Skip to content
ProbeDNS

WHOIS Lookup

WHOIS is the registration record for a domain: who sponsors it, when it was created, when it expires, which nameservers the registry has on file, and which status codes are locking or unlocking it. This tool queries the authoritative registry directly over port 43 and shows you the raw answer.

How a WHOIS lookup actually works

WHOIS is one of the simplest protocols on the internet, defined in RFC 3912: open a TCP connection to port 43, send the query terminated by CRLF, and read free-form text until the server closes the socket. There is no schema, no authentication, and no guaranteed field names — which is why two WHOIS tools can disagree about the same domain.

Finding the right server takes three steps, and this tool performs all three on every lookup:

  1. Ask IANA. whois.iana.org holds the root zone database and answers with the WHOIS server delegated for each TLD. For .com that is whois.verisign-grs.com; for .lol it is whois.nic.lol.
  2. Query the registry. The registry is authoritative for dates, EPP status codes, DNSSEC state, and the delegation nameservers. This is the data that governs whether your domain resolves and whether it can be transferred.
  3. Follow the registrar referral once. Thin registries such as Verisign publish only a pointer — Registrar WHOIS Server: — and the registrar holds the contact details. This tool follows that referral a single time and merges the two responses, with registry values always winning.
Registry values are never overwritten by registrar values. When the two disagree about an expiry date, the registry date is the one the domain actually dies on — a registrar may show its own internal renewal date, which is usually earlier.
Read the full explanation of whois lookup results ↓

Reading the fields that matter

Dates

Creation date is the moment the name first entered the registry and never changes for the life of the registration — dropping and re-registering a domain resets it. Expiry is a hard deadline: at expiry the domain typically enters a 30-day auto-renew grace period, then a 30-day redemption period during which only the registrant can recover it (for a fee, often $80–200), then a 5-day pending-delete window, after which it is released to the public. Updated date changes on almost anything: a nameserver edit, a lock change, a contact update.

EPP status codes

Status codes are the most under-read part of a WHOIS record and the most operationally important. Codes prefixed client were set by your registrar; codes prefixed server were set by the registry and you cannot remove them yourself.

StatusWhat it meansAction
clientTransferProhibitedRegistrar transfer lock is onNormal and desirable — unlock only when transferring
clientHold / serverHoldThe domain has been pulled from the zoneThe domain will not resolve at all — contact the registrar immediately
pendingDeleteFinal stage before public releaseRecovery is no longer possible through the registrar
redemptionPeriodExpired and deleted; recoverable at a premiumRedeem now — this window is short
autoRenewPeriodPassed expiry and auto-renewedConfirm payment went through; the renewal can still be reversed
ok / activeNo restrictions at allTurn on a registrar transfer lock

Nameservers

The nameservers in WHOIS are the *delegation* — what the registry tells the world. They are not necessarily the NS records inside the zone. When those two disagree you get intermittent, provider-dependent resolution failures that are maddening to debug. Compare this list against the NS record lookup; if they differ, the registry list is the one resolvers follow.

Why so many fields say "redacted"

Since GDPR took effect in 2018, ICANN's Temporary Specification has required registrars to withhold registrant name, email, address, and phone from public WHOIS for most domains, replacing them with "REDACTED FOR PRIVACY" or an anonymised relay address. Many registrars apply it globally rather than only to EU registrants, and privacy-proxy services (Domains By Proxy, Withheld for Privacy, Super Privacy Service) redact by default on top of that.

Redaction does not affect the fields that matter for operations. Dates, status codes, registrar identity, DNSSEC state, and nameservers are still published and still authoritative. If you genuinely need registrant contact details — for a trademark dispute or a legal notice — the route is a request to the registrar's abuse or legal contact, which remains published, or ICANN's Registration Data Request Service.

Some ccTLDs publish almost nothing over WHOIS. DENIC (.de) omits creation dates entirely; several registries are now RDAP-only or web-form only. When a field is missing here, it is because no server published it — the tool never fills a gap with an estimate.

