WHOIS Lookup: What a Domain Record Tells You (and What It Hides)

WHOIS is the protocol for querying domain registration databases. Every registered domain has a record stating who registered it, when, through which registrar, and when it expires — plus a set of status codes that reveal whether the domain is locked, pending renewal or in a dispute.

Real-world uses

• Before buying a domain: check creation date, expiry and status. Some extensions carry locks such as clientTransferProhibited (protection against hijacking) — a healthy sign, whereas pendingDelete or redemptionPeriod means the domain is about to drop.
• Evaluating a second-hand domain: age and a continuous registration history factor into its SEO value and price. A domain registered last month and sold as “aged” is a red flag the WHOIS record exposes immediately.
• Watching your own portfolio: a forgotten expiry means a lost domain. Automated monitoring beats calendar reminders, because registrars, renewal emails and payment cards all fail silently.
• Investigating abuse: when a phishing site uses a look-alike domain, the WHOIS record is the first evidence you file with the registrar.

Privacy and RDAP

Most registrars redact the registrant’s personal data behind a privacy service, so the “owner” field often shows the registrar itself. The newer RDAP protocol returns structured JSON instead of the old free-text blob and is gradually replacing classic WHOIS — it is the same data, machine-readable.

Country-code zones each have their own rules: for .ir domains the authoritative source is IRNIC, which has its own query path and public registration data. The WhoDNS WHOIS tool detects the TLD and automatically uses RDAP, port-43 WHOIS or the IRNIC path as appropriate, so a single lookup works across gTLDs, ccTLDs and Iranian domains.

🔗 Related tool: Run a WHOIS lookup on any domain