DEV Community

Michael Lip
Michael Lip

Posted on • Originally published at zovo.one

WHOIS Lookups: What Domain Registration Data Tells You

Every domain name has registration data: who registered it, when, through which registrar, and when it expires. This data is stored in the WHOIS database and is publicly queryable. Or at least, it used to be fully public. GDPR changed that in 2018, and now much of the registrant information is redacted. But the data that remains is still useful.

What WHOIS tells you

A WHOIS lookup on a domain returns:

Domain name and status. Whether the domain is active, in a redemption period (recently expired and recoverable), or pending delete.

Registration dates. Created date, updated date, and expiration date. The created date tells you how old the domain is. Older domains generally have more authority for SEO purposes.

Registrar. Which company the domain was registered through (GoDaddy, Namecheap, Cloudflare, etc.). This is useful when you need to transfer a domain or resolve DNS issues.

Name servers. Which DNS servers are authoritative for the domain. This tells you where the domain's DNS is hosted, which may be different from where the website is hosted.

Registrant information. Name, organization, email, phone, and address of the domain owner. Post-GDPR, this is usually redacted for domains registered through privacy-conscious registrars. US-based registrars sometimes still show this data.

Practical use cases

Checking domain availability. A WHOIS lookup that returns "No match" means the domain is not registered. But a domain can be unregistered and still not available (reserved by the registry, premium domain, etc.).

Investigating phishing domains. A suspicious email links to "mybank-secure-login.com." A WHOIS lookup shows it was registered yesterday, through a registrar known for abuse-friendly policies. Red flag.

Finding domain owner contact info. You want to buy a domain that is parked or not in active use. WHOIS (or the registrar's RDAP data) may provide contact information, or at least tell you which registrar to contact for a potential purchase inquiry.

Monitoring domain expiration. If a competitor's domain or a domain you want is approaching its expiration date, WHOIS tells you when. Most domains have a 30-day grace period after expiration before they become available.

Verifying business legitimacy. A company claims to have been established in 2010. Their domain was registered in 2024. That discrepancy is worth investigating.

Technical troubleshooting. DNS not resolving? Check WHOIS for the nameservers. If they are wrong or missing, that explains the DNS failure. If the domain has expired, the nameservers may have been removed.

RDAP: the successor to WHOIS

Registration Data Access Protocol (RDAP) is the modern replacement for WHOIS. Key differences:

  • Structured data. WHOIS returns unstructured text. RDAP returns JSON. This makes programmatic parsing reliable instead of fragile.
  • Standardized format. WHOIS output varies by registrar. RDAP has a defined schema.
  • Access control. RDAP supports authenticated access, allowing differentiated responses (more data for legitimate purposes like law enforcement).
  • Internationalization. RDAP supports Unicode properly. WHOIS was designed for ASCII.

Most registries now support RDAP, and ICANN has been transitioning away from WHOIS. However, the whois command-line tool and most lookup services still use the WHOIS protocol as a fallback.

Bulk WHOIS and rate limits

WHOIS servers typically rate-limit queries to prevent abuse. Attempting to scrape WHOIS data for large lists of domains will result in blocks. Legitimate bulk lookup services exist but are usually paid.

For occasional lookups, the command-line whois tool works well:

whois example.com
Enter fullscreen mode Exit fullscreen mode

For programmatic access, RDAP is preferred:

curl https://rdap.verisign.com/com/v1/domain/example.com
Enter fullscreen mode Exit fullscreen mode

I built a WHOIS lookup tool at zovo.one/free-tools/whois-lookup that queries both WHOIS and RDAP, presents the results in a clean, readable format, and highlights the key fields: registration dates, expiration, registrar, nameservers, and available contact information. Enter a domain, get the registration details.

I'm Michael Lip. I build free developer tools at zovo.one. 500+ tools, all private, all free.

Top comments (0)