Start Using WHOIS Lookup Today — Free Guide

Updated 2026-03-27 · By SPUNK13 · Back to spunk.bet

A WHOIS lookup takes one command and costs nothing. What takes explaining is why the answer looks half-empty and which fields you can still rely on. Here is the practical version.

Run your first lookup

macOS and most Linux distributions ship a whois client: whois example.com. On Windows, use Sysinternals' whois.exe or run the same command in WSL. The default client queries the registry, then usually follows a referral to the registrar's own server. To skip straight to the authoritative registry record for .com and .net: whois -h whois.verisign-grs.com example.com.

Why most of it says REDACTED

Since 2018, registrars have withheld registrant name, email, postal address and phone from public WHOIS for most generic domains to comply with privacy law. This is not a paywall and no free tool gets around it. What remains public is genuinely useful: registrar name, creation date, updated date, expiry date, nameservers, DNSSEC status, EPP status codes and an abuse contact address.

The status codes are the interesting part

• clientTransferProhibited — the domain is locked at the registrar. Normal and healthy. Its sudden absence means someone is preparing a transfer.
• clientHold — the registrar has pulled the domain from DNS, usually for non-payment or an abuse complaint. The site is offline regardless of your hosting.
• pendingDelete and redemptionPeriod — the registration lapsed. During redemption the original owner can still recover it, typically for a fee; after pendingDelete it goes to the drop.
• serverTransferProhibited — imposed by the registry rather than the registrar, often the sign of a dispute.

Use RDAP when you want structured data

RDAP is the modern, JSON-based replacement and it is just as free: curl -s https://rdap.org/domain/example.com. rdap.org bootstraps to the correct registry for you. Dates live in the events array under registration, expiration and last changed; nameservers and statuses are proper arrays instead of free text. If you plan to script anything, start here rather than parsing WHOIS output — every registrar formats WHOIS differently, and RDAP formats it once.

ccTLDs play by their own rules

.de returns almost nothing beyond the nameservers. .uk uses Nominet's own format and its own server. Several country registries have no RDAP endpoint at all, and some require you to use a web form with a CAPTCHA rather than a command-line client. When a lookup returns nothing useful, check the registry's own WHOIS host before assuming the domain does not exist.

Rate limits and etiquette

Registries throttle by IP, and the limits are lower than people expect — a loop over a few hundred domains without a delay will get you temporarily blocked. Sleep a second between queries, cache answers for at least 12 hours, and set a descriptive User-Agent on RDAP requests. If you need bulk data, that is what registrar APIs and paid data feeds exist for.

What to do with the answer

The two highest-value uses are both scheduled rather than one-off: watch your own portfolio's expiry dates so nothing lapses, and watch status and nameserver changes on domains you care about. Both are a daily cron job away — see the weekend WHOIS project guide for the script.