About this tool

What you get back

Registrar — The company the domain was purchased through (GoDaddy, Namecheap, Cloudflare Registrar, GKG.Net, etc.). This is usually the answer you actually need: it tells you which account to log into to renew or transfer.
Created date — When the domain was first registered.
Expires date — When the registration runs out. Color-coded: yellow if within 60 days, red if expired.
Name servers — Which DNS servers are authoritative for the domain. Sometimes this is a different company than the registrar (e.g. registered at GoDaddy but using Cloudflare's DNS).
Status codes — EPP status flags like clientTransferProhibited (locked against transfer, normal default) or serverHold (suspended).
Abuse contact — Email/phone for reporting abuse from this domain (spam, phishing, malware).
DNSSEC — Whether the domain has DNSSEC signing enabled.

Why some fields are empty (that's normal)

Registrant name and contact info are usually hidden. Most registrars wrap consumer domains in a privacy proxy ("Domains By Proxy", "Privacy Service Provided By Withheld For Privacy", etc.) — this is a feature, not a missing field. The registrar field stays accurate, which is what you need for "where do I log in to renew this."

Which TLDs are supported

Most modern TLDs work great via RDAP — including all of .com, .net, .org, .io, .ai, .app, .dev, .co, .uk, .de, .eu, plus the new gTLDs (.tech, .cloud, .xyz, .online, etc.). Some country-code TLDs (.cn, .jp, .ru, .kr) don't expose RDAP publicly and will return an error — for those you have to use the country registry's own WHOIS site directly.

Privacy

The query goes from your browser to this site to the appropriate registry's RDAP server. We log nothing about who looked up what. Results are cached at the edge for 1 hour per domain so popular lookups are fast.

Why RDAP, not WHOIS?

The classic WHOIS protocol from the 1980s sends unstructured text over TCP port 43. Each registry returns data in their own format, with their own field names, and parsing it reliably is a nightmare. RDAP (Registration Data Access Protocol, RFC 7480-7484, finalized 2015) is the modern replacement — it's HTTP, returns clean JSON, has proper rate limiting and authentication. ICANN required all gTLD registrars to support RDAP by 2019. This tool uses RDAP exclusively for reliable, structured results.

When this is most useful

DNS audit. You're auditing a customer's DNS and find a domain you don't recognize. Run it through here — registrar tells you which account it's in, the expiration date tells you whether to renew it now, and the name servers tell you whether DNS is hosted at the same place. Combined with DNS Propagation Check you've got the full picture in 30 seconds without logging into anything.

Phishing investigation. A suspicious email arrives from a domain you don't recognize. Run the domain through here — registration age is a huge signal. A domain created last week is almost certainly a phishing operation; a 10-year-old domain is more likely a real (if compromised) sender. Pair with Email Header Analyzer to see the full delivery path and authentication results.

Outbound deliverability. Customer's email is bouncing. After running Email Health Check on their domain to verify SPF/DKIM/DMARC, run the domain through here to confirm it's not expired or about to expire — domains in their renewal grace period sometimes get held by registries, which silently breaks mail flow.

Why WHOIS still matters, even in the RDAP era

WHOIS was invented in the 1980s as a directory service for the early internet. Anyone could look up who owned a domain, what registrar handled it, when it was registered, when it expired, and the contact details for the owner. For decades that was the standard way to identify domain ownership.

WHOIS is being replaced by RDAP (Registration Data Access Protocol), a modern JSON-based successor with standardized field names, proper authentication support, and structured data. Most registries now serve their data via RDAP, and this tool queries RDAP endpoints under the hood. When I say "WHOIS lookup" I mean the general concept of looking up domain registration data — the underlying protocol is RDAP now, but the everyday name hasn't fully caught up.

Historical WHOIS made contact details public by default. This became a magnet for spam and harassment, and the introduction of GDPR in 2018 essentially ended the practice of publishing personal contact info. Modern WHOIS/RDAP responses redact personal details for most registrants, showing only the registrar as a contact. This preserves the useful information (who to talk to about the domain) while protecting personal privacy.

What the lookup tells you

Registrar

Which company sold the domain to whoever registered it. Common registrars include GoDaddy, Namecheap, Cloudflare, Google Domains (now Squarespace Domains), Porkbun, and dozens of others. The registrar is who you'd contact for administrative issues with the domain.

Some registrars have specific patterns: Cloudflare charges at cost with no markup (great for high-domain-count users but not designed for casual customers). GoDaddy is aggressive on upsells and has a mixed reputation. Namecheap is popular for cost-conscious individual registrants. Enterprise-focused registrars like MarkMonitor and CSC handle domain portfolios for large companies.

Registration date

When the domain was first registered. This is one of the more informative fields for investigation purposes. A domain registered three days ago that's suddenly sending you invoices is almost certainly a phishing operation. A domain registered fifteen years ago has established history that's harder to fake.

Expiration date

When the current registration ends. If nobody renews before this date, the domain enters a grace period, then a redemption period, then eventually becomes available for anyone to register. Domains close to expiration are worth watching if they matter to you — either to renew (if it's yours) or to catch (if you want it and the current owner is letting it lapse).

Updated date

When the registration was last modified. A recent update might indicate a nameserver change, contact info update, or transfer between registrars. In investigation contexts, sudden updates are often noteworthy.

