict how many queries a client may send, and bulk harvesting is usually forbidden by terms of use.
- Output differs by TLD, so tools that parse one registry’s text can fail on another.
For reliable automated processing, RDAP should be preferred wherever it is available, while classic WHOIS remains useful for quick manual checks and for TLDs that still run port 43 services.
Put simply
Every domain name is registered, much like a car or a piece of land. WHOIS is the public register you can look things up in. It shows which company registered the domain, when it was created, when it expires and which servers handle it.
In the past it also showed the owner’s name and home address. Today, to protect privacy, those personal details are usually hidden, but the technical facts remain visible. A newer system called RDAP does the same job in a more modern, more organized way.
In practice
An employee of a small accounting firm receives an email asking her to log in to a client portal at a domain that looks almost identical to the firm’s real one. Before clicking, the IT administrator runs a WHOIS lookup on the suspicious domain.
The record shows a creation date only two days earlier, a registrar the firm has never used and redacted contacts. The firm’s own domain, by contrast, was created twelve years ago and is locked against transfer. The administrator reports the lookalike domain through the registrar’s abuse contact listed in the record, blocks it on the company mail filter and warns staff. The registration data, although partly hidden, gives enough evidence to act within minutes.