What Is WHOIS? Domain Lookup Explained (2026)

What Is WHOIS? Domain Lookup Explained (2026)

WHOIS is the public registration directory for domain names — and in everyday language, a "WHOIS lookup" means fetching that record (registrar, dates, nameservers, status), whether the transport is legacy port-43 WHOIS or modern RDAP.

Just need to look up a domain right now? Paste it into the free WHOIS Lookup. It follows the public referral chain and surfaces the fields that matter for hygiene and triage: registrar, creation / update / expiry, nameservers, and EPP status. The rest of this article explains what those fields mean, how RDAP fits in for gTLDs in 2026, and the ethics line for authorized recon.

What WHOIS actually is

Every registered domain sits in a registry database. That database answers basic questions: who sponsors the name (the registrar), when it was created and when it expires, which nameservers hold the zone, and which status codes currently apply. The historic way to ask those questions was the WHOIS protocol — a plain-text query over TCP port 43 against a registry or registrar WHOIS server, often after a referral hop from IANA.

In practice, people say "WHOIS lookup" for the job, not only for the old protocol:

There is no single global WHOIS server. Lookups chase a referral chain: ask which server is authoritative for the TLD, query that registry, and sometimes follow one hop to a registrar WHOIS endpoint for a fuller view. Formats differ by TLD. Treat parsed fields as a convenience layer on top of a messy, registry-specific wire format — and prefer the registry values for creation and expiry when a registrar copy disagrees.

This article is for domain hygiene, white-hat recon, and incident-response triage against public registration data. It is not a guide to doxxing, stalking, or collecting personal contact details.

RDAP in 2026: the gTLD cutover

Registration Data Access Protocol (RDAP) was designed to fix WHOIS's weak spots: no standard discovery, weak internationalization, plain-text transport, and little room for differentiated access. RDAP speaks HTTPS and returns structured JSON. ICANN-accredited registrars and gTLD registries have offered RDAP since 2019.

The operational cutover is explicit. In its 27 January 2025 update, ICANN stated that as of 28 January 2025, RDAP is the definitive source for delivering gTLD registration information in place of sunsetted WHOIS services. Users are pointed to ICANN Lookup (RDAP-based) and to ICANN's open-source command-line client.

What that does not mean:

• Not every TLD on earth flipped overnight. Country-code TLDs (ccTLDs) and some registries may still expose legacy WHOIS, different disclosure policies, or both. Do not treat the gTLD sunset as a universal "WHOIS is dead everywhere" claim.
• Colloquial "WHOIS lookup" did not disappear. Searchers, tickets, and IR playbooks still say WHOIS. Tools may still speak port 43 for some TLDs while using RDAP for gTLDs. Read the record; don't argue the label.
• Authoritative discovery matters. RDAP's service-discovery model is one of the advantages ICANN lists over classic WHOIS. Prefer well-known lookup UIs (ICANN Lookup, your registrar, or a vetted live tool) over random scraped "WHOIS APIs."

For day-to-day defender work in 2026: if you need the current public gTLD registration view, start from RDAP-backed sources. If a ccTLD only answers on WHOIS, that is expected — document the source you used.

Fields that matter for security

When you open a registration record, ignore the noise and read these first.

Registrar

The company through which the domain is registered. Useful for:

• Knowing whom to contact for an authorized takedown or ownership dispute process
• Spotting registrar hopping on related malicious names (same cluster, same cheap registrar patterns — hypothesis only, not proof)
• Checking your own portfolio is where you think it is

Creation, last update, expiry

Trust the registry expiry when registrar and registry disagree. Calendar reminders on your production domains beat heroic recovery later.

Nameservers

Authoritative NS for the zone. Compare them to what you expect from change tickets or your DNS provider console. Sudden NS drift on a domain you own is a hijack / account-takeover clue. On a suspicious lookalike domain, shared or bulletproof NS patterns can support clustering — still public data, still hypothesis until verified elsewhere.

EPP / RDAP status codes

Status codes say whether the name is locked against transfer, delete, or update; whether it is on hold; whether a transfer or delete is pending. Client codes are set by the registrar; server codes are set by the registry and take precedence. ICANN's plain-language guide is at icann.org/epp. The same values appear in RDAP under mapped status strings in the IANA RDAP JSON Values registry (for example client transfer prohibited ↔ EPP clientTransferProhibited).

