How to Read a WHOIS Record, Field by Field

Most people run a WHOIS lookup to answer one question, usually "who owns this?", and come away disappointed because the owner's name is redacted. But the record still has plenty in it. The dates tell you how old the domain is and whether it is about to lapse. The status codes tell you whether it is locked, suspended or on its way to deletion. The name servers tell you who runs its DNS. Together they often answer the question you actually had.

This guide walks through a domain record one field at a time. If you want the background first (what WHOIS is, how it differs for IP addresses, and why it is being replaced), start with our explainer on what WHOIS is. To follow along, open our WHOIS lookup in another tab and try a domain you know.

Whose record are you reading?#

Two organisations hold data about every domain. The registry runs the top-level domain itself: Verisign for .com, for example. The registrar is the company you bought the name from. The registry knows the core facts (which registrar sponsors the name, the key dates, the status codes, the name servers). The registrar usually holds the customer side, including the contact details.

Since 28 January 2025, ICANN treats RDAP, the Registration Data Access Protocol, as the definitive source of registration data for generic top-level domains. RDAP answers in structured JSON over HTTPS rather than the free-form text of the old port-43 WHOIS service. The two-layer arrangement shows up clearly in it. Ask Verisign's RDAP server about google.com and the answer carries the registrar, dates, statuses and name servers, but no registrant at all. Instead it includes a link marked related that points at the registrar's own RDAP server, which is where any contact data lives.

Our tool queries the registry, which it finds through IANA's public list of RDAP servers, and shows you which server answered. A site that follows the link through to the registrar may show contact fields that a registry-only answer leaves out.

The registrar and its IANA ID#

The registrar field names the company the domain is registered through. It is not the web host, and it is not necessarily the DNS provider. A domain can be registered at one company, use another for DNS and be hosted on a third.

Next to the name you will often see an IANA Registrar ID, a number ICANN assigns to each accredited registrar. IANA publishes the full list, along with each registrar's RDAP address. Names change after acquisitions and get abbreviated differently by different tools; the ID stays fixed. For google.com the ID is 292, which belongs to MarkMonitor, a registrar used by many large brands. Seeing an enterprise registrar like that on a domain is a small signal that a large organisation is looking after it.

The dates#

RDAP records dates as events, each with an action and a timestamp in UTC. Four turn up most often:

• Registration, the creation date. This is when the current registration began. If a domain lapsed and someone registered it fresh, this date usually starts again from that new registration, so an old, well-known name showing a creation date from last month has very likely changed hands.
• Expiration, the date the registration is paid up to. Under a month away is worth attention on any domain you depend on. Our tool shows the days remaining and flags anything under 90 days in amber and under 30 in red.
• Last changed, the last time something in the record was modified, such as name servers, statuses or the sponsoring registrar. A recent change on a domain that has been quiet for years is worth a second look if you were not expecting one.
• Last update of RDAP database, which describes the database, not the domain. It is the time the registry last refreshed the data you are reading, and it will often be minutes old. Do not mistake it for activity on the domain.

Domain age is the most useful single field for judging an unfamiliar site. Phishing domains tend to be days or weeks old when they are used, because they are registered for a campaign and abandoned when they get blocked. A "bank" or a "family-run shop since 1998" on a domain created a fortnight ago deserves suspicion. Age is not proof either way, though. Plenty of legitimate businesses are new, and attackers sometimes buy aged domains to look established.

Status codes#

Status codes come from EPP, the protocol registrars use to talk to registries. In RDAP output you may see them written as camelCase (clientTransferProhibited) or with spaces (client transfer prohibited). They mean the same thing.

The prefix tells you who set the code. ICANN's own guide puts it plainly: client codes are set by registrars, while server codes are set by registries and take precedence over client codes.

