WHOIS Lookup

About WHOIS

WHOIS queries the registry for a domain or an IP address and returns the registration record: registrar, creation and expiry dates, status codes, nameservers and whatever contact data is still public. It is the standard first step when tracing ownership or diagnosing a domain that stopped resolving.

For IP addresses the answer comes from the regional registry — ARIN, RIPE, APNIC and the others — and tells you which organisation the block is allocated to, which is how an unfamiliar address in a log gets identified. An AS number works the same way: type AS15169 or just the number and the registry says who runs it.

A domain is asked twice. The registry answers first and holds the identifiers and the dates; it then points at the registrar, who holds the status codes and whatever contact data survives. Both answers are merged into one table, with the registrar's version winning where the two disagree, and every server that was asked is listed above it.

The querying itself is done by whoiser, which keeps up with the details that make WHOIS awkward — which server owns which TLD, the handful of registries that want a differently shaped query, and where the referral to the registrar is hidden in each layout.

Where it helps

• Covers domain names, IP address blocks and AS numbers.
• Merges the registry and registrar answers, so nothing either of them knows is lost.
• Surfaces expiry and status codes, which explain most sudden resolution failures.
• Shows the registrar, which is who you contact about a transfer or a dispute.
• Runs server-side, so no WHOIS client is needed locally.

Limits

• GDPR and registry privacy services redact most contact details, so expect a proxy rather than a person.
• Formats differ by registry — the raw record is not consistently structured.
• Some TLDs restrict or rate-limit queries, and a few return very little.
• Registration data can lag reality; a recent transfer may not be reflected yet.
• Some registries have retired WHOIS entirely in favour of RDAP — .uk among them — and those return nothing here rather than a record.

Frequently asked questions

Why are the contact details hidden?

Privacy rules and paid proxy services replace them. Registrars usually offer a relay form if you need to reach the owner.

What do status codes like clientTransferProhibited mean?

They are locks. That one prevents a transfer to another registrar until you unlock it — normal protection, and a common cause of a failed transfer.

Why does an expired domain still resolve?

Expired domains pass through grace and redemption periods before deletion. Renewing during that window is far cheaper than recovering afterwards.

Can I look up a subdomain?

No. Registration exists at the registrable domain level, so query example.com rather than api.example.com.

Why does a .uk domain return nothing?

Nominet no longer publishes a WHOIS server for .uk; the registry moved to RDAP, which is a different protocol. The tool says so rather than pretending the domain does not exist.

Related tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature