How to Read a WHOIS Record and What Each Field Means
A field-by-field walkthrough of a WHOIS record: registrar vs registrant, the three dates that matter, name servers, status codes, and why half the contact fields are now redacted.
Step-by-step
- 1
Run the lookup on the registrable domain
Open the WHOIS Lookup and enter the bare registrable name, like example.com, not www.example.com or a full URL. WHOIS answers about domains, not hostnames, so the www prefix confuses some servers and returns nothing. If you paste a subdomain such as api.example.com, strip it back to the last two labels first. For country-code domains you sometimes need the local registry's own suffix rules, but the tool handles that routing for you and picks the right server.
- 2
Separate the registrar from the registrant
These two get mixed up constantly. The registrar is the company that sold and manages the domain, GoDaddy, Namecheap, Cloudflare, and it appears in the Registrar field along with an IANA ID. The registrant is the person or organization that actually owns the name. On a well-run domain the Registrar line is always populated; the registrant contact block may be empty or masked. Reading the registrar tells you who to contact for transfers and abuse reports, which is often what you actually need.
- 3
Read the three dates in order
Creation Date tells you the domain's age; a name registered last week behind privacy protection is a different risk profile than one from 2004. Updated Date changes when name servers, status, or contacts move, so a very recent update on an old domain can mean a transfer or a hijack. Registry Expiry Date is the hard deadline. Watch for the gap: domains renew up to the expiry, then enter a redemption grace period, so an expired date does not immediately mean the name is free to grab.
- 4
Check the name servers
The Name Server lines show where the domain's DNS is actually hosted, ns1.cloudflare.com, dns.google, or a registrar's default servers. This is a quick sanity check: if a client swears they moved DNS to a new provider but WHOIS still lists the old name servers, the delegation never took effect at the registry. Pair this with the DNS Propagation Checker to confirm what those name servers are actually answering right now.
- 5
Decode the status codes
The Domain Status field carries EPP codes that control what can happen to the name. clientTransferProhibited is normal and usually good; it means the registrar has locked the domain against transfers, which blocks casual hijacking. clientHold is a red flag: the domain is removed from DNS, often for non-payment or a dispute, so the site is down by registry action, not a server problem. pendingDelete and redemptionPeriod tell you the name is on its way out. serverHold and serverTransferProhibited are set by the registry itself and are harder to clear.
- 6
Understand the redacted contact fields
Since GDPR, most gTLD records replace the registrant name, email, and phone with a privacy string or a REDACTED FOR PRIVACY placeholder, sometimes routed through a proxy email. This is expected, not a broken lookup. You will still usually get the organization on business domains, the country, and the state or province. If you genuinely need to reach the owner, the record often provides an anonymized contact form URL instead of a real address. Do not read redaction as evidence the domain is shady; it is the default now.
- 7
Use it to vet a domain before buying
Before you pay for a name on the secondary market, read the record end to end. A long creation date with clean status codes and no recent updates is a good sign. Check the expiry so you know how much runway you inherit. Watch for serverHold or pendingDelete, which can complicate a transfer. And confirm the name servers match what the seller claims. A two-minute WHOIS read routinely catches a domain that is about to expire out from under the deal.
Thin vs thick WHOIS
Not every registry stores the same data. In a thick model, the registry holds the full contact set and the registrar's data, so one query returns everything. In a thin model, common for .com and .net under Verisign, the registry only knows which registrar sponsors the name and where to ask next; the actual contacts live at the registrar. That is why a first lookup on a .com sometimes returns a short record pointing you at a second server. The tool follows that referral automatically, but it explains why two domains can produce very different-looking output.
RDAP, the modern replacement
WHOIS is a 1980s protocol that returns free-form text with no fixed format, which is why parsers break so often. RDAP, the Registration Data Access Protocol, is its structured successor: it answers over HTTPS with JSON, supports consistent field names, standardized status values, and proper redaction, and can hand back links to further resources. ICANN now requires RDAP for gTLDs. When you run a lookup here you may see cleaner, normalized output because it prefers RDAP where available and falls back to legacy WHOIS only when it must.
- Registrar: the company managing the domain, with an IANA ID and an abuse contact.
- Registrant: the actual owner, usually redacted on privacy-protected names.
- Registry Expiry Date: the renewal deadline, followed by grace and redemption periods.
- Domain Status: EPP codes like clientTransferProhibited and clientHold.
A brand-new domain is not automatically malicious and a decade-old one is not automatically safe. Treat the creation date as one input alongside the DNS records, the hosting, and the mail setup. WHOIS answers who registered a name and when; it never tells you what the site actually serves.