Registrar, dates, status and nameservers, read from the registry itself.
WHOIS answers who registered a name, when it was registered, when it expires and which registrar holds it. It is the first check before buying a domain, the fastest way to find out why a site went dark, and the way to find the abuse address when something is attacking you.
This lookup uses RDAP, the structured replacement for WHOIS text that every registry now has to run, and it asks the registry that holds the name rather than a reseller's copy. Enter an IP address instead and it asks the regional internet registry who the address block belongs to.
A registration record has two halves. The operational half says which registrar holds the name, when it was created, when it expires, which nameservers the registry is publishing and what locks are on it. That half is public, because the internet needs it. The other half is the registrant's own contact details, and since data protection law caught up with WHOIS most registries withhold it for people and show only what a business consents to publish.
| Field | Usually published? | Why |
|---|---|---|
| Registrar | Yes | You need to know who to go to for a transfer, a renewal or a complaint. |
| Creation and expiry dates | Yes | They are facts about the registration, not about a person. |
| Status codes | Yes | They explain why a transfer or an update is being refused. |
| Nameservers | Yes | They are already public in DNS. |
| Registrant name and address | Only for some businesses and some registries | Personal data needs a legal basis to publish, and marketing is not one. |
| Registrant email | Rarely; often a forwarding address instead | The same rule, with a route kept open for legitimate contact. |
| Abuse contact | Yes, at the registrar | ICANN requires a working abuse address for reports. |
Status codes are the registry's own words for the state of a registration. The ones that start with client were set by the registrar, usually at the registrant's request; the ones that start with server were set by the registry, and are more serious.
| Code | Means | What to do |
|---|---|---|
| ok | No locks, nothing pending. | Consider adding transfer and update locks. |
| clientTransferProhibited | The registrar will not let the name be transferred away. | Nothing. Keep it on, and unlock only for a transfer you started. |
| clientHold | The registrar has asked the registry to stop publishing the name, so nothing resolves. | Usually non-payment or an unverified contact address. Check the registrar account. |
| serverHold | The registry itself is not publishing it. | A dispute or a legal order. Speak to the registrar. |
| pendingTransfer | A transfer to another registrar is in progress. | If you did not start it, contact the registrar at once. |
| autoRenewPeriod | Renewed automatically; the charge can still be reversed. | Nothing, unless you meant to let it go. |
| redemptionPeriod | Expired. Only the registrant can get it back, for a fee. | Act within the period or lose the name. |
| pendingDelete | On its way to being released for anyone to register. | Treat it as gone. |
| inactive | No nameservers are set at the registry. | Set them, or nothing under the domain will resolve. |
A domain does not stop working on a schedule anyone would guess. The website and the mail stop when the registrar parks the name, which is normally on the expiry date itself, long before the name is released. These periods are set by ICANN policy for the common top-level domains; country registries set their own, and some are shorter.
| Stage | Typical length | What works | Cost to recover |
|---|---|---|---|
| Registered | 1 to 10 years | Everything. | The renewal fee. |
| Expired, in the registrar's grace period | Up to about 45 days | Usually nothing. The registrar parks the name. | The renewal fee. |
| Redemption period | 30 days | Nothing. | A redemption fee, often many times the renewal. |
| Pending delete | 5 days | Nothing. | Cannot be recovered. |
| Released | - | Anyone can register it. | Whatever the next owner asks. |
This page uses RDAP, which answers in JSON over HTTPS. Your own machine can ask the same question. The first command is the old text protocol, the second is RDAP through a client, and the third is the raw request this page makes once it has looked the registry up in IANA's bootstrap file.
whois example.com
whois -h whois.verisign-grs.com example.com
curl -H 'Accept: application/rdap+json' https://rdap.verisign.com/com/v1/domain/example.comMost registries now withhold registrant names, addresses and emails, because publishing personal data without a legal basis is not allowed. Business registrant details are sometimes still shown, and the registrar and abuse contact always are.
It answers the same questions from the same registries. RDAP is the protocol that replaced the old WHOIS text format, which every registry wrote differently. Where a top-level domain has no RDAP service, the result says so rather than guessing.
After expiry most registrars hold the name for a grace period, then a redemption period with a large fee, then release it. Mail and the website stop as soon as the registrar parks it, which is usually on the expiry date, not at the end of the grace period.
You see the organization the address block is allocated to, its range and the abuse contact, which is what you need to report an attack. The customer using the address is not published.