WHOIS Domain Lookup

WHOIS, RDAP, and why the answer varies

WHOIS is the decades-old protocol for asking who registered a domain and when it expires. Its replacement, RDAP, returns the same facts as structured data over HTTPS, and it is what this lookup uses wherever the registry supports it — which is now nearly everywhere for common extensions.

The registry for each extension decides what it publishes, so the depth of the answer varies by domain. Some return full registrar details and every status code; some return a date and very little else. When a registry refuses to answer, we say the lookup was unavailable rather than reporting an empty result as though it were a clean one.

The expiry date is not the deadline

This is the single most misunderstood field in the response, and it is why domain lapses catch people who thought they had time.

On the expiry date, the domain does not become available to somebody else. It typically stops resolving — the site goes dark — and enters a grace period of roughly thirty to forty-five days during which the original registrant can renew at the normal price. Many registrars auto-renew before this point, and many do not when the card on file has expired.

After grace comes redemption, usually another thirty days, during which recovery is still possible but costs a redemption fee that is commonly three figures. After that the domain is deleted and can be registered by anybody, and there is a small industry that watches for exactly this.

So the useful question is not "when does it expire" but "when did anybody last confirm the renewal will happen". Renewal notices go to the registrant email address in this record, which for a domain registered by a former employee is an address nobody reads.

Status codes are the security story

The status codes in a WHOIS or RDAP response describe what the registry will currently allow. The one worth knowing is clientTransferProhibited — the registrar lock. With it set, a transfer request to another registrar is refused outright.

Domain hijacking almost always requires the lock to come off first. A lock that silently disappears is therefore either an administrative action somebody took and did not mention, or the first visible step of a takeover, and both are worth an alert the same day.

You may also see codes indicating a pending transfer, a registry hold, or a pending deletion. Any of them appearing without explanation is worth a phone call to whoever administers the domain.

Why the registrant is usually hidden

Since GDPR, most registries redact personal contact details from public responses. Registrant name, email and address are commonly replaced with the registrar's privacy service or omitted entirely.

What remains public and useful is the registrar, the creation and expiry dates, the nameservers and the status codes. The nameservers in particular are worth reading: if they are not the ones you expect, DNS for the domain is being answered by somebody else, whatever the site currently shows.

What this lookup will not tell you

It cannot tell you whether auto-renew is switched on, whether the payment card on file is valid, or whether the registrar account has anyone left who can log in. Those live inside the registrar account and are the actual cause of most lapses.

It is also a snapshot. A lock that is on today can be off next week, and nothing about a one-off lookup will tell you it changed.

Common questions