What is WHOIS and how to look up who owns a domain?

WHOIS is the long-standing system for looking up registration details of a domain name, such as its registrar, creation and expiry dates, status codes, name servers and, where it isn't hidden, the owner's contact details. To look up who owns a domain, run whois example.com in a terminal or use a lookup tool such as ICANN Lookup at lookup.icann.org, then read the Registrant fields. Today most personal details are redacted for privacy, so you'll usually see the registrar rather than the owner, and you'll need to contact the owner through the registrar's contact form or relay email instead.

WHOIS is still the name everyone uses, but the system behind it has changed a lot. For gTLDs it has been formally replaced by RDAP, and privacy laws have removed most personal data from public view. This guide explains what WHOIS shows, how to run lookups from the command line and in code, how to read the output, why owner details are usually hidden, and what you can do when you genuinely need to reach a domain's owner.

What Is WHOIS?

WHOIS refers to two related things:

• The protocol: A very simple text protocol, defined in RFC 3912, where a client connects to a server on TCP port 43, sends a domain name and receives a block of plain text back.
• The data: The registration records that registries and registrars hold for each domain, often called "WHOIS data" or more formally registration data.

The protocol dates from the early days of the internet, when the network was small and publishing contact details for every administrator was considered helpful. It has no standard output format, no support for non-ASCII text, no authentication and no way to show different data to different people. Those limitations are why it's being replaced.

WHOIS and RDAP

Since 28 January 2025, ICANN no longer requires gTLD registries and registrars to run port 43 WHOIS services. The official replacement is RDAP (Registration Data Access Protocol), which returns structured JSON over HTTPS. Many registries still run WHOIS servers voluntarily, and many ccTLDs continue to rely on it, so the whois command still works for a large number of domains, but RDAP is now the authoritative source for gTLDs. See what is RDAP for the details.

Most web-based "WHOIS lookup" tools, including ICANN Lookup, now query RDAP behind the scenes and simply keep the familiar name.

What a WHOIS Lookup Shows

A typical lookup returns:

Field	What it means
Domain Name	The domain you queried
Registrar	The company the domain is registered through
Registrar IANA ID	The registrar's ICANN accreditation number
Creation Date	When the domain was first registered (or last re-registered after deletion)
Updated Date	When the record last changed
Registry Expiry Date	When the current registration period ends
Domain Status	EPP status codes, such as clientTransferProhibited
Name Server	The authoritative name servers for the domain
DNSSEC	Whether the domain is signed
Registrant, Admin, Tech	Contact details, usually redacted
Registrar Abuse Contact	Email and phone for reporting abuse

Even with the owner's details hidden, these fields are useful. You can see whether a domain is locked, when it expires, which registrar to contact and which DNS provider it uses.

How to Run a WHOIS Lookup

In a Web Browser

The simplest option is ICANN Lookup at lookup.icann.org. Enter the domain and it queries the authoritative source for gTLDs. For ccTLDs, use the country registry's own lookup page, which you can find through IANA's root zone database.

On macOS and Linux

The whois command is installed on macOS and available on most Linux distributions (install the whois package on Debian and Ubuntu if it's missing):

whois example.com

For .com and .net, the registry's response looks something like this (trimmed):

   Domain Name: EXAMPLE.COM
   Registry Domain ID: 2336799_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.example-registrar.com
   Registrar URL: http://www.example-registrar.com
   Updated Date: 2026-08-14T07:01:34Z
   Creation Date: 1995-08-14T04:00:00Z
   Registry Expiry Date: 2027-08-13T04:00:00Z
   Registrar: Example Registrar, LLC
   Registrar IANA ID: 9999
   Registrar Abuse Contact Email: abuse@example-registrar.com
   Registrar Abuse Contact Phone: +1.5555550100
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Name Server: NS1.EXAMPLE-DNS.NET
   Name Server: NS2.EXAMPLE-DNS.NET
   DNSSEC: signedDelegation

To pull out just the fields you care about:

whois example.com | grep -iE "registrar:|creation date|expiry date|status|name server"

Querying a Specific Server

.com and .net are "thin" at the registry level for contact data, so the registry tells you which registrar holds the full record. You can query a specific server with -h:

whois -h whois.verisign-grs.com example.com
whois -h whois.example-registrar.com example.com

If you don't know which server handles an extension, ask IANA:

whois -h whois.iana.org org | grep -i whois

whois:        whois.publicinterestregistry.org

On Windows

Windows doesn't include a whois command. You can install Microsoft's Sysinternals whois tool, use WSL, or query RDAP directly with PowerShell, which needs no extra software:

$r = Invoke-RestMethod "https://rdap.org/domain/example.com"
$r.events | Select-Object eventAction, eventDate
$r.status

With Python

Because the WHOIS protocol is so simple, you can query a server with a few lines of standard library code. This sends the domain to the server on port 43 and reads until the connection closes:

import socket
import sys


def whois_query(domain: str, server: str = "whois.verisign-grs.com") -> str:
    with socket.create_connection((server, 43), timeout=10) as sock:
        sock.sendall(f"{domain}\r\n".encode())
        chunks = []
        while data := sock.recv(4096):
            chunks.append(data)
    return b"".join(chunks).decode(errors="replace")


if __name__ == "__main__":
    domain = sys.argv[1] if len(sys.argv) > 1 else "example.com"
    for line in whois_query(domain).splitlines():
        if any(key in line for key in ("Registrar:", "Expiry Date", "Domain Status")):
            print(line.strip())

For anything beyond quick scripts, use RDAP instead. It returns JSON, so you don't have to parse free-form text that differs between servers.

