Whois Domain Lookup

WHOIS returns registration information for domains or IP-related resources when that data is published by the registry, registrar, or regional internet registry. It may include registrar name, name servers, creation and expiration dates, status codes, contact or privacy-proxy details, and technical notes. The tool supports domain research, expiration monitoring, abuse reporting, trademark checks, incident response, and understanding which organization is responsible for a name. WHOIS data is not always complete or current: privacy regulations, proxy services, RDAP migration, and registry policies can all change what is visible. For legal, security, or ownership decisions, results should be cross-checked with official registrar or registry sources.

The WHOIS protocol is specified in RFC 3912 and is one of the simplest internet protocols still in active use: a client opens a TCP connection to port 43 on a WHOIS server, sends the query string followed by `\r\n`, and the server replies with free-form ASCII text and closes the connection. There is no authentication, no structured schema, and no required field order — every TLD registry returns its own text layout, which is why the parser has to handle each TLD's quirks individually. Lookups follow a two-step referral chain. The IANA root WHOIS at `whois.iana.org` knows which registry runs each TLD: for `.com` it returns `refer: whois.verisign-grs.com`, the thin registry that holds only the registrar and name-server info. To get full registrant details a second query goes to the sponsoring registrar's WHOIS (e.g. `whois.markmonitor.com` for many corporate domains). Country-code TLDs differ: `.cn` is served by `whois.cnnic.cn` (CNNIC), `.de` by `whois.denic.de` (with most personal data suppressed), and `.jp` by `whois.jprs.jp`. The whole referral chain is plain text, so a browser cannot speak raw port 43 directly — this tool proxies through a server-side fetch that performs the TCP query and returns the parsed response. RDAP (Registration Data Access Protocol), defined in RFC 7480-7484 and 9082-9083, is the structured successor. It is a RESTful JSON-over-HTTPS API at `https://rdap.verisign.com/com/v1/domain/example.com` style URLs, with consistent field names, internationalisation, and access control. ICANN required gTLD registries and registrars to deploy RDAP by August 2019, and as of 2025 ICANN's Registration Data Consensus Policy phases out legacy WHOIS (port 43) for gTLDs in favour of RDAP, with many registries still operating WHOIS in parallel during the transition window. Since GDPR took effect in May 2018, registrant name, email, address, and phone for natural persons in the EEA are redacted by default and shown as "REDACTED FOR PRIVACY" or routed through the registrar's anonymized abuse contact.

• WHOIS protocol: RFC 3912, TCP port 43, plain-text request (`domain\r\n`) and unstructured ASCII response, no auth, no schema.
• Two-step referral: IANA root (`whois.iana.org`) returns the TLD's WHOIS server; the registry WHOIS returns the sponsoring registrar's WHOIS for full data.
• Common status codes (EPP, RFC 5731): `clientTransferProhibited` (registrar lock), `serverDeleteProhibited`, `clientHold` (DNS suspended), `pendingDelete`.
• GDPR (effective May 2018) redacts EEA natural-person registrant data; replies show `REDACTED FOR PRIVACY` and route contact through registrar abuse channels.
• RDAP (RFC 7480-7484, 9082-9083) is the structured JSON-over-HTTPS successor; ICANN's 2025 Registration Data Consensus Policy phases out legacy port-43 WHOIS for gTLDs in favour of RDAP, with parallel operation during the transition window.
• Browsers cannot open raw TCP port 43, so client-side WHOIS tools require a server proxy that performs the socket query and returns parsed JSON.
• Critical date fields use ISO 8601: `Creation Date`, `Updated Date`, `Registry Expiry Date`; a domain enters a 30-day redemption grace period after expiry before deletion.