What Is WHOIS, and How Do You Look Up Domain Ownership?

Sooner or later, almost everyone who works with websites needs to answer a simple question: who owns this domain? Maybe you want to buy a name that is already taken, check when a client's domain expires, report abuse, or confirm that your own registration details are correct. The traditional tool for all of these jobs is WHOIS, a decades-old lookup system that returns the registration record for a domain name. This article explains what WHOIS is, how the protocol works under the hood, what each field in a WHOIS record means, why so much of it is now redacted, and how to run lookups from a browser, the command line, and your own scripts. If you are looking for ownership because you want to acquire a domain, pair this with how to buy a domain name that's already taken.

What Is WHOIS?

WHOIS (pronounced "who is") is both a protocol and a public directory of domain registration data. When a domain is registered, the registrar records information about the registration: who the registrant is, which registrar manages it, which name servers it uses, when it was created and when it expires, and which status codes are applied to it. A WHOIS lookup queries that data and returns it as plain text.

The system dates back to the early ARPANET, when a single directory listed the people responsible for network resources. Today it is spread across hundreds of servers run by registries and registrars, but the basic idea is unchanged: anyone can ask "who is responsible for this name?" and get an answer.

WHOIS is used for:

• Checking domain ownership before trying to buy a domain.
• Finding the registrar so you know where a domain is managed.
• Checking expiration dates for your own domains or ones you want to acquire.
• Reading status codes like clientTransferProhibited to see whether a domain is locked.
• Reporting abuse such as phishing, spam, or malware, using the registrar's abuse contact.
• Investigating trademark and security issues, including cybersquatting and fraud.

It also works for IP addresses and autonomous system numbers, which are handled by Regional Internet Registries such as ARIN and RIPE NCC. This article focuses on domain names.

How the WHOIS Protocol Works

The WHOIS protocol, defined in RFC 3912, is about as simple as an internet protocol can be:

1. The client opens a TCP connection to a WHOIS server on port 43.
2. It sends the query, usually a domain name, followed by a carriage return and line feed.
3. The server sends back a block of plain text and closes the connection.

That's all there is to it. There is no authentication, no standard output format, no encryption, and no way for the server to indicate errors other than in free text. Those limitations are a big part of why the industry has moved to RDAP, covered below.

Registries, Registrars, and Thin vs. Thick WHOIS

Registration data lives in two places:

• The registry, which runs the top-level domain (Verisign for .com and .net, Public Interest Registry for .org, and so on).
• The registrar, the company that sold you the domain.

For some TLDs the registry holds only a thin record: the domain name, registrar, name servers, dates, and statuses. The contact details live only at the registrar. .com and .net have historically worked this way. Other TLDs use a thick model, where the registry holds the full record including contacts.

This matters for lookups. A query to the .com registry WHOIS server returns the registrar and a Registrar WHOIS Server line, and you need a second query to that registrar's server to see contact information. Most whois command-line clients follow that referral automatically. If the registry-versus-registrar split is new to you, see registry vs. registrar.

Finding the Right WHOIS Server

Each TLD has its own WHOIS server. IANA, which maintains the root zone, publishes the server for every TLD, and you can query IANA itself to find it:

whois -h whois.iana.org com

The relevant line in the output looks like this:

whois:        whois.verisign-grs.com

You can then query that server directly:

whois -h whois.verisign-grs.com example.com

Reading a WHOIS Record

Here is a trimmed, representative WHOIS response for a .com domain from a registrar's WHOIS server:

Domain Name: EXAMPLEBRAND.COM
Registry Domain ID: 1234567890_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.example-registrar.com
Registrar URL: https://www.example-registrar.com
Updated Date: 2026-03-14T09:12:44Z
Creation Date: 2015-06-02T17:40:11Z
Registrar Registration Expiration Date: 2027-06-02T17:40:11Z
Registrar: Example Registrar, LLC
Registrar IANA ID: 9999
Registrar Abuse Contact Email: abuse@example-registrar.com
Registrar Abuse Contact Phone: +1.5555550100
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: Example Brand Ltd
Registrant State/Province: CA
Registrant Country: US
Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant
Name Server: NS1.EXAMPLEDNS.NET
Name Server: NS2.EXAMPLEDNS.NET
DNSSEC: unsigned

The most useful fields:

