WHOIS is the system for looking up who a domain name or IP address is registered to, along with key facts such as the registrar, creation and expiry dates, name servers and status. Today most personal contact details are redacted for privacy, and the old WHOIS protocol has largely been replaced by RDAP, its structured successor.
WHOIS dates back to the early internet, when a single directory listed the people responsible for each network so administrators could reach each other when something broke. The registries and registrars that manage domain names and IP addresses still publish registration data today, and it remains one of the first places to look when you research a domain, plan a purchase, or report abuse.
What a WHOIS record shows
A typical domain record contains the following fields. The exact labels vary between registries.
| Field | What it means |
|---|---|
| Registrar | The company the domain was registered through, plus its abuse contact email and phone. |
| Creation date | When the domain was first registered. A very recent date can be a warning sign on a site asking for payment details. |
| Updated date | When the registration record last changed, such as after a renewal or a name server change. |
| Expiry date | When the current registration period ends unless it is renewed. |
| Name servers | The authoritative DNS servers for the domain, which reveal the DNS host in use. |
| Status codes | Machine-readable flags such as clientTransferProhibited or redemptionPeriod. |
| DNSSEC | Whether the domain is signed with DNSSEC. |
| Registrant, admin, tech contacts | The people or organizations responsible for the domain, now usually redacted. |
Understanding status codes
Status codes are some of the most useful fields. A few common ones:
okoractive: no special restrictions.clientTransferProhibited: the registrar's transfer lock is on, which protects against unauthorized transfers. It is normal and recommended.clientHold/serverHold: the domain is not published in DNS, often because of non-payment, a dispute or an abuse complaint.redemptionPeriod: the registration lapsed and was deleted, but the former owner can still restore it, usually for a fee.pendingDelete: the domain is about to be released and will soon become available to register again.
Privacy, GDPR and redacted data
For most of WHOIS's history, the registrant's name, postal address, email and phone number were published for anyone to read. That made WHOIS a goldmine for spammers and scammers, and many owners paid for "privacy" or "proxy" services that replaced their details with those of a forwarding company.
The turning point was the EU's General Data Protection Regulation, which took effect on 25 May 2018. ICANN responded with a temporary specification that allowed registrars and registries for generic TLDs to redact personal data, and most did so worldwide rather than only for EU residents. As a result, a typical record today shows "REDACTED FOR PRIVACY" or similar in place of the owner's personal details, often with only the registrant's country or state left visible.
You can usually still contact the owner through an anonymized email address or a web form provided by the registrar. Law enforcement, intellectual property holders and security researchers can request the underlying data, and ICANN operates a system for such requests, but disclosure is not guaranteed. Country-code TLDs set their own policies, so what you see varies between, for example, .uk, .de and .us.
WHOIS vs RDAP
Classic WHOIS is a very simple protocol: a client connects to a server on TCP port 43, sends a domain name, and gets back plain text. There is no standard format, no built-in internationalization, no authentication and no secure transport, so every registry's output looks slightly different and is hard to parse reliably.
RDAP (Registration Data Access Protocol) was standardized by the IETF to fix these problems. It works over HTTPS and returns structured JSON, which means:
- Responses have consistent, machine-readable fields across registries.
- Queries are encrypted in transit.
- Clients can find the right server automatically through bootstrap files published by IANA.
- It supports internationalized names and, in principle, tiered access where authenticated users can see more data.
The transition is effectively complete for generic TLDs: in January 2025, ICANN made RDAP the definitive source of registration data for gTLDs such as .com, .net and .org, and registries and registrars are no longer required to run port-43 WHOIS services. Many still do, and plenty of people still say "WHOIS" for any registration lookup, but behind the scenes modern tools increasingly use RDAP. Our WHOIS lookup tool queries RDAP directly.
WHOIS for IP addresses
WHOIS and RDAP also cover IP addresses and autonomous system numbers. These are not managed by domain registrars but by five Regional Internet Registries (RIRs), each responsible for a part of the world:
| RIR | Region |
|---|---|
| ARIN | United States, Canada and parts of the Caribbean |
| RIPE NCC | Europe, the Middle East and parts of Central Asia |
| APNIC | Asia-Pacific |
| LACNIC | Latin America and parts of the Caribbean |
| AFRINIC | Africa |
An IP WHOIS record shows the address range (for example 198.51.100.0/24), the organization it is assigned to, the country of registration, the date of allocation and, importantly, an abuse contact. Sometimes a large range is registered to an ISP while smaller sub-ranges are reassigned to its business customers, so you may see several nested records. IP registration data usually lists organizations rather than individuals, so it is much less affected by privacy redaction.
The related autonomous system number tells you which network routes the address. Note that the country in IP WHOIS is where the holder is registered, which is not always where the address is used; an IP lookup with geolocation data gives a better estimate of physical location.
Practical uses for WHOIS
Checking your own domain's expiry
An expired domain takes your website and email offline. Look up your domains periodically, confirm the expiry date and that auto-renew is on, and make sure the registrar has a current email address for you. After expiry, most gTLD registrars allow a grace period for normal renewal, followed by a redemption period with a higher restore fee, before the name is deleted and released. The exact timings depend on the registry and registrar.
Researching a domain you want
If a name is taken, WHOIS shows when it expires, whether it is in redemption, and which registrar holds it, which helps if you want to contact the owner or wait for it to drop. Our domain availability checker tells you quickly whether a name is free to register.
Spotting phishing and scams
A shop or bank lookalike registered a few days ago, with redacted details and an unfamiliar registrar, deserves suspicion. Domain age is not proof either way, but it is a useful signal.
Reporting abuse
For spam, phishing or malware on a domain, the registrar's abuse contact and the hosting provider's abuse contact (found via IP WHOIS of the site's address) are the right places to send reports. ICANN-accredited registrars are required to publish an abuse contact and respond to reports.
whois example.com or whois 203.0.113.25. RDAP servers answer plain HTTPS requests in the form /domain/example.com or /ip/203.0.113.25, so you can even query them with curl once you know the registry's RDAP base URL from the IANA bootstrap files.Frequently asked questions
Why does WHOIS say "REDACTED FOR PRIVACY"?
Since GDPR took effect in 2018, most registrars hide personal contact data by default. The domain is still registered normally; the owner's details are simply not published. You can usually reach them through the registrar's contact form or anonymized email.
Is WHOIS the same as RDAP?
They serve the same purpose but are different protocols. WHOIS returns free-form text over port 43, while RDAP returns structured JSON over HTTPS. For gTLDs, RDAP is now the authoritative source.
Can WHOIS tell me who is behind an IP address?
It tells you which organization the address block is registered to, typically an ISP, hosting company or business. It does not identify an individual customer; only the ISP can match an address to a subscriber, normally in response to legal process.
How accurate is WHOIS data?
Dates, registrar, name servers and status come directly from the registry and are reliable. Contact details are supplied by the registrant and may be outdated or hidden behind a privacy service.