Whois & RDAP Lookup — domain, IP address or AS number

What a whois record actually is

Whois is one of the oldest things still running on the internet. The protocol was written down in 1982 as RFC 812, and it is almost aggressively simple: open a TCP connection to port 43, send a line of text, read whatever comes back, connection closed. There is no schema, no field list, no agreement on what a line should look like. Every registry answers in its own layout, in its own language, with its own idea of which details matter.

That simplicity is why whois survived for forty years, and also why it is being retired. A human can read the output of any registry. A program cannot — not reliably, not across registries, and not without breaking the next time somebody edits a template.

The second thing worth knowing before you read any record: there are two completely separate systems here, and they are constantly confused with each other.

Domain records come from domain registries and registrars. They answer "who holds this name, through whom, until when".
Address records come from the five Regional Internet Registries. They answer "which organisation was allocated this block of IP addresses, and who handles complaints about it".

Different operators, different databases, different rules — including different privacy rules, which is the single most consequential difference and the reason a domain lookup today often looks empty while an address lookup is as detailed as it ever was.

RDAP: the replacement that has already happened

RDAP — the Registration Data Access Protocol — does the same job over HTTPS and answers in JSON with standardised field names. It was specified in 2015 across RFC 7480 to 7484, and the query and response documents were revised in 2021 as RFC 9082 and RFC 9083. Beyond the format, it brought three things port 43 never had: internationalised data with a declared encoding, a machine-readable way to say "this field was withheld", and bootstrapping — a registry at IANA that tells a client which server is authoritative for a given name, address or AS number, so nobody has to maintain a private list of "zone → whois server".

The timeline matters if you are wondering why some tools disagree with others. ICANN made RDAP mandatory for gTLD registries and registrars in August 2019, ran both protocols in parallel for years, and then retired the contractual requirement to keep port 43 alive at the start of 2025. Many operators still run it voluntarily; a growing number do not. Country-code domains are their own world — some publish RDAP, some publish only port 43, and a few publish neither and expect you to use a web form.

This page queries RDAP first and falls back to port 43 only for zones where no RDAP service is published. It is not a preference for the new thing: RDAP gives us named fields we can label correctly in your language, while a port 43 answer can only be shown to you as the block of text it arrived as.

Why domain records look empty now, and what is still public

Until 2018 a domain lookup returned the registrant's name, postal address, email and telephone number, for anyone who asked, with no logging and no limit. When the GDPR came into force, ICANN adopted a temporary specification that required this data to be redacted, and the redaction became permanent policy. What you now see instead of a name is usually a line saying the data is not disclosed, plus a web form or a forwarding address that relays mail without revealing the recipient.

What survived redaction is more useful than people expect:

Registrar and its IANA ID: Which company the domain is held through. This is who you contact about the domain itself, and who a transfer would come from.
Creation, update and expiry dates: The age of a domain is one of the few genuinely informative signals in the whole record — a "company" whose domain was created eleven days ago is telling you something.
Status codes: The EPP codes below. They describe what the registry currently permits, and they are where an expired or suspended domain gives itself away.
Nameservers and DNSSEC state: Which servers are authoritative for the zone, and whether the delegation is signed. Compare these with the actual DNS records — when they disagree, you have found the problem.

Address records were never redacted the same way, because the holder of an IP block is normally an organisation rather than a person. That is why the abuse contact on an address still works, and why looking up an address tells you far more about who runs a network than a domain lookup tells you about who runs a website.

Status codes: the part people skip and then need

EPP status codes are the registry's own machine-readable description of the domain's situation. A handful of them explain the majority of "the site suddenly stopped working" questions:

clientTransferProhibited: The registrar lock. This is the normal, healthy state for a domain somebody cares about — it prevents a transfer being started without unlocking first. Seeing it is good news.
ok: No restrictions at all. For a personal domain that is fine; for a business domain it means nothing is standing between an attacker with account access and a transfer.
clientHold / serverHold: The domain has been pulled out of the DNS entirely — the zone is no longer published, so nothing resolves. Set by the registrar or the registry respectively, usually for non-payment, a failed contact verification, or an abuse report. The whole site goes dark at once, which is why this looks like a catastrophic outage.
autoRenewPeriod: The domain passed its expiry date and was renewed automatically. The registrar can still reverse this for a period, so an unpaid domain sits here quietly before anything visible happens.
redemptionPeriod: It was deleted. It can still be recovered, but only by the previous holder and only for a redemption fee that is deliberately far higher than a renewal.
pendingDelete: The last stage. After five days the name is released. Anyone waiting to register a lapsed domain is watching for this code.