Field	What it tells you
Registrar and IANA ID	The company managing the domain, and its unique ICANN accreditation number
Creation Date	When the domain was first registered (resets if the domain is dropped and re-registered)
Expiration Date	When the current registration term ends
Updated Date	The last time something in the record changed
Domain Status	EPP status codes such as locks, holds, and grace periods
Registrant Organization / Country	Often the only registrant details left visible after redaction
Name Server	Which DNS provider is authoritative for the domain
Registrar Abuse Contact	Where to report phishing, malware, or spam
DNSSEC	Whether the domain has DNSSEC signing delegated

The Contact Roles

Traditional WHOIS records show up to four contacts: registrant, administrative, technical, and billing. The registrant is the legal holder of the domain; the others are roles that may or may not be the same person. ICANN's newer Registration Data Policy has reduced which of these registrars must collect. The differences matter a lot when there is a dispute, so they are covered in detail in registrant vs. admin vs. technical contact.

Status Codes

The Domain Status lines use EPP status codes. clientTransferProhibited means the domain is locked against transfers; ok means no restrictions; redemptionPeriod means the domain has expired and been deleted but can still be restored. For a full breakdown, see what registrar lock is.

Why So Much WHOIS Data Is Redacted

If you look up a domain today, you will often see REDACTED FOR PRIVACY instead of a name, address, and email. There are two reasons.

Data protection law. When the EU's General Data Protection Regulation (GDPR) took effect in May 2018, publishing personal data of registrants in a public directory became a legal problem. ICANN adopted a Temporary Specification that let registrars and registries redact personal data, later replaced by a permanent Registration Data Policy. In practice, many registrars now redact personal data for all registrants worldwide rather than trying to determine who is covered by which law.

Privacy and proxy services. Separately, many registrants pay for (or receive free) WHOIS privacy, where a service's details are shown instead of theirs. This predates GDPR and still matters, because redaction is not universal. See what WHOIS privacy protection is and whether you need it.

What is usually still visible:

• The registrar and its abuse contacts.
• Creation, update, and expiration dates.
• Status codes and name servers.
• Often the registrant's organization, state or province, and country.

What is usually hidden: the registrant's name, street address, phone number, and email address. Instead, registrars must provide a way to contact the registrant, typically a web form or an anonymized forwarding email address.

How to Look Up Domain Ownership

1. Use ICANN Lookup in a Browser

The simplest neutral tool is ICANN Lookup at lookup.icann.org. Enter a domain and it queries the authoritative sources for gTLDs and shows the registry and registrar data side by side. It uses RDAP under the hood. Registrar websites and third-party sites also offer WHOIS search, but third-party sites may show cached data or bury results under domain sales offers.

2. Use the whois Command

macOS and most Linux distributions include a whois client (on Debian or Ubuntu, install it with sudo apt install whois). A basic lookup:

whois example.com

Filter for the fields you care about:

whois example.com | grep -iE "registrar:|creation date|expir|domain status|name server"

Some clients query the registry only and stop. If you see a Registrar WHOIS Server line but no contact data, query that server directly:

whois -h whois.example-registrar.com example.com

Replace the host with the server named in the registry's response.

3. Query Port 43 Yourself

Because the protocol is just text over TCP, you can query a WHOIS server with nc (netcat):

printf 'example.com\r\n' | nc whois.verisign-grs.com 43

Or with a few lines of Python, using only the standard library:

import socket


def whois_query(domain: str, server: str, port: int = 43) -> str:
    with socket.create_connection((server, port), timeout=10) as sock:
        sock.sendall(f"{domain}\r\n".encode("utf-8"))
        chunks = []
        while True:
            data = sock.recv(4096)
            if not data:
                break
            chunks.append(data)
    return b"".join(chunks).decode("utf-8", errors="replace")


def lookup(domain: str) -> str:
    tld = domain.rsplit(".", 1)[-1]
    iana = whois_query(tld, "whois.iana.org")
    server = None
    for line in iana.splitlines():
        if line.lower().startswith("whois:"):
            server = line.split(":", 1)[1].strip()
            break
    if not server:
        return f"No WHOIS server listed for .{tld}; try RDAP instead."
    return whois_query(domain, server)


if __name__ == "__main__":
    print(lookup("example.com"))

The script first asks IANA which server handles the TLD, then queries that server. It does not follow the registrar referral, which you could add by parsing the Registrar WHOIS Server line and making a second query.

