What Is WHOIS?

Acutis · plain-English network help · updated June 2026

What is WHOIS, in plain English?

WHOIS (pronounced "who is") is the public record system for domain names and IP addresses. When someone registers a domain like example.com or is assigned a block of IP addresses, the details of that registration are stored in a database that anyone can query. A WHOIS lookup is simply you asking that database, "who is responsible for this domain, and when was it registered?"

Think of it as the property records office for the internet. It won't tell you what's inside the building, but it will tell you who registered the address, who's hosting the DNS, when the registration was created, and when it's due to expire.

What a WHOIS lookup shows

The exact fields vary by registry, but a typical domain WHOIS record includes:

• Registrar. The company the domain was bought through, such as GoDaddy, Namecheap, or Cloudflare. This is who you'd contact about the registration itself.
• Creation date. When the domain was first registered. This is how you find a domain's age — a useful trust signal, since scam domains are often only days or weeks old.
• Expiry date. When the registration lapses unless renewed. Letting this slip is how businesses accidentally lose their domain.
• Updated date. When the record last changed — often a sign of a recent transfer or DNS change.
• Nameservers. The DNS servers that answer for the domain, like ns1.cloudflare.com. These tell you who actually runs the domain's DNS.
• Status codes. Flags such as clientTransferProhibited (a lock that blocks the domain from being moved) or pendingDelete (it's on its way to being released).

For an IP address, WHOIS instead tells you which organization owns the block, the network range it belongs to, and the registry that assigned it (such as ARIN in North America or RIPE in Europe).

RDAP: the modern replacement

The original WHOIS protocol dates back to the 1980s and returns plain, inconsistent text that's hard for software to parse reliably. Its successor is RDAP (the Registration Data Access Protocol), which returns the same information as clean, structured JSON over HTTPS.

RDAP is now the standard that registries are required to support, and it brings real advantages: consistent field names across registries, proper internationalization, secure transport, and the ability to grant different levels of detail to authenticated users. Most modern WHOIS lookups you run today are actually RDAP queries under the hood, even if the result is still labeled "WHOIS."

GDPR and redacted personal data

WHOIS used to publish the registrant's name, email, phone number, and mailing address in the open. Since Europe's GDPR privacy law took effect in 2018, most of that personal contact information is now redacted for individuals. Where you once saw a name, you'll often see "Redacted for Privacy" or a generic privacy-service email instead.

This protects ordinary people from spam and harassment, but it means WHOIS is no longer a reliable way to find a single individual behind a personal domain. Organizational and IP-block records are generally still visible, and dates, registrar, and nameservers remain public — so the lookup is still highly useful, just less revealing about named individuals than it once was.

Common uses for WHOIS

• Checking domain age. A brand-new domain claiming to be your bank is a classic phishing red flag.
• Catching an expiry. Confirming when your own domain renews — or spotting that a domain you want is about to be released.
• Ownership and disputes. Establishing who controls a domain in trademark or transfer disputes, often via the registrar of record.
• Investigating abuse. Finding the registrar or hosting network to report a malicious or fraudulent site.
• Pre-purchase research. Seeing a domain's history, status locks, and DNS setup before you buy or take it over.

The practical takeaway: WHOIS won't always name a person, but it reliably tells you when a domain was born, when it expires, who registered it through, and who runs its DNS — and that's usually exactly what you need.