The practical arithmetic: an expired domain typically remains unavailable for around seventy-five days — up to forty-five days of auto-renew grace, thirty days of redemption, then five days pending delete. "It expired yesterday, I will grab it" is almost always wrong.

Thin and thick registries, or why two lookups disagree

Some registries store the full record; others store almost nothing. The .com and .net registries are thin: they hold the registrar, the nameservers and the dates, and nothing else. Everything about the holder lives at the registrar. Most newer generic domains and many country-code domains are thick and hold the complete record centrally.

This is why a lookup sometimes answers with little more than "this domain is managed by registrar X" — that genuinely is everything the registry knows. It also means the registry and the registrar can show different data at the same time, and each is authoritative for its own half: the registry for the delegation and the dates, the registrar for everything about the customer.

Reading an address or AS record

Address space is handed out by five regional registries — ARIN for North America, RIPE NCC for Europe, the Middle East and Central Asia, APNIC for Asia-Pacific, LACNIC for Latin America and the Caribbean, and AFRINIC for Africa. A record from any of them will normally tell you:

The range and its name. The exact block, plus the label its holder gave it. Provider network names often encode the city or the service — a small, reliable hint that no geolocation database is involved in.
The holder and the country. Note that the country here is where the block is registered, not where the equipment sits. A German provider can register a block that is used entirely in Poland, and nothing in the record will say so.
The parent allocation. Whether this is a block a provider received directly from the registry, or a smaller slice reassigned to one of its customers. When you are trying to work out whether you are looking at a hosting company or one of its tenants, this is the field that answers it.
The abuse contact. The mailbox the holder publishes specifically for complaints. It is monitored far more often than people assume, and a short factual report with timestamps and log lines gets acted on.

What a whois record cannot tell you

It cannot tell you who is behind a privacy service, whether a site is dangerous, or where anybody physically is. It also cannot be assumed correct: registries validate very little of what is entered, so an address block can carry a company name that stopped existing years ago, and a domain record can name a registrar that has since sold its business. The record is evidence of what was filed, not proof of what is true.

Use it for what it is good at — dates, delegation, status, and who to complain to — and combine it with checks that observe reality directly: what the DNS actually answers, what the server actually returns, and what mail systems think of the address.

Frequently asked questions

Why does the whois record not show the owner's name any more?

Because registration contacts for domains have been redacted since 2018, when data-protection law made publishing them by default untenable. What replaced the name is usually a web form or a forwarding address that reaches the holder without revealing them. The registrar, the dates, the status codes and the nameservers are still published, and for IP address ranges the holding organisation is still public, because it is an organisation rather than a private person.

What is the difference between whois and RDAP?

They answer the same question in different formats. Whois is plain text over port 43 with no agreed structure, so every registry looks different. RDAP answers over HTTPS in JSON with standard field names, can state explicitly that a field was withheld, and has a bootstrap service that points a client at the right server. RDAP has been mandatory for generic domains since 2019, and the requirement to keep the old port 43 service running was retired at the start of 2025.

Can I find out who owns a website from its domain record?

Usually not directly. You will learn which registrar the domain is held through, when it was registered and which nameservers it uses, but not the holder's identity. If you have a legal or security reason to need it, the route is a disclosure request through the registrar rather than a lookup — and many jurisdictions require a court order or a documented abuse case.

The domain expired yesterday. When can I register it?

Almost certainly not for another two and a half months. After expiry most domains sit in an auto-renew grace period of up to forty-five days, then thirty days of redemption during which only the previous holder can recover it, then five days of pending delete before the name is released. The status code in the record tells you exactly which of those stages it is in.

My site went offline and the record says clientHold. What does that mean?

The domain has been removed from the DNS by the registrar, so nothing resolves at all — mail included. It is set for non-payment, for a failed contact-verification email, or in response to an abuse report. Nothing on your server is broken and nothing you change there will help; the fix goes through the registrar.

Why does a lookup on an IP address show a company I have never heard of?

Because the record describes who holds the address block, which is normally a network operator or a hosting provider rather than the person using the address. If the record mentions a parent allocation, that tells you the block was reassigned from a larger one — a common sign that you are looking at a customer of a hosting company rather than the company itself.

Is the information in a whois record verified?

Very little of it is. Registries check that required fields are present and formatted correctly, not that they are true. Address blocks routinely carry the names of companies that were acquired or dissolved years ago. Treat the record as evidence of what was filed, and confirm anything important against what the network actually does.

Whois and RDAP lookup