• ok: the standard state, with no pending operations or prohibitions.
• clientTransferProhibited: the transfer lock. The registry will reject requests to move the domain to another registrar. Many registrars set it by default, and you want it on for any domain you care about. You switch it off at your registrar only while you are deliberately transferring.
• clientUpdateProhibited and clientDeleteProhibited: further locks against changes and deletion.
• The server…Prohibited versions: the same locks applied at the registry. A full set of client and server locks, as on google.com, is typically the sign of a "registry lock" service, where changes need a manual, out-of-band confirmation. It is a defence against hijacking through a compromised registrar account.
• clientHold or serverHold: the domain is not published in DNS, so it will not resolve at all. This is how registrars and registries suspend domains for unpaid bills, abuse complaints or legal orders. If a site has vanished and its record shows a hold, that is why.
• addPeriod: a grace period during the first several days after registration. On a domain you received a suspicious email from, it is a strong sign the name is brand new.
• autoRenewPeriod: the registry has auto-renewed the domain at expiry and the registrar has a limited window to decide whether to keep it. The expiry date may have rolled forward a year even though nobody has actually paid.
• redemptionPeriod: the registrar has deleted the domain, but the original owner can still restore it, usually for a fee. ICANN describes this state as lasting 30 days.
• pendingDelete: the end of the line. When it follows redemption, ICANN says the domain is purged five calendar days later and then becomes available to anyone.

If you own a domain and see redemptionPeriod on it, call your registrar the same day. Restoring it is usually possible but costs more than an ordinary renewal, and once pendingDelete appears it generally cannot be recovered at all.

Name servers and DNSSEC#

The name servers in a registration record are the delegation: the servers the parent zone sends resolvers to when they ask about the domain. Their hostnames usually reveal the DNS provider at a glance. *.ns.cloudflare.com means Cloudflare, names containing awsdns mean Amazon Route 53, and ns1.google.com style names mean the organisation runs its own.

The delegation is not always what the domain's own zone says. If you changed DNS providers and updated the zone's NS records but not the registration, the registry is still sending everyone to the old provider. Compare the two: the record here, and the live NS records from our DNS lookup. They should list the same servers.

The DNSSEC field in RDAP is a yes-or-no flag called delegationSigned. RFC 9083 defines it as true if there are DS records in the parent. It tells you a DS record has been published, which is the parent zone's promise that the domain's answers are signed. It does not tell you the signatures are valid. A DS record left behind after a move to a provider that does not sign the zone makes validating resolvers reject the domain outright, and the registration record will still say "signed". Our DNSSEC validator walks the actual chain, and our guide to how DNSSEC works explains what the DS record is anchoring.

Contacts, redaction and the abuse address#

RDAP describes people and companies as entities, each with one or more roles: registrant, administrative, technical, billing, abuse, registrar and a few others. For most domains today, the registrant's personal details are withheld. RFC 9537 gives servers a standard way to say so: a redacted list naming each withheld field, so a client can tell "hidden" from "never existed". Not every server uses it, and some simply leave the entity out, which is why our tool treats a missing registrant as redacted.

What survives redaction is still worth reading. Some registries publish the registrant's organisation and country even when the name is hidden, and companies that want to be identified often opt in to full display. A privacy service's name in the organisation field means the owner is paying to stay anonymous, which is common and harmless for individuals and a mild flag for a site asking for your card number.

The abuse contact, usually listed under the registrar, is the field most people actually need. ICANN requires accredited registrars to publish one and to investigate and respond to the reports it receives. If you are reporting a phishing site, this address, not the hosting company or the registrant, is the party that can suspend the domain itself.

Three records, read start to finish#

A suspicious email from secure-payments.example. Created nine days ago, status shows addPeriod and a transfer lock, retail registrar, registrant redacted, name servers at a free DNS host. Nothing here proves fraud, but a payments brand would not be launching on a nine-day-old domain. Report it to the registrar's abuse address and run the name through our typosquatting checker, since lookalikes tend to come in batches. Our post on typosquatting covers the patterns.

Your own company's domain. Check that expiry is comfortably far off and auto-renewal is on at the registrar, that clientTransferProhibited is set, and that the name servers match the provider you actually use. If DNSSEC shows as signed, confirm it validates. Two minutes once a year covers the failures that take whole companies offline.

A site that has disappeared. If the record shows clientHold or serverHold, the domain has been suspended. If it shows redemptionPeriod or pendingDelete, it expired and nobody renewed it. If the lookup returns not found, the name has been released and is available to register.

One practical limit: a few country-code domains, such as .de and .jp, still publish no RDAP service, and our tool says so rather than guessing. For those, the registry's own website or a command-line whois client is the way in.