WHOIS (pronounced "who is") is a protocol and public database that stores registration information about domain names and IP addresses. It was first described in RFC 812 back in 1982 and is still the main tool for identifying domain owners.
What a WHOIS record contains
| Field | Description | Example |
|---|---|---|
| Domain Name | The domain name | example.com |
| Registrar | Domain registrar | ZevsHost, GoDaddy |
| Registration Date | Initial registration date | 2010-05-14 |
| Expiry Date | Expiration date | 2027-05-14 |
| Name Servers | Domain NS servers | ns1.zevshost.net |
| Registrant | Domain owner | Hidden with Privacy Protection |
| Status | Domain status | clientTransferProhibited |
Why WHOIS is needed
- Checking domain availability — make sure the domain is not taken before you buy it
- Identifying the owner — find a contact to negotiate a purchase
- Abuse complaints — report spam or phishing coming from the domain
- Legal investigations — establish who is responsible for violations
- SEO audit — check the age and history of a domain before buying it
Domain statuses in WHOIS
Every domain carries one or several ICANN statuses:
| Status | Meaning |
|---|---|
| clientTransferProhibited | Transfer is locked by the registrar |
| clientDeleteProhibited | Deletion is locked |
| clientUpdateProhibited | Changes are locked |
| pendingDelete | The domain is being prepared for deletion |
| redemptionPeriod | Redemption window (30 days after expiration) |
| ok | Active, no restrictions |
💡 SEO tip: Always check WHOIS before buying a second-hand domain. Domain age affects authority in Google's eyes — a domain registered in 2010 weighs more than a brand-new one.
How to run a WHOIS query
From the Linux/macOS command line:
whois example.comThrough online services:
- who.is — universal
- lookup.icann.org — the official ICANN one
- whois.domaintools.com — with history
WHOIS and GDPR
Since GDPR came into force in 2018, EU registrars are required to hide the personal data of owners. That is why most WHOIS records today show anonymized data or the registrar's details instead of personal contacts.
⚠️ Important: Even when the data is hidden, the WHOIS history of a domain is kept in archive databases (DomainTools, SecurityTrails). Removing it is technically impossible.
Common WHOIS Errors and Confusing Responses
No match for domain "EXAMPLE.COM"
Connection timed out; No response from server
Query rate limit exceeded
Domain Status: clientHold| Response | What it means | What to do |
|---|---|---|
| No match for domain | The domain is genuinely free, or the query went to the wrong server — for example, a .com was queried against a .ua zone WHOIS server | Check that the correct zone's server is being used, or treat the domain as available for registration |
| Connection timed out; No response from server | A local firewall is blocking outbound TCP port 43 (the standard WHOIS protocol port) | Open outbound port 43, or use the registrar's web interface instead of the console command |
| Query rate limit exceeded | Too many WHOIS queries were sent from one IP in a short time — most WHOIS servers throttle requests | Pause between queries, or use the registrar's official API instead of bulk polling |
| Domain Status: clientHold | The registrar has suspended the domain's delegation — usually due to non-payment or a violation of usage rules | The domain owner needs to contact their registrar — only the registrar can lift the status, it doesn't clear automatically |
WHOIS, RDAP, and the Registrar Panel: Comparing Sources
| Source | Response format | When to use it |
|---|---|---|
| Classic WHOIS (port 43) | Unstructured text, format varies between TLDs | A quick manual check from the console |
| RDAP (Registration Data Access Protocol) | Structured JSON, a single format across every registry that supports it | Automation, scripts, bulk domain checks |
| The registrar's account panel | A ready-made interface with real (non-private) data for your own domains | Checking and editing contacts for your own domain |
When WHOIS Doesn't Give You the Answer You Need
- The domain uses Privacy Protection — the owner's real contacts are hidden, and WHOIS will only show the privacy service's data, not the person or company
- You need historical records of ownership changes — plain WHOIS only returns the current snapshot; historical archives like DomainTools are needed for that
- The domain is in a national zone with its own response format (not RDAP-compatible) — automatic parsing built for one zone may not work for another without adjustments
- You need legally admissible proof of ownership for court — a WHOIS printout alone is usually not accepted as sole evidence; an official request to the registrar is needed
How to Verify a WHOIS Response
# Classic query
whois example.com
# Via RDAP — structured JSON instead of plain text
curl -s https://rdap.org/domain/example.com | python3 -m json.tool
# Compare the expiry date from both sources
whois example.com | grep -i "expir"- Compare the Registrar field with the registrar the domain was actually bought from — a mismatch can happen after a domain transfer that hasn't finished yet
- Check that Expiry Date matches the date shown in the registrar's account panel
- If WHOIS shows Privacy Protection data but you need real contacts, send a request directly to the registrar — that's how abuse reports are handled
- For automated checks, compare the RDAP response with classic WHOIS — a mismatch in domain statuses means one source's cache is stale
What happens to a domain after it expires and how not to lose it is covered in domain renewal, and transferring a domain between registrars is covered in domain transfer: a guide. Personal data protection in WHOIS via Privacy Protection is described in WHOIS Privacy Protection.