WHOIS Lookup: How to Find Domain Ownership & Registration Details

WHOIS (pronounced "who is") is a query-and-response protocol used to look up information about the registered owner of a domain name or IP address. When someone registers a domain, they provide contact information that is stored in a WHOIS database maintained by domain registrars and registries.

A WHOIS lookup reveals details such as the domain registrar, registration and expiry dates, nameservers, and sometimes the registrant's name, organization, email, and phone number. It's an essential tool for network administrators, cybersecurity professionals, journalists, and anyone investigating domain ownership.

A typical WHOIS record includes:

• Domain Name: The fully qualified domain name being queried.
• Registrar: The company where the domain was registered (e.g., GoDaddy, Namecheap, Cloudflare).
• Registration Date: When the domain was first registered.
• Expiry Date: When the domain registration expires and needs renewal.
• Updated Date: When the WHOIS record was last modified.
• Nameservers: The DNS servers responsible for the domain's DNS records.
• Domain Status: Codes indicating the domain's current state (e.g., clientTransferProhibited, active).
• Registrant Contact: The domain owner's name, organization, and contact details (if not privacy-protected).

The amount of visible information depends on whether the domain owner has enabled WHOIS privacy protection.

WHOIS privacy (also called domain privacy or WHOIS guard) is a service offered by most registrars that replaces the domain owner's personal contact information with the registrar's proxy details. This prevents your name, email, phone number, and address from being publicly visible in the WHOIS database.

Since the introduction of GDPR in 2018, many registrars automatically redact personal information from WHOIS records for domains registered by individuals in the EU. ICANN has also relaxed its requirements around publishing personal data in WHOIS records.

Even with privacy enabled, the following information is still visible: registrar name, registration and expiry dates, nameservers, and domain status codes. The domain itself remains publicly queryable — only the contact details are hidden.

Checking domain availability: Before registering a domain, a WHOIS lookup confirms whether it's already taken and when it might expire.

Investigating suspicious websites: Security researchers and fraud investigators use WHOIS to identify who operates a suspicious or malicious website. Recently registered domains with hidden ownership are often red flags.

Verifying business legitimacy: If you're doing business with a company online, a WHOIS lookup can confirm how long they've had their domain and whether the registration details match their claimed identity.

Resolving domain disputes: In trademark and cybersquatting cases, WHOIS records provide evidence of when a domain was registered and by whom.

Troubleshooting DNS issues: When debugging email or website problems, checking nameservers and registration status via WHOIS can reveal configuration problems.

You can perform a WHOIS lookup using LookMyIP's free WHOIS tool at lookmyip.com/whois. Simply enter any domain name and get instant results showing registrar details, dates, nameservers, and available contact information.

You can also use the command line: on macOS or Linux, open Terminal and type whois example.com. On Windows, you can use third-party tools or PowerShell modules for WHOIS queries.

For IP address WHOIS lookups, the process is similar but queries Regional Internet Registries (RIRs) such as ARIN (Americas), RIPE NCC (Europe), APNIC (Asia-Pacific), AFRINIC (Africa), and LACNIC (Latin America).

• Always check multiple WHOIS sources if one returns limited data. Different registries may have different levels of detail.
• Pay attention to the domain status codes. A status like "redemptionPeriod" means the domain has expired and is in a grace period before being released.
• The creation date can help gauge legitimacy — a brand-new domain claiming to be an established company is suspicious.
• If WHOIS shows "Registrant: REDACTED FOR PRIVACY," the owner is using a privacy service. This is normal and doesn't necessarily indicate anything malicious.
• WHOIS data is cached and may not update instantly after changes. Allow 24–48 hours for WHOIS records to reflect recent modifications.

WHOIS is old. The protocol dates to 1982 and returns unstructured text with no defined schema, which is why every registrar's output looks different and why parsing it reliably is genuinely hard.