4. Use RDAP Instead

For anything you want to automate, RDAP is the better choice. It returns structured JSON over HTTPS, and it is now the authoritative source for gTLD registration data:

curl -sL https://rdap.org/domain/example.com | jq '{name: .ldhName, status, events}'

RDAP is covered in depth in what RDAP is and how it is replacing WHOIS.

WHOIS Is Being Retired for gTLDs

ICANN required gTLD registries and registrars to run RDAP services starting in 2019. Effective 28 January 2025, ICANN's contracts no longer require gTLD registries and registrars to operate port 43 WHOIS, and RDAP became the definitive source of gTLD registration data. Many operators still answer WHOIS queries, but some have shut their servers down or stopped maintaining them, so you may see errors, timeouts, or less complete data than RDAP provides.

Country-code TLDs set their own policies. Many ccTLDs still run WHOIS as their primary service, and some offer only WHOIS or only a web lookup. For .uk, .de, .ca, and other ccTLDs, check the registry's own website for the authoritative tool. For background on ccTLDs, see what a country-code TLD is.

What WHOIS Can and Cannot Tell You

WHOIS is useful, but it is easy to over-read. Keep these limits in mind:

• It does not prove who controls the domain. The registrant of record is the legal holder, but the person who controls the registrar account may be someone else, such as a web agency.
• Accuracy is not guaranteed. Registrars are required to verify some contact data and act on inaccuracy reports, but false or stale data still exists.
• Creation dates can mislead. A domain that expired and was re-registered shows a new creation date, hiding its earlier history. Use archive tools to learn more, as described in how to check a domain's history.
• Redacted is not the same as unavailable. Law enforcement, trademark holders, and others with a legitimate interest can request non-public data through registrars or ICANN's request systems, but nothing guarantees disclosure.
• Formats vary. Every server formats its output differently, which makes parsing WHOIS text fragile.

Contacting a Domain Owner When Data Is Redacted

If you need to reach a registrant and their details are hidden:

1. Use the registrar's contact form or relay email. The WHOIS or RDAP record usually links to it.
2. Check the website itself for contact pages, imprint pages, or social profiles.
3. Try the organization name, if it is shown, through normal business channels.
4. Use a domain broker if you want to buy the domain and prefer not to negotiate directly.
5. Request disclosure through the registrar if you have a legal basis, such as a trademark or law enforcement matter.

If you are trying to recover a domain that should be yours, the process is different and is covered in how to recover a domain registered under someone else's name.

Checking Your Own WHOIS Record

It is worth looking up your own domains once or twice a year:

• Is the registrant you or your company? If an agency or former employee is listed, fix it now.
• Is the registrant email one you still read? Registrars send verification and renewal notices there, and failed verification can lead to suspension.
• Is the domain locked? You should see clientTransferProhibited at minimum.
• When does it expire? Make sure auto-renew is on and the payment method is current.

ICANN also requires registrars to send registrants a reminder to review their data, so if you receive a "WHOIS data reminder" email from your registrar, it is usually legitimate. Still, log in through your registrar's website rather than clicking links, because WHOIS reminders are a common phishing lure.

---

WHOIS FAQ

Conclusion

WHOIS is the long-standing public directory of domain registration data. A lookup tells you which registrar manages a domain, when it was created and when it expires, which name servers and status codes apply, and, when it is not redacted, who the registrant is. The protocol itself is a simple text exchange on port 43, which makes it easy to use from whois, nc, or a short script, but also hard to parse reliably.

For gTLDs, RDAP has now taken over as the authoritative source, and personal data is widely redacted under privacy law. In practice, that means using ICANN Lookup or RDAP for reliable results, relying on registrar contact forms when you need to reach a registrant, and regularly checking your own records so the right person or company is listed as the owner of your domains.

Here are some useful references for going deeper on WHOIS:

1. RFC 3912: WHOIS Protocol Specification — the short specification for the port 43 protocol.
2. ICANN: ICANN Lookup — ICANN's official lookup tool for gTLD registration data.
3. ICANN: Registration Data Access Protocol (RDAP) — background on RDAP and the transition away from WHOIS.
4. IANA: Root Zone Database — lists every TLD, its registry operator, and its WHOIS and RDAP details.