Domains
What is WHOIS?
WHOIS, pronounced “who is”, is both a protocol and a database system that stores and provides publicly accessible information about domain name registrations. When a domain is registered the registrant’s contact information, registration dates, nameserver details, and domain registrar information are recorded in WHOIS databases maintained by registrars and registries. Anyone can query these databases to find out who registered a domain, when it was registered, when it expires, and how to contact the domain owner.
The name WHOIS is a question, “who is responsible for this domain?”, that captures the original purpose of the system. In the early internet a small community of researchers and network administrators needed to know who operated specific network resources and domain names for coordination and troubleshooting purposes. WHOIS provided a simple query-response mechanism for answering that question. As the internet grew from hundreds of domains to hundreds of millions the WHOIS system scaled with it, though its design, privacy implications, and governance became increasingly complex and contentious.
WHOIS is foundational to domain management, it is used by security researchers tracking malicious domains, trademark owners identifying infringement, network administrators diagnosing problems, businesses performing due diligence on domain purchases, and countless other purposes. Understanding what WHOIS contains, how to query it, and what protections are available for registrant information is important for anyone managing domains.
What WHOIS records contain
A WHOIS record for a domain typically contains several categories of information, though exactly what is publicly available has changed significantly with privacy regulations and ICANN policy evolution.
Registrant information: the contact details of the person or organisation that registered the domain. Traditionally this included name, organisation, mailing address, email address, and phone number. In the privacy era much of this information is masked or redacted, replaced with privacy service contact details or simply marked as redacted for privacy.
Administrative contact: the contact responsible for administrative matters related to the domain, often the same as the registrant for small organisations, a designated administrator for larger ones. May include contact name, email, and phone.
Technical contact: the contact responsible for technical management of the domain, DNS configuration, nameserver management. May be the registrant, an IT department, or a managed services provider.
Registrar information: the name of the domain registrar through which the domain is registered, the registrar’s IANA ID, and contact information for the registrar’s abuse contact.
Registration dates: when the domain was first registered, the creation date. When the current registration expires, the expiry date. When the WHOIS record was last updated, the updated date.
Nameserver information: the hostnames of the domain’s authoritative nameservers, the servers that hold the domain’s DNS zone. This information tells anyone which DNS provider is being used for the domain and is always publicly available regardless of privacy settings.
Domain status codes: EPP status codes indicating the domain’s current state. clientTransferProhibited means the registrar has applied a transfer lock preventing unauthorised transfers. serverTransferProhibited means the registry has applied a lock. ok means no special restrictions are active. Multiple status codes can apply simultaneously.
DNSSEC information: whether DNSSEC is enabled for the domain and the associated DS record information if applicable.
How WHOIS works technically
WHOIS is a simple client-server protocol defined in RFC 3912. A WHOIS client sends a text query, typically a domain name, to a WHOIS server on TCP port 43. The server responds with the WHOIS record as plain text. The protocol has no authentication, encryption, or standardised response format, each registry and registrar structures its WHOIS responses differently.
WHOIS query hierarchy: WHOIS queries follow a hierarchy based on the domain’s TLD. Querying the IANA root WHOIS server for a TLD returns information about that TLD’s registry and the registry’s WHOIS server address. Querying the TLD registry’s WHOIS server for a domain returns the domain’s registration information. For gTLDs like .com the TLD registry WHOIS server, operated by Verisign for .com: returns thin WHOIS data, registrar name and nameservers, and points to the registrar’s own WHOIS server for full registration details.
Thin vs thick WHOIS: gTLD registries historically operated thin WHOIS, storing only the registrar identity and nameservers, with full registration details held by the registrar. Thick WHOIS stores complete registration details at the registry level. ICANN has required all gTLD registries to move to thick WHOIS, centralising complete registration data at the registry level for improved data accuracy and consistency.
RDAP, Registration Data Access Protocol: the modern successor to WHOIS. RDAP uses HTTPS and returns structured JSON responses rather than unformatted plain text, making the data programmatically parseable and supporting authentication for tiered access. ICANN has been transitioning the domain registration data system from WHOIS to RDAP. Both systems currently coexist, RDAP provides more structured access while legacy WHOIS servers remain operational.
Web-based WHOIS: most registrars and registries provide web-based WHOIS lookup tools alongside the technical WHOIS protocol. These web interfaces are more accessible to non-technical users, entering a domain name in a form and receiving a formatted HTML response rather than raw text. Many third-party WHOIS lookup services aggregate information from multiple registries and provide enhanced lookup interfaces.
Privacy and WHOIS
The intersection of WHOIS’s public information mandate and privacy rights has been one of the most contentious issues in domain registration governance. The traditional model of fully public WHOIS data conflicts with privacy laws and reasonable expectations of personal information protection.
Historical WHOIS transparency: originally WHOIS operated on complete transparency. All registrant information, home addresses, personal email addresses, personal phone numbers, was publicly accessible to anyone with an internet connection. This was appropriate when domains were registered by organisations and network administrators operating infrastructure, not by individuals with personal websites and small businesses.
Privacy regulations and WHOIS: GDPR, the European Union’s General Data Protection Regulation, created the most significant challenge to traditional WHOIS transparency. GDPR restricts the collection and public disclosure of personal data without legitimate legal basis. Publishing individuals’ personal contact information in a publicly accessible database is difficult to justify under GDPR. Following GDPR’s May 2018 implementation ICANN and registrars began redacting personal information from WHOIS records for registrants who are natural persons, individuals rather than organisations.
