What Is WHOIS?
WHOIS is the protocol that returns a domain’s registration record: its registrar, creation and expiry dates, name servers and status codes such as clientTransferProhibited. Personal owner details are usually redacted since 2018, and for generic domains RDAP replaced WHOIS as the official source on 28 January 2025.
For domain owners, buyers and site administrators who need to read a registration record before renewing, transferring or reporting a domain.
knowledge
- Read time
- 3 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What is WHOIS?
WHOIS is a query-and-response protocol that returns the registration record for a domain name, an IP address block or an autonomous system number. For a domain it tells you which registrar manages the name, when it was created and when it expires, which name servers it uses and what locks are on it.
The protocol is old and simple. It grew out of the ARPANET “NICNAME/WHOIS” service described in RFC 812 in 1982, and its current specification, RFC 3912 from 2004, is barely two pages: a client opens a connection to TCP port 43, sends the name, and receives plain text back. That simplicity is also its weakness — every registry formatted the answer differently, and there was no way to control who saw what.
What does a WHOIS record show?
A domain’s WHOIS record shows the registrar, key dates, name servers and status codes, plus registrant contact fields that are now usually redacted. The technical fields are the useful ones for day-to-day work.
| Field | What it tells you |
|---|---|
| Registrar | The company that can renew, change or transfer the name |
| Creation date | When the name was first registered in its current life |
| Updated date | The last change to the record, such as new name servers |
| Expiry date | When the registration ends unless renewed |
| Name servers | The DNS hosts that answer for the domain |
| Status | Locks and lifecycle stage, as EPP status codes |
| DNSSEC | Whether the domain is signed |
| Registrant, admin, tech | Contacts — mostly “REDACTED” or a privacy proxy today |
| Code | Meaning |
|---|---|
clientTransferProhibited | Registrar lock is on; the name cannot be transferred until it is removed |
clientHold / serverHold | The name is registered but not published in DNS, so it will not resolve |
redemptionPeriod | Expired and deleted; only the current holder can restore it, usually for a fee |
pendingDelete | About to be released for anyone to register |
ok | No restrictions are set |
The transfer lock is explained in what is a registrar lock, and the expiry stages in how to check a domain’s expiry date.
Why are owner details hidden in WHOIS records?
Since the EU’s GDPR took effect on 25 May 2018, registries and registrars redact personal names, addresses, phone numbers and emails from public lookups. ICANN’s policy for generic domains followed, so a public query for most .com names now returns “REDACTED FOR PRIVACY” in place of the owner.
- Redaction is not anonymity: the registrar still holds the full contact data and can disclose it to law enforcement or in response to a lawful request.
- Privacy services: some registrars replace your contacts with a proxy that forwards messages, where the extension allows it.
- Hidden does not mean available: a redacted record still belongs to a registered, active name.
- Country-code rules vary: each ccTLD registry sets its own disclosure policy, so check the terms for .in, .uk or .au separately.
Keep your own registrant email working even when it is hidden. Renewal reminders, verification requests and transfer confirmations are still sent to it.
What is RDAP, and has it replaced WHOIS?
RDAP, the Registration Data Access Protocol, is WHOIS’s successor: it returns the same registration data as structured JSON over HTTPS. ICANN ended the obligation for generic-TLD registries and registrars to run WHOIS on port 43 and web WHOIS on 28 January 2025, making RDAP the authoritative source for those names.
| Feature | WHOIS | RDAP |
|---|---|---|
| Transport | Plain text on TCP port 43 | HTTPS (encrypted) |
| Response format | Free text, different for every registry | Standard JSON fields |
| Finding the right server | Client must know it | IANA bootstrap files point to it |
| Access control | None — same answer for everyone | Can show more data to authenticated users |
| Standards | RFC 3912 (2004) | RFC 7480–7484 (2015), updated by RFC 9082–9083 |
People still say “WHOIS lookup” for both, and many country-code registries continue to answer on port 43. For a .com, .org or other generic name, an RDAP answer is now the one to trust.
How do you run a WHOIS or RDAP lookup?
The fastest way is a web lookup tool; on macOS or Linux you can also query from the terminal with the whois command or fetch RDAP with curl. All three return the same core fields.
# Classic WHOIS (macOS and most Linux distributions)
whois example.com
# Ask IANA which registry runs an extension, e.g. .in
whois -h whois.iana.org in
# RDAP via the public rdap.org redirector (JSON output)
curl -sL https://rdap.org/domain/example.comOn Windows, use the browser tool or install the Sysinternals whois utility. For a quick check without any command line, the WebJi® WHOIS domain lookup shows the registrar, dates, name servers and status for any name.
When should you check a domain’s WHOIS record?
Check WHOIS before you buy, transfer or renew a name, when you suspect a phishing site, and whenever you need to know who controls a domain’s DNS. It answers “who and until when”, not “where does traffic go”.
- Before a transfer: confirm the lock is off and the name is more than 60 days past its last registration or transfer, then get the authorisation code.
- Before buying a taken name: see the registrar and expiry; a name near expiry may be easier to negotiate or may drop.
- Suspicious email or site: a domain created days ago and imitating a bank is a strong phishing signal.
- Site or mail not working: WHOIS confirms the name servers, but the actual records live in DNS — see what is DNS and how to check DNS records.
If a name you want is free, domain registration in India takes a few minutes; if you already own it elsewhere, domain transfer moves it to WebJi®.
Frequently asked questions
Can I remove my domain from WHOIS completely?
No. Every registered domain has a record, because the registrar, dates, name servers and status must be publicly checkable. What you can hide is personal contact data, which is redacted by default for most generic names and can be masked further by a privacy service where allowed.
How do I find who owns an IP address in India?
Run a WHOIS or RDAP query on the IP itself. Indian address blocks are allocated through APNIC, the regional registry for Asia-Pacific, or through IRINN, India’s national registry run by NIXI. The record shows the network owner and an abuse contact, not the individual user.
Why does WHOIS show a different creation date from when I bought the name?
If you bought an existing name from another owner, the creation date stays from its original registration. If the name had expired, been deleted and re-registered, the date resets to the new registration. A transfer between registrars does not change it either.
Is the information in WHOIS verified?
Partly. Registrars accredited by ICANN must verify a registrant’s email address or phone number and can suspend names with false data. The registrar, dates and status fields come straight from the registry, so they are reliable even when contact details are hidden.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.