WHOIS Lookup
A WHOIS lookup returns the registration record for a domain name: the registrar that manages it, the dates it was created, last updated and expires, the nameservers it is delegated to, and the EPP status codes showing whether it is locked, on hold or pending deletion. Since GDPR, most registrars redact the registrant's personal contact details.
How do I run a WHOIS lookup from the command line?
What is a WHOIS lookup?
A WHOIS lookup queries the public registration record a registry holds for a domain name. That record is created when the domain is registered and updated whenever it is renewed, transferred or locked, so it is the authoritative statement of who manages the name, when it expires, and where it is delegated, independent of anything the domain's own DNS or website says.
DNSX queries the registry live for every lookup, returns the full record rather than a summary, and requires no account, no captcha and no rate-limit paywall. The same data is available as JSON from curl https://dnsx.dev/whois/example.com.
Who owns a domain, and why is the owner usually hidden?
WHOIS and RDAP return the registrant on record, but for most domains that field no longer names a person. Following GDPR, ICANN's Temporary Specification of 2018 and the Registration Data Policy that replaced it require registrars to redact personal contact details from public output, so a lookup typically shows the registrar, the registrant's country and state, and an anonymised forwarding address rather than a name and email.
What remains fully visible is everything technical: the registrar, the creation, updated and expiry dates, the nameservers, the EPP status codes, the DNSSEC state, and organisational registrant details where the registrant is a company rather than an individual. Many registrars also sell a privacy service that substitutes a proxy contact even where redaction would not otherwise apply.
When does a domain expire, and what happens next?
The expiry date is carried in the registration record. Passing it does not release the name. For most gTLDs the domain enters an auto-renew grace period of roughly 30 to 45 days during which the registrant can still renew at the normal price, though the registrar will usually have stopped resolving it.
After that comes a 30-day redemption period, during which only the original registrant can restore the name and the registry charges a redemption fee well above the renewal price. Then a five-day pending-delete window, in which nothing can be done at all, before the name drops and becomes available for anyone to register. The status codes autoRenewPeriod, redemptionPeriod and pendingDelete identify which stage a domain is in.
What do the EPP status codes mean?
EPP status codes describe the current state of a domain at the registry. Codes prefixed client are set by the registrar; codes prefixed server are set by the registry and the registrar cannot remove them. A domain normally carries several at once.
| Status code | What it means |
|---|---|
| ok | The default state. No pending operations and no locks. Because no transfer lock is set, arguably less protected than a domain showing clientTransferProhibited. |
| clientTransferProhibited | A registrar-set lock blocking transfer to another registrar. Normal and desirable; the registrant removes it from the registrar control panel before a legitimate transfer. |
| clientDeleteProhibited | A registrar-set lock blocking deletion of the domain, protecting against accidental or unauthorised removal. |
| clientUpdateProhibited | A registrar-set lock blocking changes to the registration record, including nameserver and contact changes. |
| clientHold | The registrar has asked the registry to remove the domain from the zone. The domain stops resolving entirely while this is set. The usual causes are non-payment or an abuse complaint. |
| serverTransferProhibited | A registry-set transfer lock. Applied automatically for 60 days after a registration or a change of registrant, and cannot be lifted by the registrar. |
| autoRenewPeriod | The domain passed its expiry date and is in the grace window, typically 30 to 45 days, in which it can still be renewed at the normal price. |
| redemptionPeriod | The domain was deleted after expiry. For 30 days only the original registrant can restore it, and the registry charges a redemption fee. |
| pendingDelete | Redemption has ended. After a five-day window the name is purged from the registry and becomes available for registration by anyone. |
| inactive | No nameservers are delegated at the registry, so the domain cannot resolve regardless of any DNS configured elsewhere. |
What is RDAP, and has it replaced WHOIS?
RDAP, the Registration Data Access Protocol, is the structured JSON successor to WHOIS, standardised in RFC 7480 through RFC 7484. It carries the same registration data over HTTPS with defined field names, consistent date formats, internationalisation support and standardised access controls, so it can be parsed reliably instead of scraped.
RDAP has replaced WHOIS as the authoritative interface at all five Regional Internet Registries and at gTLD registries under ICANN's RDAP requirement. Legacy WHOIS output is still served by many registries for compatibility, but it is free-form text with no guaranteed schema and is being retired.
What do the WHOIS fields and status codes mean?
RDAP Transition
RDAP (Registration Data Access Protocol) is replacing legacy WHOIS with structured JSON responses, HTTPS transport, and standardized access controls mandated by ICANN for all registries.
Domain Lifecycle
Domains progress through stages: registration, active use, expiration, grace period (30-45 days), redemption period (30 days at premium cost), and pending delete before becoming available again.
Transfer Locks
The clientTransferProhibited status prevents unauthorized domain transfers. Most registrars enable this by default. It must be removed before initiating a legitimate transfer to a new registrar.
WHOIS Privacy
Privacy protection replaces personal registrant details with proxy information. Since GDPR, most registrars automatically redact personal data for European registrants from public WHOIS results.
Nameserver Delegation
WHOIS data includes the authoritative nameservers for a domain. These NS records in the registry determine which DNS servers control the domain's zone and handle all DNS queries for it.
EPP Status Codes
EPP (Extensible Provisioning Protocol) codes describe domain states. Client-level codes are set by registrars, server-level codes by registries. Multiple codes can be active simultaneously on a single domain.