WHOIS Checker

A WHOIS checker reads the registration record a domain registry publishes about a domain name. Enter a name such as example.com and the tool returns who registered it through, when the registration was created, when it expires, which status codes the registry has applied, which nameservers answer for it, and whether DNSSEC is signed. Every domain on the internet has such a record, because a registry has to track who holds each name, and most of that record is public by design.

There are two ways to read it. WHOIS is the original protocol from 1982: a plain TCP connection to port 43 that returns free-form text, formatted differently by nearly every registry. RDAP, the Registration Data Access Protocol, replaced it in the registries ICANN oversees and returns structured JSON with defined fields, following RFC 9082 and RFC 9083. This checker asks RDAP first, because its answer is unambiguous, and falls back to port-43 WHOIS for the registries that have not moved, which is most country-code domains. You see the parsed record either way, plus the raw text underneath when a WHOIS server supplied it.

A worked example shows what comes back. Look up a registered .com and the report opens with the domain, the registrar holding it, how old the registration is and how long is left before it expires, colour-coded once that drops under thirty days. Registration shows the created, expiry and last-changed dates and the DNSSEC state. Registrar shows the registrar of record, the registrant if the registry still publishes one, and the abuse contact. Nameservers lists the hosts that answer for the domain and names the DNS provider when the hostnames identify it. Status codes translates the EPP tokens: clientTransferProhibited means the registrar has locked the name against transfer, redemptionPeriod means it has expired and can still be recovered for a fee, pendingDelete means it is about to be released.

Most registrant names, emails and addresses have been redacted since GDPR took effect in 2018, so a WHOIS checker no longer tells you who personally owns a domain in most cases. What it does tell you is still the useful part for day-to-day work: when a domain expires and whether a renewal is overdue, which registrar to approach about a transfer or an abuse report, whether a name is locked, whether the nameservers match the host you expect, and whether a domain someone is offering you is three weeks old or fifteen years old. The lookup runs on our server because port 43 is a raw socket no browser can open, and nothing you look up is stored. It is free, no signup.