WHOIS Lookup: How to Find Domain Registration Information
A WHOIS lookup retrieves registration data for any domain — who registered it, when it expires, and which nameservers it uses. Here is how to use it and what the results mean.
WHOIS Lookup: How to Find Domain Registration Information
A WHOIS lookup retrieves the registration record for a domain directly from the authoritative WHOIS database. It tells you who registered the domain, when it was registered, when it expires, and which nameservers control it.
How to Do a WHOIS Lookup
Using ElasticDomain
- Add the domain to your dashboard and run any scan.
- Click the WHOIS tab to see all parsed and raw WHOIS data.
- For a quick one-off lookup: use the API endpoint GET /api/v1/tools/whois?domain=example.com (1 credit).
ElasticDomain queries the authoritative WHOIS server for each TLD directly over TCP port 43 (RFC 3912). Results come straight from the registry — not from cached third-party data.
What WHOIS Data Contains
Always Available
- Expiry date — when the registration lapses
- Registrar — the company where the domain is registered (GoDaddy, Namecheap, etc.)
- Nameservers — which DNS servers are authoritative for the domain
- Domain status codes — operational status (clientTransferProhibited, etc.)
- Creation date — when the domain was first registered
Sometimes Available (Depends on Privacy Settings)
- Registrant name and organization — who owns the domain
- Registrant contact details — email, phone, address
- Admin and technical contacts
GDPR and Privacy Protection
Since 2018, most registrars redact registrant contact data under GDPR for European registrations — and many do it globally. You will often see:
Registrant Name: REDACTED FOR PRIVACY Registrant Email: Please query the RDDS service...
The expiry date, registrar, and nameservers are never redacted — they are operational data required to remain public.
Domain Status Codes Explained
| Status | Meaning |
|---|---|
| clientTransferProhibited | Normal — domain cannot be transferred without owner authorization |
| clientDeleteProhibited | Domain cannot be deleted at registrar level |
| ok | No restrictions (common on simpler registrations) |
| serverHold | Domain is suspended — not resolving |
| pendingDelete | Domain being deleted — will drop soon |
| redemptionPeriod | Expired, in recovery period before deletion |
clientTransferProhibited is expected and good — it prevents unauthorized transfers. serverHold and pendingDelete are urgent situations requiring immediate action.
What WHOIS Is Used For
Domain Expiry Monitoring
The expiry date is the most important WHOIS field. Automated monitoring queries WHOIS regularly and alerts domain owners before expiry. ElasticDomain does this on every scan.
Domain Due Diligence (Buying or Selling)
Before buying a domain, WHOIS tells you:
- Domain age (older domains have more SEO authority history)
- Current registrar
- Whether transfer lock is active (clientTransferProhibited)
- Registration history signals
Security Research
WHOIS helps trace malicious domains back to their registrars and registration patterns.
Brand Protection
Searching for newly registered domains containing your brand name can surface squatters before they build phishing infrastructure.
Monitoring WHOIS Changes
For owned domains, any unexpected WHOIS change is a security signal:
- Registrar change → unauthorized transfer attempt?
- Nameserver change → DNS hijacking?
- Registrant change → ownership fraud?
Set up WHOIS monitoring alerts in ElasticDomain:
- Domain detail → Alerts → Create Alert Rule
- Trigger: WHOIS Changed or Nameserver Changed
- Save
You will be alerted immediately if any WHOIS field changes.