WHOIS is a decades-old protocol for looking up who registered a domain and how it's configured at the registry level. It predates the modern web, and it shows — the output is plain text, formatting varies by registry, and a chunk of it is often redacted these days. Even so, it's still the most direct way to answer “who owns this domain, and when does it expire.”
Increasingly, that lookup actually happens over RDAP (Registration Data Access Protocol) rather than classic WHOIS — a newer, structured replacement that most registries have adopted or are migrating to. The result reads the same to a human either way, which is why “WHOIS” has stuck as the everyday name for this kind of lookup regardless of which protocol actually answered it.
What's typically in a WHOIS record
- Registrar — the company the domain was registered through (not necessarily who hosts it).
- Registration date — when the domain was first registered.
- Expiry date — when the current registration period ends. Domains that lapse without renewal typically enter a grace period, then a redemption period, before eventually becoming available for anyone to register.
- Last updated date — the last time the registration record itself was modified, which can be a useful signal for a recently transferred or reconfigured domain.
- Name servers — which DNS servers are authoritative for the domain. This tells you who actually controls where the domain's traffic goes, which can be different from who owns the registration.
- Registrant / admin / technical contact — historically included name, organization, and contact details for whoever controls the domain.
Why so much of it is redacted now
Contact information used to be published in full by default, which made WHOIS a popular source for spam harvesting and even harassment. Privacy regulations — GDPR in Europe being the biggest driver — pushed registrars to redact most personal contact data by default. Most domains today show a registrar's generic privacy service instead of a real name and address. That's normal, not suspicious, and applies to the overwhelming majority of domains you'll look up.
What WHOIS is still genuinely good for
- Expiry tracking — checking when a domain you care about (or a competitor's, or one you're trying to acquire) is due to expire.
- Confirming a transfer or change — the “last updated” date and registrar field are a quick way to confirm a domain transfer actually went through.
- Identifying the name servers in control — useful when troubleshooting DNS issues, since it tells you exactly which provider's DNS you need to be looking at.
- Abuse and takedown reporting — the registrar field points you to the right company to file an abuse report with, even when the registrant's own details are redacted.
WHOIS vs. DNS lookup — different questions
It's easy to conflate the two, but they answer different questions. WHOIS tells you about the registration — who registered the domain, through which registrar, and when it expires. A DNS lookup tells you about the domain's actual records — where it currently points, its mail servers, and so on. A domain can have a perfectly valid, current registration in WHOIS while its DNS is completely misconfigured, and vice versa.
A quirk worth knowing: domains vs. subdomains
WHOIS only has records for registered domains (example.com), not subdomains (shop.example.com). Looking up a subdomain in a WHOIS tool will typically just return the parent domain's registration information, since subdomains aren't separately registered anywhere.
Look up any domain's registration details with the WHOIS lookup.