Network Tools

WHOIS Lookup

Query domain WHOIS records such as registrar and expiry date.

External WHOIS lookup:
🔍

Enter domain to lookup WHOIS information

View domain registration info, expiration date, contacts, DNS and more

Supported TLDs:.com.net.org.cn.io.co.app.dev.me.xyz

What is WHOIS Lookup?

WHOIS lookup retrieves domain registration information, including owner details, registration dates, and nameservers.

Information Provided

  • Registrant information
  • Registration and expiration dates
  • Nameservers
  • Registrar details

Use Cases

  • Domain availability check
  • Contact information lookup
  • Security research

This tool sends a domain name to the registry WHOIS service on port 43 and parses the plain-text reply into registrar, creation and expiry dates, EPP status codes, nameservers and DNSSEC state, with the untouched response kept on a raw tab. It suits ownership and expiry checks before a transfer, acquisition or abuse report.

From a pasted URL to a port 43 query

Before anything is validated, the input is lowercased and the scheme, path, port and a leading www. are cut away, so https://www.Example.COM:8443/blog/post is reduced to the bare string example.com. What survives must match a label pattern of 1 to 63 characters per segment plus a final suffix of at least two ASCII letters, which is why xn--fiqs8s and 中国.cn are rejected while blog.example.com passes. The suffix then chooses a server: com and net go to whois.verisign-grs.com, org to whois.pir.org, cn to whois.cnnic.cn, and 38 suffixes are mapped in total; anything unmapped is guessed as whois.nic.<tld>. The backend writes the name plus CRLF to TCP port 43 and reads until the peer closes the connection.

Thin registries and the registrar referral

.com and .net are thin registries: Verisign returns registrar, dates, EPP statuses and nameservers but no registrant block at all. The backend therefore reads the Registrar WHOIS Server: line out of the reply and queries that host on port 43 as well, adopting the second answer only when it is longer than 100 characters. Registrant, admin, tech and billing fields all come from that hop, and so does GDPR redaction, which shows up as REDACTED FOR PRIVACY rather than a missing key. When the referral is absent, points back at whois.verisign-grs.com, or yields a stub, the Contacts tab renders the privacy notice instead. If the TCP attempt fails outright, an RDAP request over HTTPS takes over, but only for com, net, org, io, co, me, app and dev.

Parsing rules that dictate the rendered output

The parser walks the raw reply line by line, drops lines starting with % or #, splits the rest at the first colon, lowercases the key and keeps only the first non-empty value per field, so a record carrying two creation dates shows the first one. Nameservers are truncated at the first space, discarding glue addresses and comments, and EPP statuses are cut the same way, which removes the https://icann.org/epp#... tail ICANN appends. Each status is then matched, after lowercasing and stripping spaces, against 25 known codes; unrecognised ones fall through to the neutral ok styling. Seven reply substrings, among them no match and not found, turn a valid answer into a not-registered error, so an available name is never displayed as an empty record.

Worked example

A pasted URL reduced to a registrable name

Input 
https://www.Example.COM:8443/blog/post?from=hn
Output 
example.com → whois.verisign-grs.com:43

Lowercasing and the leading-www strip happen before validation, so the mixed case and the prefix never reach the registry, and the port, path and query string are discarded as well. Only the suffix com selects the server, and com is mapped to whois.verisign-grs.com. The socket is opened by the tool API, not by the browser, so the page itself never talks to port 43.

Limits and pitfalls

  • The input pattern caps each label at 63 characters and demands a final suffix of pure ASCII letters, so punycode suffixes such as xn--fiqs8s and Unicode names such as 中国.cn fail validation before any query — convert to the A-label first.
  • Only a leading www. is stripped: blog.example.com is sent verbatim, the .com registry answers no match for it, and the UI reports a not-registered error instead of showing the parent domain record.
  • Registrant and admin blocks survive only when the registrar re-query returns more than 100 characters; a stub answer leaves the Contacts tab empty even though the registry record itself is valid.
  • Two-label suffixes resolve to co.uk or com.cn, which have no server entry, so the TCP path queries whois.nic.co.uk, and the RDAP fallback covers only com, net, org, io, co, me, app and dev.
  • Date-only values are parsed as UTC midnight and rendered in local time, so 2025-01-01 appears as January 1, 2025 at 08:00 AM in UTC+8, and the expiry countdown uses Math.ceil over milliseconds rather than calendar days.

Related tools

When it goes wrong

I pasted the host from the address bar and it says the domain is not registered

CauseOnly a leading www. is removed, so blog.example.com goes to the .com registry verbatim. Verisign answers No match for "BLOG.EXAMPLE.COM", and no match is one of the seven substrings that convert a reply into a not-registered error before parsing starts.

FixEnter the registrable name — example.com — rather than the host you happened to copy. The page has no public-suffix logic, so trimming the leftmost label is your job.

The Contacts tab shows the privacy notice for a domain that obviously has an owner

CauseTwo different causes look identical here. Either the registrar reply was 100 characters or shorter and got discarded in favour of the thin registry text, or the fields came back as REDACTED FOR PRIVACY, leaving no name, organisation, email or phone for hasContactInfo to accept.

