What is a WHOIS lookup?
A WHOIS lookup asks the registry responsible for a domain to return its public registration record. That record tells you who sponsors the domain (the registrar), when it was first registered, when it was last changed, when it is due to expire, which name servers it uses, and what status codes are currently set on it. It's the fastest way to answer basic but important questions: is this domain active, who runs it, and when does it lapse?
WHOIS vs RDAP — what's the difference?
WHOIS is the original protocol. It returns free-form text that looks slightly different at every registrar, which makes it awkward to read and parse. RDAP (Registration Data Access Protocol) is its modern replacement: it returns structured JSON with standard field names and a defined set of status codes, and it supports secure, standardized access. Where a registry publishes RDAP, this tool prefers it; where it doesn't, it falls back to WHOIS so you still get an answer.
What's inside a registration record
- Registrar — the company the domain is registered through.
- Creation, updated and expiry dates — the domain's lifecycle in three dates.
- Name servers — where the domain's DNS is hosted.
- Status codes — EPP flags that control transfers, renewals and deletion.
- Registrant details — usually redacted for privacy on public records.
How to read domain status codes
Status codes are the part people most often miss. clientTransferProhibited is normal and healthy — it stops unauthorized transfers. clientHold means the registrar has removed the domain from DNS, so it won't resolve. pendingTransfer signals a transfer in progress, and pendingDelete / redemptionPeriod mean the domain has lapsed and is heading toward deletion. A sudden change in these codes is often the first sign that something is wrong.
Why registrant details are often hidden
Since GDPR and similar privacy rules, registries redact personal contact information from public records. That's expected — the operationally useful fields (registrar, dates, name servers, status) are still visible, and those are what you need to spot a transfer, a lapse or a hijack.
From a one-off check to continuous monitoring
A lookup is a snapshot in time. The real risk is a change you don't see: a domain quietly transferred, name servers swapped, or a status flipping to clientHold. WHOIS change monitoring in Domain Monitor Hub re-checks your domains for you and alerts you the moment the record changes — by email, webhook, Discord or Slack. Check a domain here once; let the app watch it around the clock.