zerobounce.ai
Domains and networks

WHOIS lookup

Query the live WHOIS chain for a domain: IANA for the registry, the registry for the record, and for thin registries such as .com the registrar. Registries without WHOIS, such as .uk, are read over RDAP. You get the registrar, age, expiry, locks and every raw record.

By using these tools you accept the Terms and the Privacy page.

A domain name. Email addresses and URLs work too; only the domain is used. Usually under 2 seconds.

How the WHOIS lookup works

The WHOIS lookup reads a domain’s registration record straight from the WHOIS servers and turns it into plain facts: registrar, creation and expiry dates, status locks, DNSSEC and name servers. Use it to confirm your own domains are locked and renewed on time, or to see how old a domain that just emailed you is.

What happens during a lookup

Each server in the chain gets its own query on TCP port 43, with an 8-second limit per server. The whole lookup, DNS included, has 24 seconds; whatever hasn’t answered by then is reported as “couldn’t check” and never cached. IANA’s referral for a top-level domain can be reused for up to six hours. An answer over 64 KB is cut there and marked, and when a server never closes the connection, what arrived is kept and marked partial.

Before connecting, every server name is resolved once, and it’s skipped if any of its addresses is reserved or internal; the connection goes to an address that was checked. That includes referrals read from a registry’s own text, which are only followed on port 43. Some registries need their own query syntax, and the lookup sends it: domain for .com, -T dn,ace for .de and /e for .jp.

If the registry has no record for the name you entered, such as shop.example.com, it’s asked for the name one level up, then for the likely registered domain. A retry that fails or is rate-limited is “couldn’t check”, never “unregistered”.

When IANA lists no WHOIS server for a top-level domain, the registry’s RDAP address comes from IANA’s RDAP directory and the record is fetched over HTTPS, with the same address checks. Only the registrant’s organization is shown in the summary, never a person’s name; redacted contacts are marked as redacted.

How the record is read

WHOIS has no single format. The parser reads ICANN-style Key: value lines, the indented sections of registries such as .uk, .eu and .nl, .jp’s bracketed fields and many date formats. Ambiguous slash dates are read day first (dd/mm/yyyy), as the registries that use them publish them. When the registrar answers too, the registry’s record wins for dates, status and name servers, and the registrar’s fills gaps such as the abuse contact.

Reading the verdict and notes

  • Problem: a status that suspends or deletes the domain is set, such as clientHold, serverHold, redemptionPeriod or pendingDelete, or the expiry date has passed.
  • Warning: expiry is 30 days away or less, or a status such as pendingTransfer needs attention.
  • No transfer lock: the record shows recognized status codes but neither clientTransferProhibited nor serverTransferProhibited, so a transfer can start with only the authorization code.
  • Record couldn’t be read: the registry answered in a format the parser doesn’t recognize. The raw text is still shown.
  • No public WHOIS: the registry lists no WHOIS server with IANA, so its data may only be available over RDAP.

When to use it, and what to check next

Check your own domains after a renewal or registrar move, and well before expiry. A domain only days old is worth a second look before you trust mail or a link from it. For the registry’s RDAP record and the services in a domain’s DNS, open the domain analyzer. If DNSSEC is signed, the DANE checker shows whether the domain’s mail servers pin their certificates with TLSA records.

Updated · Maintained by Liviu Tanase

Questions

Where does the data come from?

From the WHOIS protocol on TCP port 43, queried live from Cloudflare’s network. The lookup asks whois.iana.org which server answers for the top-level domain, asks that registry for the domain, and when the registry is thin (.com and .net) follows its referral to the registrar’s WHOIS server. Every raw answer is shown, so nothing is hidden behind the summary.

Why is the owner’s name missing?

Since GDPR, registries and registrars redact personal contact data, usually as “REDACTED FOR PRIVACY” or “Data Protected”. The page notes when contact data is redacted. What stays public is the registrar, the dates, the name servers, the status codes and DNSSEC.

What do the status codes mean?

They are EPP status flags. clientTransferProhibited is the registrar lock that stops unauthorised transfers, and the server versions are a registry lock. clientHold or serverHold take the domain out of DNS. redemptionPeriod means it was deleted but can still be restored, and pendingDelete means it is about to be released. Each code on the result is explained in plain words.

Which date is the real expiry date?

The registry’s. Registrars sometimes show a different date, for example while a domain sits in the auto-renew grace period after expiry. The page uses the registry date and shows the registrar’s when the two differ by more than a day.

It says the domain isn’t registered. Is it available?

Not necessarily. No record means the registry has nothing for that name, but reserved, premium and blocked names can still be unavailable. Confirm with a registrar before you rely on it. A rate-limit or refusal from the server is reported as “couldn’t check”, never as unregistered.

How does this compare with RDAP?

RDAP is the JSON successor to WHOIS, and since 2025 ICANN no longer requires gTLD registrars to run WHOIS, so some registrar referrals no longer answer. When IANA lists no WHOIS server for a registry (.uk, for example), this lookup reads the registry’s RDAP record instead and says so. The domain analyzer reads RDAP for every domain, so you can compare. Results here are cached for five minutes and “Check again” bypasses the cache. zerobounce.ai’s own logs don’t keep the domain; Cloudflare’s request logs do, as the privacy page explains.

Can I do a WHOIS lookup for an IP address?

Not on this page: it looks up domain names. For an IP address, the ASN lookup shows the network that holds it, its registry and country, and where to report abuse. The IP check shows your own address.