Know the moment your domain's WHOIS changes

Domain Monitor Hub watches your domain's registration record and alerts you the instant a registrar or nameserver changes, a risky EPP status appears, or a transfer lock quietly disappears — and watches the registry’s own Updated Date for everything else that touches the record.

Start monitoring — free
How it works

How WHOIS change monitoring works

Registrar & nameserver changes

If your domain's registrar or its nameservers change, you get an alert — the earliest signal that control of the domain may be moving.

Risky EPP status flags

Six statuses are surfaced the moment they appear: clientHold, serverHold, pendingTransfer, pendingDelete, redemptionPeriod and inactive.

Registrar lock lifted

The signal most tools miss. A transfer lock quietly disappearing is the classic first step of a domain hijack — you hear about it the moment it happens.

Manual re-check on demand

Suspect something changed? Run an instant WHOIS/RDAP re-check from the dashboard without waiting for the next scheduled pass.

Registry record changes

Every registry keeps a timestamp of when a domain’s record last changed — the Updated Date. It moves for everything we don’t name individually: a DNSSEC key swap, a contact edit, a renewal.

Why it matters

An unauthorized transfer starts quietly in WHOIS

Domain hijacks and mistaken transfers rarely announce themselves — the first trace is a changed registrar, a new nameserver, a fresh EPP status code, a transfer lock that quietly came off, or simply the registry's record being touched at all. Catching that early is the difference between a quick reversal and a lost domain.

WHOIS is one of four signals Domain Monitor Hub watches — it pairs naturally with DNS monitoring.

The registry’s own Updated Date

Every registry keeps a timestamp of when a domain’s record last changed. We read it on every check and tell you when it moves. Registrar changes, nameserver changes and status changes we already name individually — this catches everything else the registry recorded: a DNSSEC key swap, a contact edit, a renewal. Whoever gets into a registrar account doesn’t always start with the nameservers, and the quieter steps still leave this trace.

It costs nothing extra to watch. The value arrives in the same response as the expiry date, the registrar and the nameservers — last changed in RDAP, Updated Date in WHOIS — so there is no additional query to the registry. It’s compared against the stored value on every daily check, and on any manual re-check you run yourself. Times are shown in UTC, exactly as the registry publishes them.

What moves it

What lands in the registry record depends on the zone. For .com and .net the registry is “thin” — nameservers, statuses, registrar, dates and DNSSEC — and contact details live with the registrar, so editing them doesn’t move the date. For .org, .info and most country domains the registry is “thick” and holds the contacts too, so a contact edit does move it.

What it doesn’t tell you

  • It says the record changed, not what changed. Reading the detail is a trip to your registrar account — this is the prompt to make it.
  • Ordinary events move it too. A routine renewal shifts the date. That’s a fact, not an alarm.
  • Not every zone publishes it. Where the registry doesn’t provide it, the field stays empty and nothing is ever raised from it — a dash in the interface says so plainly.
  • The field is always shown; the alert needs monitoring on. You can read the date on any domain you’ve added, but a change only reaches you when WHOIS monitoring is switched on for that domain.

How it reaches you

There is no separate email for it, on purpose. The change joins the same WHOIS-changes notification that lists every difference found in one place — if the nameservers moved and the date shifted, that’s one message with both, not two. Old and new values are shown to the minute, and it goes to email plus whatever channels that domain’s notification group uses.

Questions, answered

WHOIS monitoring FAQ

A change of registrar or nameservers; any of six risky EPP statuses appearing — clientHold, serverHold, pendingTransfer, pendingDelete, redemptionPeriod and inactive; a registrar lock being lifted; and a move of the registry's own Updated Date, which catches everything else the registry records. Every difference found in one check arrives together, in a single notification.

On the next scheduled check: daily for most zones, and every three days for zones whose registry strictly limits lookups — such as .info — daily again in the last 30 days before the domain expires. If you suspect something has changed, run a manual re-check from the dashboard and the record is read straight away.

The transfer lock (clientTransferProhibited) stops a domain from being moved to another registrar. Removing it is the usual first step of a hijack — and of a legitimate transfer too — so when it comes off and you haven't planned a move, that is the moment to check your registrar account, before a transfer can go through.

Yes. WHOIS change alerts are switched on per domain, so you choose which domains are watched this way. The registry's Updated Date is shown for every domain you've added either way — only the alert depends on the switch.

Watch who controls your domains

Add your domains and get an alert the instant their registration record changes — around the clock.

Create your free account
Free forever for 3 domains · No credit card · Sign in with Google