WHOIS Explained: How Domain Registration Records Work

Behind every domain name there is a registration record, and WHOIS is the oldest way to look it up. It is one of the first tools a developer, a security analyst, or a curious buyer reaches for: type a domain, get back who registered it, when, through whom, and where its name servers point. The protocol is decades old, it changed dramatically after privacy law caught up with it, and it is quietly being replaced. Here is how it all fits together.

What WHOIS is

WHOIS is a simple request-and-response protocol: you send a domain or IP address to a WHOIS server, and it replies with the registration record held for that resource. The name is literally the question it answers — "who is" responsible for this domain. It was born in the early days of the internet, when the list of registered hosts was small enough that a single directory could answer for everyone.

Today the data is spread across many servers, but the idea is unchanged: WHOIS turns a domain name into a human-readable record about its registration.

What a WHOIS record contains

A typical domain record, before any redaction, includes:

• Domain name and its current status codes (for example clientTransferProhibited, which blocks unauthorised transfers).
• Registrar — the company you bought or manage the domain through.
• Registry — the organisation that runs the whole top-level domain, such as the operator of .com.
• Important dates — when the domain was first created, when it was last updated, and when it expires.
• Name servers — the DNS servers that answer for the domain.
• Contacts — registrant, administrative, and technical contacts (now usually redacted).

The dates alone tell a surprising amount. A domain created last week behaves very differently, from a trust point of view, than one that has been continuously registered for fifteen years.

Registry vs registrar: who stores what

This split confuses people, so it is worth being precise. The registry operates a top-level domain and keeps the authoritative list of every domain under it. The registrar is the retailer you actually deal with — the company that sells you the domain and manages your contact details and settings.

WHOIS reflects that structure. For many TLDs the registry runs a "thin" model: the registry's WHOIS points you to the right registrar, and the registrar's WHOIS holds the full record. Other TLDs run a "thick" model where the registry itself holds everything. Either way, following the trail from registry to registrar gets you to the complete record.

Why most of the record is now blank

If you ran a WHOIS lookup a decade ago, you would often see a real name, email, phone number, and postal address. Then the EU's GDPR took effect in 2018, and publishing personal data by default became a legal problem. Registrars responded by redacting personal contact fields for most domains, replacing them with notices like "Redacted for Privacy."

What usually stays visible are the non-personal, operational fields: registrar, creation and expiry dates, status codes, and name servers. What usually disappears is the registrant's identity. This is not a bug or a block on your end — it is the record working as privacy rules now require.

Privacy and proxy services

Separately from GDPR, many registrars sell privacy or proxy protection. A privacy service shows the service's contact details instead of yours; a proxy service registers the domain in its own name on your behalf. In both cases WHOIS shows the service, not the owner, and you typically reach the real owner only by sending a message the service forwards.

RDAP: the modern replacement

The classic WHOIS protocol has real weaknesses: its output is unstructured free text, it has no standard way to control who sees what, and it predates internationalised data. The industry's answer is RDAP — the Registration Data Access Protocol. RDAP returns the same registration data as clean, structured JSON over HTTPS, supports authentication so that verified parties can see more, and is now the required standard for registries.

In practice, when you use a lookup tool today, it may be querying RDAP under the hood even if the interface still says "WHOIS." The two names will coexist for a while, but RDAP is where things are heading.

WHOIS for IP addresses

WHOIS does not stop at domains. The same protocol answers for IP addresses, returning the organisation an address block is allocated to and the regional registry that manages it. This is how you find out which network or hosting provider an address belongs to. When you are assessing a visitor or a suspicious connection, this ownership data pairs naturally with a risk signal — our IP risk score and IP lookup tools combine that kind of context so you are not reading a bare address in isolation.

How developers and analysts use WHOIS

• Buying a domain: check whether it is registered, when it expires, and whether its status allows a transfer.
• Security triage: a brand-new domain sending you email or hosting a link is a classic phishing signal. The creation date is one of the fastest checks you can run.
• Email authentication: WHOIS tells you about the domain's registration, while the DNS records tell you how it sends mail. Pair it with a DMARC checker when you are verifying whether a domain is configured to stop spoofing.
• Portfolio management: tracking expiry dates across many domains so none lapses by accident.

Reading a record sensibly

A few habits keep you from over-reading WHOIS data:

• Trust the operational fields (dates, registrar, name servers) — they are reliable and rarely faked.
• Treat redaction as normal, not suspicious. Almost every domain hides personal contacts now.
• Remember the record describes registration, not content. A clean WHOIS record says nothing about whether a site is safe, and a privacy-protected one says nothing bad about its owner.

The takeaway

WHOIS is a decades-old protocol that turns a domain or IP into a readable registration record. Since GDPR, the personal parts are usually hidden, but the operational parts — who the registrar is, when the domain was created and expires, and where it points — remain some of the most useful quick-check data on the internet. RDAP is modernising how that data is served, but the questions it answers are the same ones WHOIS has answered since the beginning.