RDAP: the structured replacement

RDAP (Registration Data Access Protocol, RFC 7483) returns JSON over HTTPS instead of free-form text over a cleartext socket, with proper internationalisation, standard field names, and the ability to authenticate for differentiated access. ICANN required gTLD registries and registrars to run RDAP from 2019, and the contractual requirement to run WHOIS is being retired. In practice both are still available for most gTLDs today; WHOIS remains the only option for a number of ccTLDs. See RDAP vs WHOIS for what changes in day-to-day use.

The same lookup from your terminal

whois google.com | grep -Ei "registrar:|creation date|expiry date|status|name server"

   Registrar: MarkMonitor Inc.
   Creation Date: 1997-09-15T04:00:00Z
   Registry Expiry Date: 2028-09-14T04:00:00Z
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Name Server: NS1.GOOGLE.COM
Full record, following the registrar referral automatically
# 1. which server is authoritative for the TLD?
whois -h whois.iana.org com | grep '^whois:'
whois:        whois.verisign-grs.com

# 2. ask the registry (the "domain " prefix forces an exact match)
whois -h whois.verisign-grs.com "domain google.com"

# 3. follow the referral for thick data
whois -h whois.markmonitor.com google.com
The three steps by hand — IANA, then the registry, then the registrar

Once you know the registration is healthy, the next checks are usually the nameserver delegation and how long is left before renewal — the domain age checker turns the same registry dates into age and days-to-expiry.

Frequently asked questions

Why does WHOIS show different nameservers than my DNS provider?
WHOIS shows the delegation the registry holds; your DNS provider shows what is inside the zone. If you changed nameservers at the provider but not at the registrar, resolvers still go to the old ones. The registry list on this page is what the internet follows — make the registrar match your provider, then re-check with the NS lookup.
The registrant name says "REDACTED FOR PRIVACY" — can I still find the owner?
Not through public WHOIS. Since GDPR, registrars withhold personal contact data by default. Legitimate routes are the registrar abuse contact (still published in every record), ICANN's Registration Data Request Service, or a court order. Registrant country and the registrar itself often remain visible, which is enough for most abuse reports.
What happens between the expiry date and the domain being deleted?
For most gTLDs: roughly 30 days of auto-renew grace where the registrar can still restore it cheaply, then 30 days of redemptionPeriod where only the registrant can redeem it at a premium fee, then 5 days of pendingDelete, then release. The domain usually stops resolving at the start of that sequence, not at the end — so an expired domain is an outage long before it is a loss.
Why did my WHOIS query get rate-limited or return nothing?
Registries limit queries per IP aggressively — CentralNic and Verisign both throttle at low thresholds. This tool caches every answer for an hour and uses a slower rate-limit bucket for that reason. If a lookup fails, wait a minute rather than retrying immediately; repeated hammering gets an IP blocked for far longer.
Can I look up WHOIS for a subdomain?
No. Registration data exists only for registrable domains — the name you actually pay for. mail.example.com has no WHOIS record of its own; query example.com. For multi-part suffixes such as .co.uk you register at the second level, so example.co.uk is the queryable name.
What does "DNSSEC: unsigned" mean here?
It means no DS record is published at the registry, so the zone is not covered by the DNSSEC chain of trust even if the nameservers themselves sign responses. Publishing a DS record is the step that actually turns DNSSEC on. Verify the result with the DNSSEC checker — a signed zone with no DS at the parent is a common half-finished configuration.
Is the WHOIS creation date reliable for judging a domain's reputation?
It is reliable as a fact — the registry publishes it — but it means less than people assume. A domain that expired and was re-registered by a new owner gets a fresh creation date, and a very old domain can have changed hands and purpose many times. Treat it as one signal alongside the certificate history, mail authentication records, and current hosting.

Related guides

RDAP vs WHOIS: What Changed?

The structured successor to WHOIS and what it means for lookups.

When Does My Domain Expire? How to Check

Reading WHOIS expiry dates and what actually happens after expiry.