RDAP (Registration Data Access Protocol) is its replacement. It returns JSON over HTTPS, uses a documented data model, supports internationalised field values properly, and allows tiered access so authenticated parties can receive fields that anonymous queries cannot. ICANN required all gTLD registries and registrars to run RDAP services from 2019, and in January 2025 ICANN formally sunset the WHOIS requirement for gTLDs — RDAP is now the authoritative source.

You can query it directly with nothing but curl:

curl -s https://rdap.org/domain/example.com | jq

The response is structured, so pulling out a single field is trivial:

curl -s https://rdap.org/domain/example.com | jq '.events'

That returns the registration, expiry and last-changed events as discrete objects with ISO-8601 timestamps, instead of the free-text date formats that classic WHOIS scatters across registrars.

In practice, most lookup tools — including this one — query RDAP first and fall back to legacy WHOIS for the country-code TLDs that have not migrated yet. Several ccTLDs, notably .de and .uk, still run their own WHOIS servers with their own field conventions.

The status codes in a WHOIS or RDAP response are the most useful and most ignored part of the record. They are called EPP status codes, and they tell you what can and cannot currently happen to the domain.

Two of these matter more than the rest.

Seeing plain ok on your own domain means anyone who compromises your registrar account can transfer it away immediately. Turning on clientTransferProhibited costs nothing and is the single highest-value security setting a domain owner can change.

Seeing pendingDelete on a domain you want tells you roughly when it becomes available: gTLDs follow a fixed lifecycle of 30 days redemption, then 5 days pending delete, then release.

Before May 2018, WHOIS records for most gTLDs showed the registrant's full name, postal address, phone number and email. GDPR ended that. ICANN's Temporary Specification, later made permanent, requires registrars to redact personal data for registrants in scope.

What you now see instead is a redaction placeholder and an anonymised forwarding address, something like a1b2c3@contact.gandi.net. Mail sent there is relayed to the real registrant, so the contact path survives even though the identity does not.

Several things did not change, and they are the fields that actually matter for most investigations:

• Creation date. Always visible. A domain registered eleven days ago that is sending you invoices is a red flag no amount of redaction hides.
• Registrar. Always visible, and it tells you where to file an abuse report.
• Nameservers. Always visible, and they often reveal shared infrastructure across a group of related domains.
• Status codes. Always visible.
• Organisation. Frequently visible, because GDPR protects natural persons rather than companies. Many corporate registrations still show the company name.

Registrations by legal entities, and registrations outside the EEA with registrars that chose not to apply blanket redaction, may still show full details. Country-code TLDs set their own policy — .us still publishes registrant data in full, while .de was already restrictive long before GDPR.

Does a WHOIS lookup tell the domain owner I looked them up?

No. Queries are anonymous and are not reported to the registrant. Registries do rate-limit queries from a single source to prevent bulk harvesting, which is why automated tools sometimes return an empty or throttled response.

Why does WHOIS say a domain is available when the registrar says it is taken?

Usually caching, or a premium listing. Some registrars also display domains as "taken" when they are actually available but priced as premium inventory. Check RDAP directly — if there is no registration record, the domain genuinely is unregistered.

Can I find who owns a domain with privacy protection enabled?

Not directly, and attempting to circumvent it is generally not productive. Legitimate routes exist: send mail to the anonymised forwarding address, file a complaint with the registrar's abuse contact, or, for genuine trademark disputes, use the UDRP process, which compels disclosure. Historical WHOIS archives sometimes hold pre-privacy records, though their accuracy degrades over time.

How often is WHOIS data updated?

Registry data updates in near real time when a change is made. Third-party WHOIS mirrors and historical databases can lag by hours or days, which is why a freshly transferred domain sometimes shows its old registrar for a while.

What is the difference between the registrar and the registry?

The registry operates the TLD — Verisign runs .com, PIR runs .org. The registrar is the retailer you buy through, such as Namecheap or Cloudflare. Registry data is authoritative; registrar data is what you manage day to day.