Whois Lookup — The Domain's Public File

About the Whois Lookup

Every registered domain has a public file. Who a domain belongs to in business terms — which registrar manages it, when it was registered, when it expires, which nameservers it answers on, whether it is locked against hijacking — all of it is published by the registry under the RDAP protocol, the structured successor to classic whois. This tool reads that file directly from the registry and presents it in rows a human can scan in seconds.

The classic whois experience is a wall of ALL-CAPS legal text that differs by registry and frightens normal people. RDAP is the same truth in clean JSON, which is why this tool can show you exactly six rows instead of forty lines — and why the answers here are authoritative rather than scraped: the record comes from the organisation that actually manages the extension, whether that is Verisign for .com or Public Interest Registry for .org.

What the record is for: verifying a seller actually manages the domain they are offering; finding out where your own domain lives before a transfer; checking which nameservers a site answers on before pointing DNS; and finding the abuse contact when a domain is sending spam or running a scam. Owner names and phone numbers are usually hidden behind privacy services — that is normal and by design — but the operational facts above are public and permanent.

How to Use the Whois Lookup

Follow these simple steps — the whole process takes under a minute:

1. Type the domain — example.com; protocol prefixes and paths are stripped automatically.
2. Press Look Up Record — the query routes through RDAP to the official registry for that extension.
3. Read the registrar row — the company currently managing the domain; transfers between registrars show up here.
4. Check the dates and locks — registration, last update and expiry, plus transfer-protection status.
5. Scan the nameservers — the DNS machines the domain answers on; familiar names like cloudflare or awsdns tell you where hosting and DNS actually live.

The Formula & Method Behind the Whois Lookup

The lookup sends one request to rdap.org, the IANA-backed bootstrap service. For example.com it forwards to Verisign's RDAP server; for wikipedia.org to Public Interest Registry's; and so on for hundreds of extensions. The registry returns a JSON object: entities for the registrar, events for the dates, nameservers for the DNS hosts and status codes for the locks. The tool walks that object and renders the rows you see — no scraping, no cached copies, no guesswork.

Registrar identity comes from the entity carrying the registrar role, read from its published vCard. Dates arrive as UTC timestamps — registration, last changed, expiration — and are shown in plain day-month-year form. Nameservers arrive as hostnames; there are usually two to four, and their brands are informative: ns.cloudflare.com means Cloudflare DNS, ns-awsdns prefixes mean AWS Route 53, go daddy hosts NS on their own network.

Status codes are the domain's security toggles, and the two that matter to owners are transfer locks: clientTransferProhibited or serverTransferProhibited mean the domain cannot be moved to another registrar without the owner's explicit approval — an anti-hijack feature you want enabled. Holds (clientHold, serverHold) mean the domain has been suspended and does not resolve; they appear on expired, disputed or registrar-frozen domains. The tool decodes the common codes and lists the rest as-is.

Reading the Record Like a Professional

Buying from a reseller? Verify the handle. The seller should either control the domain at the registrar shown or be willing to transfer it into your chosen registrar before full payment. Escrow the transfer: the record's registrar and expiry date tell you who must action the move and how much runway exists.

Transferring your own domain? The record answers the three questions every transfer needs: current registrar (to unlock and get the auth code), expiry (transfers inside the last days can be risky), and lock status (must be off before the transfer starts). Check all three here before starting the process at the new registrar.

Reporting a scam domain. A fake shop or phishing page has a registrar like everyone else, and registrars are legally obliged to handle abuse reports. The abuse contact row gives you the right inbox: send the URL, what the site is doing, and screenshots. Reports from multiple people get faster action — registrar-level takedowns are often quicker than courtrooms.

The privacy-wall reality. Owner names, emails and phones are typically replaced by privacy services — GDPR-era norms, not secrecy. The operational facts never hide: dates, registrar, nameservers and locks are what disputes, purchases and reports actually run on. For .pk domains, PKNIC publishes no RDAP records yet, so the tool says so honestly; use whois.net.pk for those.