FixOpen the raw tab and search for REDACTED or for an empty registrant block. If the data is redacted, use the abuse email on the registrar card; if the raw text is a one-line stub, the registrar never answered and the registry record is all that exists.

The contacts badge never goes past 3 and billing never shows up

CauseThe parser has key branches for registrant, admin and tech only. The billing object is created empty, never filled, and then nulled by the same cleanup that drops empty contacts, so a Billing Email: line in the reply is read and thrown away.

FixCopy that line out of the raw tab by hand, or take it from the registrar panel. No setting on this page will make a billing card appear.

Lookup fails with an empty result on a domain that clearly exists

CauseAny first reply shorter than 50 characters is rejected as empty before parsing, and the registrar referral is only attempted when Registrar WHOIS Server: matches with a host that is not verisign. A short stub from the registry therefore ends the lookup with no second hop.

FixRetry once — some registries answer a rate-limited stub first. If it repeats, check the suffix against the 38 mapped TLDs: an unmapped one is guessed as whois.nic.<tld> and may have no listener on port 43 at all.

The page says not registered while the registry page lists the record

CauseThe seven not-found patterns are matched against the whole lowercased reply before any line is filtered, so a % or # comment that happens to contain "not found" or "no information available" trips the check even though the record below it is present and complete.

FixConfirm in ICANN Lookup, which shows the unparsed text, and treat the verdict here as inconclusive for that suffix rather than as proof of availability.

A .co.uk or .com.au name fails every time with a generic retry message

CauseThose two-label suffixes are recognised as co.uk and com.au, which are absent from the 38-entry server map, so the TCP attempt targets whois.nic.co.uk. RDAP covers only com, net, org, io, co, me, app and dev, so nothing catches the failure and the endpoint throws the generic retry error.

FixQuery Nominet or the .au registrar directly for these names; there is no working path through this tool, and retrying will not create one.

WHOIS lookup against the CLI, RDAP and the registrar panel

DecisionWHOIS lookup (this page)Alternative
The registry answer has no registrant block at allThe backend pulls the Registrar WHOIS Server: line out of the thin registry reply and queries that host on port 43, swapping in the second answer only when it is longer than 100 characters, so this page usually carries registrar-side fields.A bare whois example.com follows the same referral but prints both replies as one unlabelled blob. Stay here when you want the fields classified into registrar, dates and contacts; drop to the CLI when you need the bytes exactly as the registry sent them.
The answer feeds a script rather than a personOne lookup is one GET /api/whois/:domain request. The batch route slices the incoming array to 5 domains before it loops, so a longer list loses its tail without a warning.For a portfolio of dozens, loop RDAP JSON yourself — https://rdap.verisign.com/com/v1/domain/example.com returns status codes and events already structured. This page is for reading a single domain carefully, not for reconciling a list.
The suffix is outside the 38 mapped TLDsUnknown suffixes are guessed as whois.nic.<tld>. If nothing answers on port 43, RDAP takes over — and that fallback is hard-coded to com, net, org, io, co, me, app and dev.Use the registry own lookup for .de, .jp or .uk (DENIC, JPRS, Nominet). There is no RDAP safety net behind those suffixes here, which is exactly why unmapped ccTLDs end in an error rather than a record.
You only want to know where the domain pointsThe DNS tab prints the Name Server: lines from the registry record, each truncated at the first space, which is accredited delegation as of the last registry update.The DNS lookup tool resolves A, AAAA, MX and TXT live. Pick it to debug why a site does not load, and come back here when the question is which nameservers the registry itself lists for the domain.
A renewal or transfer decision is due nowThe countdown is Math.ceil over the millisecond gap to the parsed expiry date: red below 30 days, amber below 90, nothing else — there is no grace-period modelling.Once a transfer is in flight the registrar panel is the authority; a registry expiry date says nothing about the extra days a registrar may keep the name alive. Read this number as the hard deadline, not the practical one.
You need what the record said last yearOnly the current reply is rendered. Nothing is stored or compared between lookups, and the raw tab holds just this one response, discarded when you clear the page.Historical WHOIS archives such as DomainTools or Whois.com keep dated snapshots. For a dispute or an acquisition where the registrant at the time matters, this page cannot help no matter which suffix you try.

Frequently Asked Questions

Can WHOIS still show the registrant’s name and email?
Since GDPR (2018), most registries redact personal data; the public record shows registrar, dates, and status codes. To reach a domain owner, use the registrar’s privacy-proxy contact or the site’s published channels. The tool shows whatever the registry discloses.
How do I read WHOIS status codes?
The notable ones: clientTransferProhibited is a transfer lock (theft protection — recommended); ok is normal; redemptionPeriod / pendingDelete mean the domain expired and is being deleted — the window for drop-catching; serverHold means the registry suspended resolution (dispute or abuse).
Why does the WHOIS expiry differ from my registrar dashboard?
Common after a recent renewal: registry sync takes 1–48 hours, domains sit in auto-renew grace periods, and different TLDs sync at different paces. Make renewal decisions from the registrar; allow for lag when using WHOIS for compliance checks.

Content reviewed: