WHOIS is a protocol and service for looking up registration data about domains and IP addresses, such as the registrar, name servers and expiry date of a domain. Many people also use the name for the web pages that display this data.
How does WHOIS work?
The protocol is defined in RFC 3912 from September 2004. A WHOIS server listens on TCP port 43. The client sends a text query ending in a carriage return and line feed, the server answers with human-readable text and closes the connection. The closed connection tells the client that the answer is complete. The RFC itself notes that WHOIS lacks features expected of a newer IETF protocol, such as internationalization and security mechanisms.
A record can include the registrar, registration and expiration dates, domain status and name servers. Many domain owners use privacy services that replace their contact details with those of the registrar. For gTLDs, ICANN’s Temporary Specification, effective May 25, 2018, responds to the General Data Protection Regulation (Regulation (EU) 2016/679) and restricts most personal data to tiered access. This is not legal advice.
WHOIS and RDAP
ICANN announced that from January 28, 2025, the Registration Data Access Protocol (RDAP) is the definitive source for registration data of generic top-level domains (gTLDs) in place of the sunsetted WHOIS services. RDAP supports internationalization, secure access and different access levels. Public data can be searched at lookup.icann.org. Country-code domains follow the rules of their registry. For .de, DENIC’s domain query shows name and address of the holder for legal entities, according to DENIC, while holder data of natural persons stays protected for data protection reasons.
Example
whois example.com
The command queries the registration data. The output typically shows the registrar, creation and expiry dates and name servers.
Common mistakes
- Expecting owner details. Since the 2018 Temporary Specification, personal data for gTLDs is restricted to tiered access, so many records show no owner.
- Using port 43 WHOIS as the definitive source for gTLDs. According to ICANN, RDAP has been the definitive source for gTLD registration data since January 28, 2025.
FAQ
How can I find out who owns a domain? Through WHOIS or RDAP. Many records no longer show the owner because of privacy protection.
What does WHOIS stand for? The name is read as “who is”.
Sources
- RFC 3912: WHOIS Protocol Specification – IETF (September 2004)rfc-editor.org
- ICANN Update: Launching RDAP, Sunsetting WHOIS (January 27, 2025)icann.org
- What is WHOIS? – Network Solutions (secondary)networksolutions.com
- Temporary Specification for gTLD Registration Data (effective 25 May 2018) – ICANNicann.org
- Facts about DENIC's domain query (whois service) – DENICdenic.de
Last updated: