How to Check Domain WHOIS: Online Services and Command Line

Checking WHOIS is a standard step when buying a domain, researching competitors, or investigating abuse. Let's go through every available method.

1. Command Line (Linux/macOS/Windows)

# Basic query
whois example.com

# Through a specific WHOIS server
whois -h whois.verisign-grs.com example.com

# Key fields only (grep)
whois example.com | grep -i "registrar\|expir\|creat\|name server"

2. Online WHOIS Services

Service	Features	URL
ICANN Lookup	Official, all TLDs	lookup.icann.org
who.is	Convenient interface	who.is
DomainTools	WHOIS history, reverse lookup	whois.domaintools.com
SecurityTrails	Historical data, DNS	securitytrails.com
Whoxy	WHOIS API, bulk queries	whoxy.com

3. WHOIS API for Developers

# Example with curl (whoisxmlapi.com)
curl "https://www.whoisxmlapi.com/whoisserver/WhoisService?
  apiKey=YOUR_KEY&domainName=example.com&outputFormat=JSON"

How to Read a WHOIS Response

A sample response and what each line means:

Domain Name: EXAMPLE.COM
Registrar: Example Registrar, Inc.
Updated Date: 2023-08-01T12:00:00Z    # Last change
Creation Date: 2010-05-14T00:00:00Z   # First registration
Registry Expiry Date: 2027-05-14T...  # Expires
Name Server: NS1.REGISTRAR.COM        # DNS servers
DNSSEC: unsigned                      # No DNSSEC
Status: clientTransferProhibited

Checking a Domain's History

Before buying a used domain it is important to check its past:

DomainTools Whois History — the full record of owners
Archive.org Wayback Machine — what the domain used to host
Google: site:example.com — what Google knows about the domain
Ahrefs/Semrush — backlinks and SEO history

⚠️ History penalty: The domain may have been used for spam, link farms or paid links. Such a domain can carry accumulated Google penalties. Always review its history before buying.

💡 Tip: A good used domain: 5+ years old, stable ownership, clean history with no spam, backlinks from authoritative sites.

Common WHOIS Query Errors

Message	Cause	Fix
No match for domain "EXAMPLE.COM"	The domain is free, or it was just registered and hasn't propagated to the database yet (up to 24 hours delay)	Wait a day and retry, or check the status on the registrar's website
whois: connect: Connection refused	The whois package isn't installed locally, or the provider blocks outbound port 43	Install the package: `apt install whois`, or use an online service instead of the console
Query limit exceeded (WHOIS API)	The free request limit for the chosen WHOIS API has been exceeded for the day or month	Wait for the limit to reset, or upgrade to a paid API tier
Empty response for .ua domains	The .ua registry is "thin" — full contact data is stored by the registrar, not the central WHOIS	Request the data directly from the registrar where the domain was bought
Temporary block on frequent queries	Public WHOIS servers limit the number of queries from one IP per unit of time	Space out requests, or switch to a paid WHOIS API with a higher limit

Comparing WHOIS and RDAP

Parameter	WHOIS	RDAP
Response format	Free-form text (port 43)	Structured JSON (over HTTPS)
Machine readability	Low, needs a separate parser per TLD	High, one format across registrars
TLD coverage	Nearly all TLDs, including legacy ones	Growing list, not every TLD has migrated to RDAP yet

When WHOIS Doesn't Give an Answer

The domain is protected by WHOIS Privacy — the owner's real data is replaced by the registrar's proxy contacts
The .ua zone uses a "thin" WHOIS model — contact data is held by the specific registrar, not the central registry
The domain was registered literally moments ago — the data hasn't replicated to the public WHOIS database yet
The hosting or provider network blocks outbound requests to port 43 — only the web interface works, not the console command

A full rundown of every WHOIS field and term is in "What Is WHOIS: Complete Reference Guide". If WHOIS is needed to vet a used domain before buying it, the transfer process is covered in "Domain Transfer: A Step-by-Step Guide".

Verifying the Result

Confirm the data was retrieved correctly and matches the requested domain:

# Check the domain in the response against what was requested (guards against typos)
whois example.com | grep -i "domain name"

# The alternative RDAP protocol, if WHOIS doesn't respond
curl -s "https://rdap.org/domain/example.com" | grep -i "ldhName"

# Confirm the domain is actually delegated (otherwise WHOIS status can be misleading)
dig NS example.com +short

If the owner's data is needed to register a domain for a company, the process is covered in "Registering a Domain for a Legal Entity: Documents".

Frequently asked questions

Can the real owner of a domain be contacted if their details are hidden behind WHOIS Privacy?

Directly — usually not: the response shows the registrar's proxy service contacts instead of the actual owner. Getting in touch only works through the form or mailbox that proxy service provides, and the message reaches the owner already forwarded. Real contact details are revealed by the registrar only on an official request, not through an ordinary message from a stranger.

Does a domain's original registration date (Creation Date) stay the same after a change of ownership?

Yes, under a normal ownership transfer the Creation Date field keeps the original first-registration date rather than resetting — the domain simply continues counting its age. That is handy for judging a domain's age before buying it, but it says nothing about reputation on its own; check the history of owners and content separately through services like DomainTools.

Is it worth using RDAP instead of a plain WHOIS query in a custom script?

If what matters is automatic processing of the response in code, RDAP is more convenient: the answer arrives as structured JSON instead of free-form text needing a separate parser per domain zone. But not every zone has migrated to RDAP yet, so for wide coverage a script sometimes has to support both protocols in parallel rather than picking only one.

What should be done if the whois command simply isn't found in the terminal?

Most often the reason is that the relevant package is simply not installed — on most Linux distributions it can be added with the standard package manager in one command. If the error persists after installing it, check whether the provider's network blocks outbound requests on the needed port, in which case a web service works better than the console.