WHOIS

01

WHOIS, explained

WHOIS dates to 1982 and works as a simple text query, traditionally on port 43, answered by registries and registrars. A record typically shows the registrar, the creation, update and expiry dates, EPP status codes and nameservers. Since the EU's GDPR took effect in May 2018, contact fields for generic TLDs are mostly redacted, so a record usually shows a privacy service, a registrar contact form or a placeholder instead of the owner's name and email.

For generic TLDs such as .com, the old protocol has been retired: as of January 28, 2025, ICANN made RDAP the definitive source of registration data in place of sunsetted WHOIS services. People still say WHOIS, and many web lookup tools now query RDAP behind the scenes. Country-code registries set their own rules, and many still run WHOIS.

Investors check it before every purchase. The expiry date and status codes show whether a name is in a grace period, redemption or pending delete; the registrar tells you where a push or transfer will come from; and the dates can matter in a trademark dispute. The common mistake is reading the creation date as the date the current owner bought the name. When assessing bad faith under the UDRP, panels look at when the current registrant acquired the name, not when it was first registered. Before paying, confirm through the escrow process that the seller actually controls the name.

Historical WHOIS databases, such as those from DomainTools and WhoisXML API, keep snapshots from before redaction, which helps trace ownership chains and research a buyer or seller. AI tools can summarize those histories quickly, but they cannot see redacted data; nonpublic contact details are generally released only through formal disclosure requests or legal process.

Go deeper How to Start Domain Investing: A Beginner's Guide