You found the perfect domain name. You type it into a registrar, hold your breath — and it's taken. The listing says "unavailable," and that's all you get. But somewhere there's a record of exactly who owns it, when they registered it, and when it expires. That record is called WHOIS, and knowing how to read it is one of the most useful skills in domaining.
WHOIS (pronounced "who is") is the internet's ownership directory. Every registered domain name has a WHOIS record, maintained by the registrar or registry that manages it. In this guide you'll learn what WHOIS is, what a record actually tells you, how to look one up in under a minute, and how to read the status codes that reveal whether a "taken" domain might actually be buyable.
What WHOIS actually is
WHOIS is a query-and-response protocol defined in RFC 3912 (published 2004), with roots going back to RFC 812 from 1982 — the early internet's NICNAME/WHOIS directory. When you run a WHOIS lookup, your query goes to the database of the registrar (or registry) responsible for that domain, and it returns the registration record as plain text.
The reason the data exists at all is contractual: under ICANN's Registrar Accreditation Agreement (RAA), every ICANN-accredited registrar must collect registration data from customers and make a defined subset of it publicly available. That's why WHOIS works across registrars — Namecheap, GoDaddy, Dynadot, Porkbun, Cloudflare Registrar, and hundreds of others all publish records in the same basic format. If you want to try one right now, Nomlen's free WHOIS checker runs the lookup for any domain in seconds, no signup.
What a WHOIS record contains
A typical record has five groups of information. Here's what each one means and why you'd care:
- Domain identity: the domain name itself and its ID at the registry. Confirms you're looking at the right record.
- Registrar details: which registrar manages the domain (e.g., Cloudflare, Inc. or Porkbun LLC) and its IANA ID. Useful because some registrars make transfers and contact requests easier than others.
- Important dates: creation date, last-updated date, and expiry date. The expiry date is the single most useful field — it tells you when a domain you want might drop or become renewable.
- Name servers: which DNS servers the domain points to (e.g.,
ns1.cloudflare.com). This often reveals the hosting or DNS provider even when the site itself is parked. - Registrant contact data: name, organization, email, phone, address — if it's visible. For most domains today, this section is redacted (more on that below).
- Status codes: EPP codes like
clientTransferProhibitedthat describe the domain's current state. These deserve their own section — keep reading.
The GDPR change: why most owner data is hidden now
If you used WHOIS before 2018, you remember the old days: full names, email addresses, phone numbers, street addresses — all public. That ended on May 25, 2018, when the EU's General Data Protection Regulation (GDPR) took effect. Publishing personal data of EU registrants without a legal basis became a liability, so ICANN issued a Temporary Specification requiring registrars to redact personal data from public WHOIS for most gTLD registrations.
Here's the before-and-after:
Field | Before May 2018 | Today (2026) |
|---|---|---|
Registrant name | Public | Redacted in most gTLD records ("REDACTED FOR PRIVACY") |
Registrant email | Public | Redacted, or replaced with an anonymized forwarding address |
Phone / address | Public | Redacted |
Registrar, dates, name servers, status codes | Public | Still public — this is the useful part that remains |
Organization name | Public | Sometimes still shown (treated as non-personal in some policies) |
So can you still find out who owns a domain? Often, yes — just not always from the public record alone. The legitimate path is ICANN's Registration Data Request Service (RDRS), launched in November 2023, which lets you submit a standardized request for nonpublic data to the registrar, who decides whether to disclose it. Many registrars also provide an anonymized contact form on the redacted record. What you should not do is trust random "unmask WHOIS" sites — they're usually harvesting your queries.
WHOIS vs RDAP: the protocol replacing it
WHOIS is old, inconsistent (every registrar formats output slightly differently), and has no standard way to authenticate users. Its successor is RDAP — the Registration Data Access Protocol, defined in RFCs 7480–7485 (2015). ICANN required all gTLD registries and registrars to offer RDAP by August 26, 2019, and RDAP is now the canonical source for registration data.