Nameservers

Which DNS servers are authoritative for the domain. This tells you where the domain's DNS is hosted, which is often different from the registrar. A domain registered at GoDaddy might use Cloudflare's nameservers, meaning DNS is at Cloudflare even though the domain is at GoDaddy.

Common nameserver patterns:

ns1/ns2/ns3/ns4.registrar.com: DNS at the registrar itself (default for most retail registrars)
*.cloudflare.com: DNS at Cloudflare
*.awsdns-XX.com/net/org/co.uk: DNS at Amazon Route 53
ns-cloud-*.googledomains.com: DNS at Google Cloud DNS
Custom nameservers on the same domain: enterprise-level DNS management with in-house or specialized provider

Domain status codes

EPP (Extensible Provisioning Protocol) status codes describe the current state of the domain in the registry. Common ones:

clientTransferProhibited: transfer lock enabled by the registrar. Prevents domain transfer without the owner explicitly removing this lock.
clientUpdateProhibited: DNS updates locked. Rare, used for very high-security domains.
clientDeleteProhibited: deletion locked. Standard for active domains.
serverTransferProhibited: transfer lock at the registry level (more secure than client-level).
pendingTransfer: a transfer is in progress.
redemptionPeriod: the domain expired and is in the redemption grace period. Can still be recovered by the original owner with a redemption fee.
pendingDelete: the domain will be deleted from the registry shortly. Can no longer be recovered by the original owner.

Where I actually use WHOIS lookups

Investigating a suspicious email

An email arrives from a domain that looks legitimate but something feels off. A quick WHOIS check often reveals it's a domain registered last week, with no history, using a registrar that specializes in bulk registration. Combined with looking at the sending IP with the IP Lookup tool, you can quickly build a picture of whether it's a genuine business or a phishing operation.

Auditing DNS I've inherited

When I take over IT for a business, their DNS often has records I don't recognize — old domains, subdomains from past projects, forgotten redirects. A WHOIS check on each unfamiliar domain tells me the registrar and expiration, which helps me build an inventory of what to keep and what to let expire.

Planning a domain migration

Moving a domain to a new registrar requires several things to be true: transfer lock removed, transfer authorization code obtained, at least 60 days since previous transfer or registration. WHOIS shows the current status of the transfer lock and the last modified date, which help me plan the migration timing.

Setting up rate-limited automation

Some domain-related tools want to know when a domain last changed. Rather than triggering on every DNS change (many of which are legitimate), I can check WHOIS's updated date to see if the registration itself has recently changed. This filters out DNS-only changes from actual registration changes.

Buying a domain from someone

Even with modern privacy protections, WHOIS shows the registrar and expiration. That tells me whether the current owner has a working relationship with the registrar and roughly when they'll need to make a renewal decision. If a domain I want is expiring in 60 days and the owner isn't very responsive, waiting for expiration and letting it drop might be the better strategy than trying to negotiate.

What WHOIS can't tell you

The actual owner

Modern WHOIS shows the registrar as the abuse contact but redacts the actual owner's personal information. Getting the real owner requires either (a) the registrar cooperates, which they generally don't without cause, (b) legal process, which requires a specific reason, or (c) the domain owner has voluntarily made themselves visible in the WHOIS.

Some ccTLDs (country-code TLDs) have different privacy rules. UK, US, and many others still redact personal info. Some smaller ccTLDs have different policies. Don't assume WHOIS is uniformly redacted — some domains still have full contact details.

DNS records

WHOIS tells you where DNS is hosted (via nameservers) but not what records exist at those nameservers. To see the actual DNS records, use the DNS Lookup or DNS Propagation Checker.

Website content or activity

WHOIS is registration metadata only. It doesn't tell you what's hosted at the domain, whether it's actively used, whether it hosts a legitimate business, or anything else about actual behavior.

Historical ownership

Public WHOIS shows the current state. Historical WHOIS databases (like DomainTools' historical Whois) show past ownership, but require a paid subscription for programmatic access. For understanding a domain's ownership history over time, historical WHOIS is the tool.

Some ccTLD quirks worth knowing

.co (Colombia)

The registry doesn't respond to public RDAP queries from cloud infrastructure. You can look up .co WHOIS manually at the registry's website, but automated tools like this one usually can't retrieve it. If you specifically need .co WHOIS data, plan for manual lookups.

.io (British Indian Ocean Territory)

Popular as a domain for tech startups. Standard WHOIS works. Occasional discussions about the geopolitical status of the .io TLD but no immediate impact on registered domains.

.ai (Anguilla)

Registration prices are significantly higher than most TLDs. Popular with AI startups. Standard WHOIS works.

Various privacy-focused ccTLDs

Some smaller ccTLDs have stricter privacy defaults or don't publish detailed WHOIS at all. Registrant privacy varies by country of registration.

Related tools

For the fuller picture of a domain's infrastructure — WHOIS registration data plus DNS records plus IP ownership for each server — use the Domain Infrastructure tool. It combines all three in one view.

For understanding what IP the domain's web and mail servers use, and who owns those IPs, use IP Lookup after resolving the domain to an IP. For DNS propagation across multiple public resolvers, the DNS Propagation Checker shows what different parts of the internet see.

Privacy

WHOIS queries are made from our Cloudflare Worker to the appropriate registry endpoint. The registries see the query but not the querier — no personal information about you is transmitted. Query results are shown only to you and not retained on the myipcat.com side beyond standard analytics.