Domain WHOIS / RDAP Lookup

What is a WHOIS / RDAP lookup?

A WHOIS or RDAP lookup retrieves the public registration record for a domain name: who it is registered with, when it was created and when it expires, the status locks protecting it, its nameservers, whether DNSSEC is enabled, and any published contact details. WHOIS is the original, free-text protocol (RFC 3912). RDAP - the Registration Data Access Protocol (RFC 9082 and RFC 9083) - is its modern, structured, JSON-based replacement. This tool queries RDAP first and falls back to classic WHOIS only when a TLD does not yet serve RDAP, and it tells you which source the answer came from.

Why is RDAP replacing WHOIS?

WHOIS has real limitations: its output is unstructured free text that differs between every registry, it has no standard way to authenticate or rate-limit requests, no internationalisation, and no consistent way to express redaction. RDAP fixes all of this with a standardised JSON model, HTTP/HTTPS transport, RESTful URLs, differentiated access, and proper Unicode support. ICANN has formally moved gTLD registries and registrars to RDAP and set the sunset of the legacy WHOIS (RDDS) service - RDAP is now the authoritative source for gTLD registration data. The fields you see above (registrar, IANA ID, abuse contact, events, status, nameservers, secure DNS) map directly to RDAP's structured objects.

How do I read EPP domain status codes?

Status codes come from the Extensible Provisioning Protocol (EPP) and describe what operations are allowed or in progress on a domain. They fall into a few families:

• Client locks (clientTransferProhibited, clientDeleteProhibited, clientUpdateProhibited) are set by your registrar and you can ask them to toggle. clientTransferProhibited is the standard anti-hijacking lock and should normally be on.
• Server locks (serverTransferProhibited, serverDeleteProhibited, serverUpdateProhibited) are set by the registry and the registrar cannot remove them alone - often part of a premium Registry Lock security service.
• Hold codes (clientHold, serverHold) mean the domain has been pulled from the zone and will not resolve - usually non-payment, a dispute, or an abuse action.
• Lifecycle / grace codes (autoRenewPeriod, redemptionPeriod, pendingDelete) track an expiring or expired domain through its grace windows toward release.
• ok / active means a normal domain with no pending operations. Note that a domain with any lock will not also show ok.

The report above prints each code with its plain-English meaning so you do not have to memorise them.

Why are the contact details redacted?

Before 2018, public WHOIS exposed the registrant's name, address, email and phone. The EU's General Data Protection Regulation (GDPR) made publishing that personal data unlawful by default, so ICANN's Temporary Specification - and now the Registration Data Policy - require registries and registrars to redact personal contact fields from public WHOIS/RDAP. That is why you usually see only the registrar and an abuse contact, with registrant/admin/tech contacts withheld. Legitimate access (law enforcement, trademark, security) goes through a tiered disclosure request rather than the public record. Country-code TLDs (ccTLDs) set their own policies - some, like .fr, still publish organisational contacts, while many redact like gTLDs.

How do I read the expiry date - and what happens when a domain expires?

The expiry date is when the current registration term ends. The badge above turns amber when a domain is within 30 days of expiry and red once it has passed. After expiry, most gTLDs run an auto-renew grace period (often up to 45 days, status autoRenewPeriod), then a ~30-day redemptionPeriod during which only the original registrant can recover the name (usually for a steep fee), then a short pendingDelete phase before the name is released back to the open market. If a domain matters to you, renew it well before expiry and keep the registrar account contact and payment method current.

Is the registrar abuse contact the right place to report a problem?

For phishing, malware, spam or other abuse tied to a domain, the registrar's abuse email and phone shown above are the correct first point of contact - ICANN requires accredited registrars to publish and act on them. For content or trademark disputes there are separate channels (registrar legal contacts, UDRP, or the relevant hosting provider). Note that using WHOIS/RDAP data for unsolicited marketing violates registrar terms and anti-spam law.