WHOIS (RFC 3912) | RDAP (RFCs 7480–7485) | |
|---|---|---|
Output format | Free-form text, varies by registrar | Structured JSON — machine-readable, consistent |
Transport | Port 43 (plain text) | HTTPS |
Internationalized domains | Patchy encoding handling | Native UTF-8 support |
Access tiers | One public level | Supports authenticated, tiered access (public vs. accredited requesters) |
Status in 2026 | Still widely offered, gradually de-emphasized | ICANN's required standard; the future default |
For everyday use the difference barely matters — tools like ICANN Lookup query both. But if you're building anything programmatic (monitoring expiry dates across a portfolio, say), RDAP's JSON output is what you want.
How to look up who owns any domain (3 ways)
All three are free and take under a minute:
- Nomlen's WHOIS checker — type the domain into the domain WHOIS checker, get the parsed record with registrar, dates, name servers, and status codes highlighted. Fastest option if you're already researching names.
- ICANN Lookup — at
lookup.icann.org, the official lookup run by ICANN itself. It queries the registry and registrar and shows both, plus RDAP data. Best for an authoritative answer. - RDAP directly — for the technically inclined,
https://rdap.verisign.com/com/v1/domain/EXAMPLE.COM(for .com/.net) returns the raw JSON record. Every registry publishes its RDAP base URL in the IANA RDAP bootstrap registry.
One caution: some "free WHOIS" websites log every domain you look up — and domain front-running, while rarer than legend suggests, is a real concern with shady lookup tools. Stick to established tools (registrars, ICANN, or reputable checkers) when researching names you actually intend to register. For checking whether a name is free in the first place, see our guide on how to check domain availability.
Reading a WHOIS record like a pro: domain status codes
The most underused part of a WHOIS record is the status field. These EPP (Extensible Provisioning Protocol, RFC 5731) codes tell you exactly what's going on with a domain — and they're the difference between "taken forever" and "might be available soon." The codes you'll see most:
Status code | What it means | What it tells you |
|---|---|---|
clientTransferProhibited | Registrar-level lock: domain can't be transferred to another registrar | Normal for active domains; the owner turned on transfer lock (good security practice) |
clientDeleteProhibited / clientUpdateProhibited / clientRenewProhibited | Registrar-level locks against delete, update, renew | Standard protection; often set together with the transfer lock |
serverTransferProhibited (and other server* codes) | Registry-level lock, set above the registrar | Common on high-value or dispute-adjacent domains |
serverHold | Registry has deactivated the domain (no DNS resolution) | Often legal/UDRP disputes or registry policy action — watch it |
redemptionPeriod | Expired; in the ~30-day grace window where only the old owner can restore it (for a fee) | The owner may still reclaim it — but if they don't, it's heading for release |
pendingDelete | Past redemption; deletion in ~5 days, then it drops | This is the window backorder services (DropCatch, SnapNames) target |
ok / active | No locks, normal operating state | A normally-held domain |
The practical play: you want a taken domain. Its record shows redemptionPeriod and an expiry date that passed weeks ago. That domain is very likely about to drop — place a backorder with a drop-catching service now rather than waiting and hoping. If it shows clientTransferProhibited with a recent creation date, move on: it's actively held, and your energy is better spent on alternatives (Nomlen checks 1,100+ TLDs for variants of your name).
Thin vs thick WHOIS: why records look different per TLD
One quirk that confuses beginners: a .com WHOIS record from a registrar often looks sparse compared to a .org one. That's the thin vs. thick model. In the thin model (historically .com and .net, run by Verisign), the registry stores only basic data — registrar, dates, name servers, status — and the full contact record lives at the registrar. In the thick model (most other gTLDs), the registry holds the complete record. ICANN has been migrating .com/.net toward thick WHOIS for years. Practically: if a .com lookup looks thin, query the listed registrar's WHOIS too.
