What Is WHOIS and How to Look Up Domain Ownership
What a WHOIS or RDAP lookup shows about a domain, why owner details are often hidden, and how to read the registrar, status codes, nameservers and expiry dates.
Table of Contents
WHOIS is a lookup that shows the registration data of a domain name: which registrar manages it, when it was created and when it expires, its status codes, its nameservers, and the registrant's contact details where they are public. Today the same information is increasingly served through RDAP (Registration Data Access Protocol), a modern, structured replacement for the old WHOIS protocol.
Most people use WHOIS to check whether a domain is available, when it expires, who manages it, or whether it is locked against transfers.
What a lookup shows
| Field | What it tells you |
|---|---|
| Domain name | The domain looked up |
| Registrar | The company managing the registration |
| Creation date | When the domain was first registered |
| Updated date | When the record last changed |
| Expiry date | When the current registration ends |
| Status codes | Locks and other states (see below) |
| Nameservers | Which DNS servers are authoritative for the domain |
| DNSSEC | Whether the domain is signed |
| Registrant, admin, tech contacts | Often redacted or replaced by a privacy service |
Why owner details are often hidden
Since 2018, many registrars redact personal data in public lookups to comply with privacy laws such as the GDPR, and many registrants use privacy services. You may see "REDACTED FOR PRIVACY", a privacy service's details, or only the organisation name and country. See domain privacy protection.
To contact a hidden registrant, use the contact form or anonymised email shown by the registrar.
Common domain status codes
Status codes come from the EPP protocol. The most common ones are:
| Status | Meaning |
|---|---|
ok / active |
No restrictions |
clientTransferProhibited |
Registrar lock is on; transfers are blocked (normal and recommended) |
clientUpdateProhibited |
Changes are locked by the registrar |
clientDeleteProhibited |
Deletion is locked |
serverTransferProhibited |
The registry blocks transfers (for example within 60 days of registration) |
clientHold / serverHold |
The domain does not resolve; often unpaid, unverified or under dispute |
redemptionPeriod |
Expired and in redemption |
pendingDelete |
About to be released |
pendingTransfer |
A transfer is in progress |
ICANN publishes an explanation of every EPP status code.
Practical uses
- Before registering: confirm a name is taken and see when it expires.
- Before a transfer: check for locks and the creation date (60-day rules). See domain transfer explained.
- When a site stops working: check whether the domain has expired or is on hold.
- When choosing a registrar: confirm who currently manages your domain.
- For security: check that the nameservers and lock status are what you expect. See preventing domain hijacking.
How to do a lookup
- Use the ServerNeed WHOIS lookup, or ICANN's lookup service, which uses RDAP.
- From a terminal,
whois example.comworks on macOS and Linux. - For country-code domains, the registry's own lookup may give the most complete result.
WHOIS vs DNS lookups
WHOIS shows registration data. DNS lookups show where the domain points right now (A, MX and other records). If you need to check whether a DNS change has spread, use a DNS lookup instead; see DNS propagation explained.
Reading a lookup: a worked example
An illustrative lookup result for a domain someone wants to buy:
Domain Name: EXAMPLESHOP.COM
Registrar: Example Registrar, Inc.
Creation Date: 2019-03-14
Updated Date: 2026-02-10
Registry Expiry Date: 2027-03-14
Domain Status: clientTransferProhibited
Domain Status: clientDeleteProhibited
Name Server: NS1.PARKINGHOST.EXAMPLE
Name Server: NS2.PARKINGHOST.EXAMPLE
DNSSEC: unsigned
Registrant Organization: REDACTED FOR PRIVACY
What it tells you:
- Registered since 2019 and renewed recently: the holder is actively keeping it.
- Expires March 2027: no sign it is about to drop.
- Transfer and delete locks are on: normal, good security practice.
- Nameservers belong to a parking service: the domain is probably not in active use and may be for sale.
- Registrant redacted: contact the holder through the registrar's contact form or a marketplace listing.
From this, the realistic options are making an offer through the registrar's contact channel or a domain marketplace, rather than waiting for it to expire. See buying a domain that is already taken.
Checking your own domains regularly
Run a lookup on your own domains a few times a year:
- the expiry date matches what you expect, and auto-renew is on in your account;
- the transfer lock is on;
- the nameservers are the ones you use;
- the registrar is the one you think it is.
An unexpected change in any of these is a reason to log in to your registrar account immediately. See preventing domain hijacking.
Frequently Asked Questions
Can I find out who owns any domain?
Not always. Personal data is often redacted. Organisation names may be visible, and the registrar can forward messages.
Why does the expiry date look wrong after I renewed?
Lookups can be cached for a while, and some registries show the auto-renew date. Check again later or look at your registrar account.
Is WHOIS being replaced?
Yes. RDAP has replaced the legacy WHOIS protocol for generic top-level domains, providing structured data and better access control, though the term "WHOIS" is still widely used.
Related reading
For the bigger picture, read domain names explained, and use the ServerNeed domain search to check availability.
Sources
Last updated 7 October 2026
