WHOIS is a public lookup that tells you about a domain's registration: which registrar it is with, when it was created, when it expires, which nameservers it uses and, sometimes, who owns it. It dates back to the early internet, when every network operator needed a way to find who was responsible for a name.
How a WHOIS lookup works
The original WHOIS is a simple text protocol on port 43: you send a domain, a server sends back a block of plain text. Each registry and registrar ran its own server with its own formatting, which made results inconsistent. Its successor, RDAP (Registration Data Access Protocol), returns the same kind of data as structured JSON over HTTPS. ICANN now treats RDAP as the official source for generic endings like .com, though most websites and tools still call any such search a "WHOIS lookup".
What you will and will not see
Since the EU's GDPR took effect in 2018, most registrars redact personal details for individual owners, and many add a free privacy service that replaces your contact information with a proxy. So a typical result today shows the registrar, the key dates, the status codes such as clientTransferProhibited, and the nameservers, but not a name or phone number. Country-code endings each set their own rules.
Example: checking a domain before you buy a business
A buyer is taking over a local landscaping company and wants the website included. A lookup on the company's domain shows it was registered in 2014, expires next March, and sits at a registrar under a privacy proxy. That tells the buyer to make the seller transfer the domain into the new owner's account as part of the deal, and to check the renewal date so it does not lapse during the handover.
When WHOIS is useful to a small business
- Finding where your own domain is registered when nobody remembers.
- Checking an expiry date you cannot see in any account.
- Seeing whether a name you want is taken, and by roughly whom.
- Investigating a lookalike domain used in phishing emails, then reporting it to that registrar's abuse contact.
Mistakes around WHOIS
- Turning privacy off to "look legitimate". Exposed contact details mostly attract spam and fake renewal invoices.
- Paying scam "domain expiry" letters. Mailings that copy WHOIS data to sell you renewals or "search listings" are not from your registrar.
- Entering false details. Registrars can suspend names with deliberately inaccurate registration data, and you may struggle to prove ownership later.
- Trusting old copies. Third-party history sites can show outdated records; check the live result.
Related terms
- Domain registrar: holds the data a lookup returns.
- Domain name: the thing being looked up.
- Nameservers: listed in every lookup result.
- DNS: the separate system that actually routes traffic for the name.