Whois Lookup
Modern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.
No result yet
Enter the inputs above and press Run. Results appear here in a moment.
Monitor this 24/7 — get alerts on the first failure.
Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our Terms.
What is Whois Lookup?
Whois is the registry record for a domain — who owns it, when it expires, which registrar manages it, what nameservers it currently delegates to, and what status flags are set on it. The classic Whois protocol is from 1982; this tool uses the modern replacement, RDAP (RFC 7480-7484), which returns structured JSON instead of free-form text and has consistent data shapes across registries.
Practically: it's how you find out that the domain you've been paying for is expiring in 11 days. Or that the customer who said "I own example.com" doesn't, the WHOIS contact is some marketing agency from 2017. Or that the domain you want to transfer is in clientTransferProhibited status and needs to be unlocked at the current registrar before the move.
How it works
RDAP discovery + query happens in two steps:
- 1Bootstrap to the right registry — Each TLD has its own RDAP server. We consult the IANA RDAP bootstrap registry (
https://data.iana.org/rdap/dns.json) to map your domain's TLD to the correct base URL — for.comthat's Verisign, for.ioit's Identity Digital, for ccTLDs it's the country's NIC. - 2Query the registry — HTTPS GET to
/<base>/domain/<your-domain>. Cache-bypassed in the tool (force: true) so you're always getting the current registry view, not our internal cache from minutes ago. - 3Parse and surface — We extract the registrar, expiration timestamp, nameservers, status flags (EPP codes), DNSSEC delegation signer record presence, and the raw events list (
registration,expiration,last changed,transfer). Days-until-expiry is computed against the current time.
Some TLDs return less data than others — .com is verbose, some ccTLDs are minimal. That's the registry's choice, not ours; if the registry doesn't expose registrant contact info, RDAP can't either.
When you'd use it
Domain expiry sanity check
Before any major launch tied to a domain, check expiry. Domains expire silently — registrars do send renewal emails, but those land in someone's inbox who left the company three years ago. A 30-day-out warning is normal; less than 14 days is a fire drill.
Pre-acquisition due diligence
You're buying a company. Their primary domain is the asset you actually care about. Whois lookup tells you the registrar (will the transfer go smoothly?), the status flags (is it locked? in dispute?), the nameserver delegation (does it point to infrastructure they actually control?). All before you sign.
Domain transfer prep
Transferring example.com from registrar A to registrar B. Whois lookup confirms the current status. If clientTransferProhibited or serverTransferProhibited, transfer will fail — unlock at current registrar first. If pendingTransfer, an attempt is already in flight.
Phishing / brand abuse investigation
A look-alike domain (exampl3.com, example-support.com) is targeting your users. Whois tells you when it was registered (yesterday is suspicious), which registrar (some are takedown-friendly, others ignore reports), and which nameservers it delegates to (often pointing right back to a hosting provider you can report to).
Verify customer ownership claims
Support flow: customer says "I own this domain, please configure my service against it." Whois the domain — does the registrant info match? Was it registered after they say they bought it? Doesn't have to be airtight, but a fresh registration with anonymised contact info is a yellow flag.
Reading the result
Status flags (EPP codes)
These are domain-level locks set by the registrar or registry. clientTransferProhibited = can't be moved to another registrar. clientUpdateProhibited = nameserver changes blocked. clientDeleteProhibited = can't be deleted. The server* variants are set by the registry directly (gTLD operators) and are harder to override. ok = no locks set, free to update.
Days until expiry
Computed at query time from the registry's expiration timestamp. "Days until" rounds down, so 13.9 days reports as 13 — be conservative with renewal timing. Most registrars auto-renew if billing is set up, but the only guarantee is the registry-side timestamp.
Nameservers
The authoritative DNS servers the registry has on file. These can disagree with what the domain's parent zone actually delegates to (registries sometimes lag behind the registrar's most recent NS change). When in doubt, run a separate NS DNS lookup to see what the parent zone currently advertises.
DNSSEC
Presence of DS records in the registry = the domain is DNSSEC-signed. Absence = unsigned or DS hasn't been published yet. DS record details (key tag, algorithm, digest type) come from the registry; the actual signing keys live in the DNS zone itself.
Events
Registration timestamp = when the domain was first created at this registry. Last changed = most recent nameserver or status update. Transfer = most recent registrar transfer. These are useful for forensics ("was this domain freshly registered for an attack?") and audit trails.
Common pitfalls
"Whois says my domain is expired but it still resolves"
There's a redemption grace period after expiry (typically 30-45 days for gTLDs). The domain is in redemptionPeriod status, won't be re-registerable by anyone else, but DNS keeps resolving until the registry pulls the delegation. You can usually renew during this window for an extra fee — talk to your registrar fast.
Registrant contact info shows "REDACTED FOR PRIVACY"
GDPR + ICANN's Temporary Specification removed most personal registrant data from public Whois in 2018. You'll see REDACTED FOR PRIVACY for individuals, sometimes for organizations. This is normal, not a tool bug. If you need the actual contact for legal/abuse purposes, file an RDAP authorized data access request with the registrar.
Two consecutive lookups return different expiry dates
Could be a recent renewal that the registry hasn't fully replicated, or two different RDAP server replicas with eventual consistency. Re-query in 5 minutes; the values converge fast in practice. If they don't, contact the registrar.
ccTLD returns very little data
Some country-code TLDs run minimal Whois — .de (DENIC) is famously sparse, others don't even expose RDAP. Not a tool limitation; we report whatever the registry chooses to publish.
Run Whois Lookup on every change, not just once.
Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card.
Start freeFrequently asked questions
What's the difference between RDAP and classic Whois?
Why is the registrant contact info hidden?
Can I look up the previous owner of a domain?
How do I find out the expiry date of my own domain?
Expiration field is the registry-side timestamp. If you control the domain, also check your registrar's admin panel; their billing-side expiry might be slightly later if you've already paid for renewal but the registry hasn't been updated yet.What does clientHold mean?
Why does my domain show different nameservers in Whois vs. DNS lookup?
Can I prevent my domain from being transferred without my permission?
clientTransferProhibited does. Most registrars set it by default; if you see it in your Whois output, your domain is protected against unauthorized transfer. To transfer intentionally, you remove the lock first.