Every registered domain on the internet has an associated Whois record — a public registry entry that contains information about who registered the domain, when, and through which registrar. Whether you are investigating a suspicious email, planning a domain acquisition, or troubleshooting a DNS issue, knowing how to read a Whois record is a valuable skill.
In this article we will break down every section of a Whois record, explain what the fields mean, and show you how to use this data in real-world scenarios. You can look up any domain's Whois record using our Whois & Hosting Lookup tool.
Whois (pronounced "who is") is a query-and-response protocol that has been part of the internet since the early 1980s. It was defined in RFC 3912 and is used to look up registration information for domain names, IP address blocks, and autonomous systems.
When you register a domain, your registrar is required to submit certain information to the domain registry (e.g., Verisign for .com domains). This information becomes part of the Whois database and is, in most cases, publicly accessible.
However, since the introduction of the European Union's General Data Protection Regulation (GDPR) in 2018, much of the personal contact information in Whois records has been redacted for domains registered by individuals. Despite this, Whois records still contain a wealth of useful technical and administrative data.
A typical Whois record for a .com domain contains several distinct sections. Let's walk through each one.
Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.registrar.com
Registrar URL: http://www.registrar.com
Updated Date: 2025-08-14T07:01:44Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2026-08-13T04:00:00ZKey fields to note:
Registrar: Example Registrar, Inc.
Registrar IANA ID: 1234
Registrar Abuse Contact Email: abuse@registrar.com
Registrar Abuse Contact Phone: +1.5555555555This section tells you which company the domain was registered through. If you need to report abuse (phishing, malware, spam), the registrar abuse contact is where you should send your complaint. The IANA ID is a unique identifier assigned by the Internet Assigned Numbers Authority.
Domain Status: clientDeleteProhibited
Domain Status: clientRenewProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibitedDomain status codes (also called EPP status codes) indicate the current state of the domain and what operations are allowed or restricted:
Name Server: NS1.DNSPROVIDER.COM
Name Server: NS2.DNSPROVIDER.COMThe name servers listed in the Whois record are the authoritative DNS servers for the domain. These are the servers that hold the actual DNS records (A, AAAA, MX, etc.) for the domain. If the name servers are wrong, the domain will not resolve correctly regardless of what records you have configured.
The name servers shown in Whois should match what you have configured at your DNS provider. Mismatches are a common cause of DNS issues after migrating providers.
Historically, Whois records contained full contact details for three roles:
Post-GDPR, most registrars redact personal information for individual registrants. You will typically see fields like "REDACTED FOR PRIVACY" or the registrar's privacy proxy information. Organization names may still be visible since GDPR protections apply to natural persons, not legal entities.
When you receive a suspicious email or find a website that might be impersonating a legitimate brand, Whois is your first stop. A domain that was created yesterday and expires in one year is far more likely to be malicious than one created fifteen years ago. You should also check if the domain or its associated IPs appear on any blacklists.
If you want to buy a domain that is already registered, Whois tells you who owns it (if not privacy-protected), when it expires, and which registrar holds it. If the domain is approaching expiration and the owner has not renewed, you may be able to backorder it.
When DNS is not working as expected, checking Whois confirms whether the name servers are correctly configured at the registry level. This is different from checking NS records in DNS itself — Whois shows what the registry has on file, which is the ultimate authority.
For email deliverability issues, Whois helps you verify that the domain is active and properly configured. Combine this with the SPF Record Test to get a full picture of your email setup.
Whois data can reveal when competitors registered new domains, which registrars and hosting providers they use, and how many domains a particular organization manages. While less detailed than it used to be, this information still has value for market research.
The Registration Data Access Protocol (RDAP) is gradually replacing the legacy Whois protocol. RDAP offers several advantages:
Many registries now support RDAP alongside or instead of traditional Whois. Our Whois & Hosting Lookup tool supports both protocols, giving you the best available data regardless of which protocol the registry uses.