WHOIS Lookup

WHOIS is one of the oldest directory services on the internet. The current protocol, RFC 3912, is almost trivially simple: a client opens TCP port 43, sends a query string followed by CRLF, and the server returns free-form text before closing the connection. There is no authentication, no standard output schema, no character-set negotiation and no way to signal errors except through prose such as 'No match for'. Every registry and registrar formats its response differently, which is why WHOIS parsers rely on heuristics and why fields like the expiration date appear under labels such as 'Registry Expiry Date', 'paid-till' or 'expire'.

Domain data is split between two parties. The registry operates the TLD (for example the .com or .org database) and records the sponsoring registrar, name servers, EPP status codes and key dates. The registrar holds the customer relationship and the contact details. Status codes come from the EPP domain mapping in RFC 5731: clientTransferProhibited is a normal registrar lock, clientHold or serverHold remove the domain from the zone so it stops resolving, and redemptionPeriod or pendingDelete indicate that the name has expired and is on its way to being released. For gTLDs, an expired domain typically passes through an auto-renew grace period of up to 45 days, a 30-day redemption period and a 5-day pending-delete phase; ccTLDs set their own rules.

The Registration Data Access Protocol (RDAP) was designed to replace port 43. It runs over HTTPS and returns structured JSON (RFC 7480, 7481, 9082 and 9083), with an IANA bootstrap registry (RFC 9224) that tells clients which server is authoritative for each TLD, IP block or ASN. RDAP supports internationalized data, standard error codes and differentiated access, so authenticated parties can see more than anonymous users. ICANN made RDAP the definitive source for gTLD registration data and ended the contractual requirement for registries and registrars to run port-43 WHOIS on 28 January 2025, although many servers still answer.

Privacy has reshaped both protocols. Since the EU General Data Protection Regulation took effect in May 2018, registrars redact personal data of registrants by default, replacing names, addresses and emails with 'REDACTED FOR PRIVACY' or a web form or anonymized relay address. Legal entities may still appear, and many ccTLDs apply their own disclosure policies. IP address WHOIS is served by the five RIRs and remains largely public for network holders, including the abuse contact that should receive spam or attack reports.

This tool runs a standard WHOIS client for the domain or IPv4 address you enter, extracts the registrar, creation and expiration dates, name servers and any registrant fields that are not redacted, and shows the raw response below. It warns when the parsed expiration date is less than 30 days away or already in the past, and reports an informational status when the registry says the name is not found.