Why the Owner's Details Are Usually Hidden

If you're hoping to see a name, address and phone number, you'll usually be disappointed. Two things hide them:

1. Data protection law. After the EU's GDPR took effect in 2018, ICANN introduced rules allowing registrars to redact personal data from public lookups. These were later formalised in ICANN's Registration Data Policy. In practice, most registrars now redact personal contact details for every customer, not just EU residents.
2. Privacy and proxy services. Many owners also use a service that replaces their details with the service's own. See what is domain privacy protection.

A redacted record typically looks like this:

Registrant Name: REDACTED FOR PRIVACY
Registrant Organization:
Registrant Street: REDACTED FOR PRIVACY
Registrant State/Province: CA
Registrant Country: US
Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant

The organisation, state or province, and country are often still visible, which can at least tell you whether a company or an individual owns the domain.

How to Contact a Domain Owner When Details Are Hidden

Use the Registrar's Contact Method

Registrars that redact email addresses must still provide a way to reach the registrant, usually a web contact form or an anonymised relay email address listed in the lookup. Messages are forwarded to the owner, who can choose whether to reply. This is the right route for purchase enquiries and general questions.

Check the Website Itself

If the domain hosts a site, the contact page, legal notice, privacy policy or social profiles often identify the owner more directly than WHOIS ever did.

Request Disclosure for a Legitimate Reason

If you have a legitimate need, such as a trademark complaint, a legal case or a security investigation, you can ask the registrar to disclose the redacted data. Registrars assess each request against privacy law. ICANN also runs the Registration Data Request Service (RDRS), which routes disclosure requests to participating registrars for gTLD domains. Disclosure isn't guaranteed, and you'll need to explain why you need the data.

Use a Broker or Escrow for Purchases

If you want to buy the domain and can't reach the owner, a domain broker may be able to make contact. When you do reach a deal, use escrow to protect both sides. See how to buy a domain that is taken and how to use domain escrow.

Report Abuse to the Registrar

If the domain is used for phishing, malware or fraud, you don't need to know the owner. Report it to the Registrar Abuse Contact shown in the lookup, and to the hosting provider if you can identify it.

Practical Uses for WHOIS Data

Even without owner details, a lookup helps with many everyday jobs:

• Find your registrar. If you've forgotten where a domain is registered, the Registrar field tells you.
• Check the expiry date. Make sure your own domains aren't about to lapse, or see when a domain you want might expire.
• Confirm a lock. Look for clientTransferProhibited to confirm your registrar lock is on.
• Check name servers. See where DNS is hosted before you change nameservers.
• Investigate a suspicious domain. A domain created a few days ago that's sending you an "urgent" invoice is a red flag.
• Research a domain before buying. Creation dates and registrar changes are one part of checking a domain's history.

Here's a short Bash script that prints the expiry date for a list of your domains using RDAP, which works for gTLDs whether or not the registry still runs WHOIS. It needs jq:

#!/usr/bin/env bash
for domain in "$@"; do
  expiry=$(curl -s -L "https://rdap.org/domain/$domain" \
    | jq -r '.events[]? | select(.eventAction == "expiration") | .eventDate')
  printf "%-25s %s\n" "$domain" "${expiry:-unknown}"
done

./expiry.sh example.com example.org example.net

example.com               2027-08-13T04:00:00Z
example.org               2027-08-30T04:00:00Z
example.net               2027-08-30T04:00:00Z

WHOIS for IP Addresses

WHOIS isn't only for domains. Regional Internet Registries such as ARIN, RIPE NCC and APNIC run WHOIS and RDAP services for IP addresses and networks. Running whois 8.8.8.8 tells you which organisation the address block is allocated to. That's useful for working out which hosting company or ISP runs a server, but it's a separate system from domain registration data.

---

FAQ: WHOIS Lookups

---

Conclusion

WHOIS is the lookup system for domain registration data. It tells you who the registrar is, when a domain was created and when it expires, which status codes and name servers it has, and, where privacy rules allow, who the registrant is. For gTLDs, the underlying protocol has been officially replaced by RDAP, but the name and the purpose live on, and the whois command still works for many domains.

Don't expect to see an owner's name and address any more. Personal details are now redacted by default, so use the registrar's contact form or relay email, the website itself, or a formal disclosure request when you have a legitimate need. For everyday tasks such as checking expiry dates, locks and name servers, a quick lookup remains one of the most useful tools you have.