Protecting your own WHOIS data
Everything above cuts both ways — the moment you register a domain, a record about you exists. For most gTLDs, GDPR-era redaction hides your personal details by default, which is why modern WHOIS records show "REDACTED FOR PRIVACY" for individuals. But redaction policies vary by TLD (many ccTLDs have their own rules), and organization names can still appear. If you want a guaranteed layer, enable your registrar's WHOIS privacy / proxy service — usually free at registrars like Cloudflare, Porkbun, and Dynadot, and a paid add-on at some others. It replaces your details with the privacy service's. One trade-off to know: some buyers and partners view privacy-enabled WHOIS as slightly less trustworthy, so businesses that want to look established sometimes publish their organization details deliberately.
The bottom line
WHOIS is the internet's deed registry: registrar, dates, name servers, and status codes are public for every domain, and the status codes alone can tell you whether a "taken" name is locked up tight or about to drop. The personal data that made old WHOIS notorious is largely redacted since GDPR, with RDAP as the modern, structured successor and RDRS as the legitimate channel for requesting hidden data. Next time a domain you want shows as unavailable, don't just move on — run the lookup, read the expiry date and status codes, and decide with data. Start with Nomlen's free WHOIS checker, and if the name is free after all, grab it across the TLDs that matter before someone else does.
Frequently asked questions
Is WHOIS lookup free?
Yes. WHOIS and RDAP data are public by ICANN contract, and lookups are free through registrars, ICANN Lookup (lookup.icann.org), and free tools like Nomlen's WHOIS checker. Never pay for a basic WHOIS lookup.
Is the owner information in WHOIS accurate?
It's required to be: ICANN's rules obligate registrants to keep contact data accurate, and registrars must verify and periodically re-verify it. In practice, accuracy varies — but deliberately false data is grounds for suspension, and it's one of the first things checked in UDRP disputes.
Why does the owner show as "Redacted for Privacy"?
Since GDPR took effect on May 25, 2018, registrars must redact personal data of registrants from public WHOIS for most gTLDs. What remains public — registrar, creation/expiry dates, name servers, status codes — is usually everything you actually need.
What replaced WHOIS?
RDAP (Registration Data Access Protocol, RFCs 7480–7485) is the designated successor: structured JSON over HTTPS instead of free-form text over port 43. ICANN required gTLD registries and registrars to support it by August 2019. WHOIS still works, but RDAP is the canonical source going forward.
Can I find the owner of a domain with WHOIS privacy enabled?
Not from the public record — that's the point of the service. Legitimate options: use the registrar's anonymized contact form, file a request through ICANN's Registration Data Request Service (RDRS, launched November 2023), or make an offer through a domain broker or marketplace like Afternic or Sedo.
What's the difference between registrar WHOIS and registry WHOIS?
The registry (e.g., Verisign for .com/.net) holds the authoritative record for the TLD; the registrar (where the domain was bought) holds the customer record. In the "thin" model the registry record is sparse and you check the registrar for details; in the "thick" model the registry has everything. ICANN Lookup shows you both.
How do I update my own WHOIS information?
Log into your registrar's control panel and edit the registrant contact details — changes propagate to the public record quickly. Keep it current: ICANN requires accurate data, and outdated details can complicate transfers, renewals, and disputes.
Is it legal to look up WHOIS data?
Yes — the non-redacted portion is published precisely so the public can query it (that's the ICANN contract requirement). What's restricted is bulk harvesting and misuse of personal data, which is also why the personal fields are redacted in the first place.
WHOIS tells you who owns it now — to see who owned it before, check a domain's age and history, including past Wayback snapshots.
Try it: Run a live lookup with the free WHOIS checker to see any domain's registrar, key dates and status codes in a clean, readable format.
Keep reading: what flushing your DNS actually does — the fix for half of all “the site is down” scares.
