WHOIS lookup

Three parties behind every domain

Nobody owns a domain name outright. You rent it by the year, and three parties are involved in the lease. The registry runs an extension (Verisign for .com, Nominet for .uk) and keeps the master list of every name under it. The registrar is the shop, the company that takes your payment and files the registration with the registry. The registrant is the customer, who holds the name for as long as the bill gets paid.

The registration record is the registry’s file on that lease. For decades people read it with a protocol called WHOIS. You opened a connection on port 43, sent the name, and got back a block of free text that every registry formatted its own way. RDAP replaces it. The question travels over HTTPS and the answer is structured data with fixed field names, so a program can read it without guessing. Registries of generic extensions have been required to offer RDAP for several years and may now switch port 43 off.

Where this page gets the record

IANA, the body that coordinates the root of the DNS, publishes a list that maps each extension to the address of its RDAP server. We look your extension up in that list and send one request to that server and nowhere else. Many registries hold only part of the file and include a link to the registrar’s own RDAP server, which has the rest. When that link is there, we follow it and merge the two answers. The line under the results names every server we asked.

We don’t open a WHOIS connection on port 43 and we don’t use any third-party WHOIS database. Some extensions aren’t on the IANA list, which is the case for many country codes such as .de, .ru or .cn. For those, the page says so and points you to the registry’s own lookup.

Dates and what happens after expiry

Three dates matter. Registered is the day the current lease started, and it resets if a name is dropped and registered again. Last changed moves on any edit, including a renewal. Expires is the end of the paid period, and the summary flags it when fewer than 45 days remain.

A .com name that isn’t renewed doesn’t vanish that day. It goes through stages, and each one shows up as a status code:

Country-code registries set their own calendar, and some delete a name within days.

Reading the status codes

Status codes are switches. The ones starting with client are set by the registrar, usually from a button in your account. The ones starting with server are set by the registry and are harder to change. The results table explains each code it finds. They come in a few families:

• Locks: clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited and their server twins. They refuse a transfer, a change or a deletion. A healthy domain carries at least the transfer lock, and this page warns when a generic domain has none.
• Holds: clientHold and serverHold take the name out of the DNS. The registration still exists, but the website and mail are down. This is the code to look for when a domain “suddenly stopped working” and nobody touched the server.
• Pending and period codes: something is in progress or happened recently, such as pendingTransfer or addPeriod.
• ok (shown as “active” by RDAP): no restriction at all, which also means no lock.

Why the owner is usually hidden

Until 2018, the record of most domains showed the registrant’s name, street address, phone number and email to anyone who asked, and spammers helped themselves daily. The European data protection regulation (GDPR) put an end to that for people, and the rules for generic extensions followed. Personal fields are now removed and the record says “redacted for privacy”. Company names often stay visible. Separately, many registrars put a privacy or proxy service in the record, a company that lends its name and forwards messages.

This page shows the owner’s name, organization and country when the registry publishes them, and tells you when they’re redacted or replaced by a proxy. It doesn’t try to find out who is behind a redacted record.