Blank or redacted registrant ≠ unowned. GDPR, local privacy law, and registrar privacy/proxy services routinely hide personal contact fields. The domain can still be fully registered, locked, and resolving. Registrar, dates, nameservers, and status remain the operationally useful public surface.

Privacy and ethics

Public registration data is still personal-data-adjacent. Treat it that way.

1. Expect redaction. Empty name / email / phone fields are normal on many gTLD records in 2026. Do not invent workarounds to unmask people for curiosity.
2. Stay on public data for everyday recon. Browser/RDAP/WHOIS lookups of public fields for authorized scopes, brand protection, and your own inventory are the standard path. See also our OSINT beginner legal methodology.
3. Authorized use only. Own domains, written engagement scope, or a clear legitimate purpose. No stalking, no harassment dossiers, no "find this person's home address via WHOIS" framing.
4. Nonpublic disclosure is a process, not a hack. ICANN's announcement points requesters who need nonpublic gTLD registration data to the Registration Data Request Service (RDRS) for participating registrars, or to the sponsoring registrar's own disclosure process — after confirming the data is unavailable in ICANN Lookup. ICANN describes RDRS as intended for parties with a legitimate interest in nonpublic data, such as law enforcement, intellectual property professionals, consumer protection advocates, cybersecurity professionals, and government officials. That is a gated disclosure channel with purpose limits — not a free-for-all people-search API.

If your question cannot be answered from public fields and you lack a legitimate disclosure path, stop. Document what you could verify publicly and escalate through counsel or the proper abuse channel.

Live lookup vs raw clients

Three common ways people pull registration data:

When to use the Andrax tool: quick triage on a suspicious hostname, hygiene check on a domain you own, or teaching someone what "expiry" and "transfer prohibited" look like without installing clients. Pair it with adjacent recon on the same asset:

• Reverse DNS Lookup — PTR + forward-confirmed rDNS on the hosting IP
• IP Address Info — scope (public vs private/reserved) and reverse-pointer naming; see also how IPv4 notation and CIDR work
• Email Security Checker — SPF / DKIM / DMARC on the same domain once registration hygiene looks sane

Same-domain hardening often sits next door: after registration locks and expiry are under control, review browser-side policy with HTTP security headers.

Raw clients still matter for automation and for TLDs your browser tool handles awkwardly. Keep the ethics constraints identical: public queries, authorized targets, no bulk scraping that turns into abusive traffic.

Defender checklist (own domains)

On names you own or are contracted to protect:

1. Confirm registrar login MFA and recovery channels.
2. Ensure transfer / delete / update locks (clientTransferProhibited and friends, or registry lock where offered).
3. Calendar registry expiry; verify auto-renew actually charges a live payment method.
4. Diff nameservers against your DNS source of truth after any incident involving account recovery or registrar support calls.
5. Re-check the public record after changes with WHOIS Lookup or ICANN Lookup.

FAQ

Is WHOIS the same as RDAP?

No. WHOIS usually means the legacy port-43 protocol (and, colloquially, any registration lookup). RDAP is the HTTPS/JSON registration-data protocol. For gTLDs, ICANN treats RDAP as definitive as of 28 January 2025; many people still call the action a WHOIS lookup.

Why is the registrant blank?

Privacy law and privacy/proxy services redact personal contact fields by default on many TLDs. The domain is still registered. Read registrar, dates, nameservers, and status instead.

Does missing clientTransferProhibited mean the domain is hijacked?

No. It means the registrar has not applied that lock (or it was removed for a legitimate transfer). On domains you own, ask the registrar to enable locks. Absence alone is not proof of compromise.

Can I use WHOIS/RDAP to identify a phishing domain owner?

You can use public fields for triage: age, NS, registrar, status. Personal identity is often redacted. For nonpublic gTLD data, use RDRS or the registrar's disclosure process when you have a legitimate interest — not informal scraping.

Should I still learn the whois CLI?

Yes, for labs and scripting — with the same public-data and authorization limits. For a one-off check, the live WHOIS Lookup is enough.

Closing

A WHOIS lookup, in 2026 language, is still "show me this domain's registration record." Under the hood, gTLDs have moved to RDAP as the definitive public source, privacy redaction is normal, and the fields that pay rent for defenders are registrar, dates, nameservers, and EPP status — not a fantasy of always-visible home addresses. Stay on public data, keep locks on your own inventory, and escalate nonpublic needs through proper disclosure channels.

When you are ready to read a live record, use the WHOIS Lookup tool on Andrax.