A WHOIS lookup asks the public record who registered a domain, when, through whom, and what state it is currently in. It is the closest thing the internet has to a land registry, and it is genuinely useful once you know which fields matter.
Most of it is noise. Four or five fields carry nearly all the information, and you can pull a record for any domain with the WHOIS lookup tool.
Registrar. The company the domain was registered through. Useful when you need to file an abuse report, or when you are trying to work out where a domain you have inherited is actually managed.
Creation date. When the domain was first registered — not when the current owner acquired it. For judging whether a site is plausible, this is the single most informative field. A "twenty years of experience" business on a domain created last month is worth a second look.
Expiry date. When the registration lapses unless renewed. Also the field to check when a site abruptly stops working and nothing else explains it.
Name servers. Which servers are authoritative for the domain's DNS. This tells you where the domain is actually operated, which is frequently a different company from the registrar — a domain registered at one company but running on another's DNS is completely normal.
Status codes. The ones that matter are covered below.
WHOIS used to publish the registrant's name, postal address, phone number and email. Since GDPR took effect in 2018, registrars have redacted personal data for most domains, and you now see placeholders or a forwarding address instead.
This was not universally popular. It made investigating abuse harder, and it removed a genuinely useful accountability signal. It also stopped publishing the home address of every individual who registered a domain, which had been an obvious problem for two decades.
Business registrations in some jurisdictions still show organisation details, and country-code registries vary widely in what they publish. If you need to contact an owner, most registrars operate an anonymised forwarding form.
These look alarming and mostly are not.
clientTransferProhibited is the most common and the most misread. It means the registrar has locked the domain against transfer, which is a good thing — it is the standard defence against domain hijacking, and it is on by default nearly everywhere. You unlock it deliberately when you want to move registrar.
clientUpdateProhibited and clientDeleteProhibited are the same idea for changes and deletion. Also protective.
Anything beginning server rather than client was set by the registry, not the registrar, and is more serious — often a dispute or a legal hold.
pendingDelete and redemptionPeriod mean the domain has expired and is working through the stages before release. redemptionPeriod can usually still be recovered by the original owner, for a fee that is deliberately unpleasant.
Checking a site before you trust it. Creation date plus registrar tells you a lot. A brand new domain on a registrar popular with bulk registrations, selling discounted goods, deserves suspicion.
Working out who to contact about abuse. The registrar's abuse address is in the record and is obliged to accept reports.
Untangling your own infrastructure. Organisations lose track of domains constantly. WHOIS tells you which registrar holds it and what is about to expire.
Buying a domain. Expiry date and status tell you whether it is about to become available or is firmly held.
It does not tell you who runs the website. The domain owner and the site operator are often different, and the hosting provider is a separate question again — for that, look up the IP address behind the domain rather than the registration.
It also does not verify anything. Registrars are required to collect accurate details, but the enforcement is weak, and where data is published it may be fictitious.
Why is the WHOIS record mostly redacted?
Privacy legislation, principally GDPR. Registrars withhold personal data by default. Organisation details are still shown for some business registrations, and country registries differ.
Does a private WHOIS record mean something suspicious?
No. It is now the default for individuals nearly everywhere, and inferring anything from it would flag most of the internet.
Can I find out who owns a domain that is redacted?
Not directly. Most registrars offer an anonymised contact form that forwards to the owner. Beyond that, disclosure generally requires a legal process.
What is the difference between the registrar and the name servers?
The registrar is who you bought the domain from and who bills you. The name servers are whoever answers DNS queries for it. They are often different companies, and that is entirely normal.
The creation date is older than the current owner.
Expected. The creation date records when the domain first existed, not when it last changed hands. Transfers do not reset it.
0 comments
No comments yet. Be the first.