Tiered access model: ICANN has been developing a System for Standardized Access/Disclosure, SSAD, that would provide different levels of WHOIS data access to different requestors based on demonstrated legitimate purpose. Law enforcement, intellectual property professionals, security researchers, and other verified requestors would have access to redacted data through an accreditation and access system. Accredited requestors with demonstrated legitimate purpose would have access to more complete data than anonymous public queries. The SSAD has been under development for years with slow progress toward implementation.
Domain privacy services: the most practical privacy solution for individual domain registrants. A domain privacy service, offered by most registrars as a paid or free add-on, replaces the registrant’s personal contact information in WHOIS with the privacy service’s own contact details. Inquiries sent to the privacy service’s contact information are forwarded to the registrant if they are legitimate, blocking spam, solicitations, and harassment while maintaining a contact path for genuine needs.
Domain privacy is strongly recommended for any individual registering a domain for personal or small business use. For large organisations registering business domains with corporate contact information the privacy calculus is different, business contact information may legitimately be publicly accessible, but even organisations benefit from considering what information should and should not appear in WHOIS.
WHOIS and redirect management
WHOIS intersects with redirect management in several practical ways, from domain ownership verification to monitoring for unauthorised changes to competitive intelligence.
Domain ownership verification: some redirect management services and DNS providers use WHOIS data to verify domain ownership, checking that the registrant information matches the claimed owner before activating redirect rules or DNS management access. This is a lightweight ownership check that does not require DNS record changes, useful for services that want basic ownership confirmation without requiring the more involved DNS-based verification process.
Monitoring for unauthorised registrar changes: WHOIS records include the registrar of record, the company currently holding the domain registration. Monitoring WHOIS for changes to the registrar field, the domain being transferred to a different registrar without authorisation, is one indicator of domain hijacking. A domain that was registered at Registrar A appearing in WHOIS as registered at Registrar B without the owner’s knowledge is a red flag requiring immediate investigation.
Nameserver change monitoring: WHOIS records include the domain’s current nameservers. Monitoring for unexpected nameserver changes, the domain suddenly pointing to different nameservers than configured, is an important security measure for valuable domains. An unauthorised nameserver change could redirect all traffic from the domain to attacker-controlled infrastructure. Regular WHOIS monitoring catches nameserver changes that were not made by the domain owner.
Expiry date tracking for parked domains: domain parking configurations often involve multiple domains across multiple registrars. WHOIS records provide authoritative expiry date information for each domain, useful for building expiry monitoring systems that alert domain owners before a parked domain expires. An expired parked brand protection domain is immediately claimable by anyone, a serious brand risk that WHOIS-based monitoring helps prevent.
Competitive and brand intelligence: WHOIS data, where publicly available, provides information about competitors’ domain registrations. When a competitor registers new domains, visible through WHOIS creation dates, it may signal upcoming product launches, market expansions, or brand changes. Trademark owners monitor WHOIS for registrations of domain names incorporating their trademarks, using this information to challenge infringing registrations through UDRP, Uniform Domain-Name Dispute-Resolution Policy, proceedings.
Expired domain acquisition research: before acquiring an expired domain buyers research the domain’s history through WHOIS historical records, understanding who previously owned the domain, when it was first registered, and whether it has been involved in any disputes. WHOIS history services maintain historical snapshots of WHOIS records, showing how the registration information has changed over time.
Querying WHOIS
WHOIS data is accessible through several methods, from command-line tools to web interfaces to API services.
Command-line WHOIS: most Unix-like operating systems, Linux, macOS, include a whois command-line tool. Querying a domain returns the raw WHOIS response:
The output format varies by registry and registrar, each may structure the response differently. The whois command queries registrar and registry WHOIS servers automatically based on the TLD.
On Windows the whois command is not installed by default but is available as a free download from Microsoft Sysinternals or through WSL, Windows Subsystem for Linux.
Web-based WHOIS tools: registrar and registry websites provide web-based WHOIS lookup interfaces. ICANN’s own WHOIS lookup at lookup.icann.org provides standardised access to RDAP data. Domain Tools, Who.is, and similar third-party services aggregate WHOIS data from multiple sources and provide enhanced search and historical lookup capabilities.
RDAP queries: RDAP data is accessible via HTTPS using standardised URLs. The IANA bootstrap service at data.iana.org/rdap/dns.json provides the RDAP service URLs for each TLD. A direct RDAP query for a domain:
Returns structured JSON with the domain’s registration data, more parseable than raw WHOIS text and increasingly the preferred access method for programmatic use.
WHOIS API services: for applications that need to query WHOIS at scale third-party API services aggregate WHOIS and RDAP data from registries worldwide and provide consistent JSON API responses. Services like WhoisXML API, WHOIS.com API, and similar provide bulk lookup capabilities, historical data access, and monitoring services beyond what direct WHOIS queries provide.
WHOIS accuracy requirements
ICANN requires registrants to provide accurate WHOIS information as a condition of domain registration. Providing false contact information violates ICANN’s registration agreements and can result in domain suspension or cancellation.
Accuracy obligation: registrants must provide accurate name, address, email, and phone information at registration and update it promptly when it changes. ICANN’s Registrar Accreditation Agreement requires registrars to verify that registrant information is accurate, at minimum verifying that the email address on file is functional by sending a verification email.
Inaccuracy consequences: if ICANN or a registrar determines that a WHOIS record contains materially false information the registrar may suspend or cancel the domain registration. Practical enforcement of WHOIS accuracy obligations is inconsistent, the scale of domain registration makes comprehensive validation impractical, but clear violations can be acted upon.
Domain privacy and accuracy: using a domain privacy service does not exempt registrants from the accuracy requirement, the privacy service maintains accurate registrant information in its records even when the public WHOIS shows the privacy service’s contact details. The privacy service acts as an intermediary that protects personal information while maintaining compliance with registration requirements.