WHOIS / RDAP Lookup

Every domain name sits in a registry database run by the organization that operates its TLD - Verisign for .com and .net, EURid for .eu, AFNIC for .fr, and a separate registry per TLD elsewhere. The registry holds the authoritative record: registrar of record, creation and expiry dates, nameservers, and a set of status codes. WHOIS and its modern replacement RDAP are just query protocols for reading that record; they do not describe the website, its hosting, or its traffic.

Traditional WHOIS (RFC 3912) is a plain-text protocol on TCP port 43 with no fixed output format - every registry has historically formatted its fields differently, which is why WHOIS text has always been awkward to parse programmatically. RDAP (RFC 9082 for the query protocol, RFC 9083 for the JSON response schema) fixes this with structured, self-describing JSON and a bootstrap mechanism (RFC 9224) that tells a client which authoritative server to query for a given TLD. Registries are migrating to RDAP as the primary interface; this tool queries RDAP first and falls back to legacy WHOIS text parsing when a registry has no RDAP endpoint.

A registrar is not the same as a registry. The registry (e.g. Verisign) is the sole authority for a TLD; a registrar (e.g. Gandi, OVHcloud, Namecheap) is an ICANN-accredited reseller that lets end users register and manage domains against that registry. The WHOIS record identifies the registrar of record, not necessarily the company the domain owner thinks of as "where I bought it" if the domain has since been transferred.

• Registries: one authoritative operator per TLD (Verisign for .com/.net, AFNIC for .fr, EURid for .eu)
• Registrars: ICANN-accredited resellers through which domains are actually registered and renewed
• RDAP (RFC 9082/9083) is replacing WHOIS as the structured query protocol; legacy WHOIS stays as fallback
• A WHOIS record describes domain registration only - it says nothing about hosting, DNS content, or site traffic

A successful lookup returns a registration date, an update date, and an expiry date. The gap between registration and expiry is not a fixed lease - it renews on payment, typically one to ten years at a time depending on what the registrant chose. A domain nearing its expiry date without a renewal is not deleted immediately: most registries run it through an expired/auto-renew grace period, then a redemption period during which the original registrant can still restore it for a fee, and only then release it back to general registration.

Nameservers listed in the record are the domain's current delegation - the servers the registry tells the rest of the internet to ask for DNS records. This is a separate layer from the DNS records themselves: WHOIS shows which nameservers are authoritative, not what those nameservers actually answer with for A, MX, or TXT queries.

The status field carries EPP status codes (RFC 5731), not free text. "clientTransferProhibited" means the registrar has locked the domain against transfer requests - a normal anti-hijacking default, not a problem. "serverHold" means the registry itself has suspended the domain, usually for abuse or a legal order, and is the one status worth investigating. A domain showing only "ok" or "active" has no restrictions applied.

DNSSEC status shows whether the domain has a signed delegation (a DS record at the registry pointing to a signing key at the nameservers) - this is registry-level configuration, separate from whether the nameservers themselves are running DNSSEC-capable software.

Historically a WHOIS record exposed the registrant's name, organization, email, phone, and postal address in full text. Since the GDPR took effect in 2018, ICANN's Temporary Specification and the contract changes that followed it require registrars to redact personal registrant, admin, and technical contact data for natural persons by default - most results today show placeholder text like "REDACTED FOR PRIVACY" instead of a real name or email. This is a policy outcome, not a lookup failure: the underlying data still exists at the registrar, and most registrars publish a relay or web form to reach the registrant without exposing their direct details.

Separately, many registrars sell an optional privacy or proxy service that substitutes the registrar's own contact details for the registrant's on the public record regardless of jurisdiction - this predates GDPR redaction and is still common for registrants outside the EU/EEA or for domains registered before default redaction became standard.

A domain WHOIS result can carry three distinct contact roles: registrant (the domain's owner), administrative (who manages registration decisions), and technical (who manages DNS/server configuration). For most personal and small business registrations, all three point to the same person and are redacted identically.

A query on an unregistered domain returns an availability result rather than a registration record - there is no registrar, no dates, and no nameservers to show, because the domain does not exist in the registry. This is a live check, not a promise: another registrar could accept a registration for the same name seconds after the query.

A domain does not become available for new registration the moment it expires. Most gTLD registries follow a sequence set out in ICANN's base registry agreement: an expired/auto-renew grace period (commonly around 45 days) where the registrant can still renew at the normal price, then a redemption period (commonly around 30 days) where restoring the domain costs a redemption fee on top of renewal, then a pending-delete window (commonly around 5 days) with no further action possible, after which the name releases back to general availability. ccTLDs like .fr set their own timelines under AFNIC's rules, which can differ from the gTLD sequence.