Whois Lookup

WHOIS after GDPR

Before 2018, WHOIS returned the registrant's name, postal address, phone number and email for most domains. GDPR ended that for records covering people in scope, and registrars now redact personal fields across the board rather than trying to determine jurisdiction per record. What remains public is the registrar, the creation, update and expiry dates, the nameservers, the domain status codes, and usually an anonymised forwarding email. Expecting a name and address from a modern WHOIS query is expecting a pre-2018 answer.

The dates are the useful part

Creation date is a genuine signal. A domain registered three weeks ago that is sending you invoices deserves suspicion, since phishing and fraud infrastructure is overwhelmingly new. Registration length is weaker but real: legitimate businesses often register for several years, while throwaway domains take the minimum term. Expiry date matters operationally, because an expired domain stops resolving and, once it drops, can be registered by anyone.

Status codes tell you what can happen next

clientTransferProhibited is a registrar lock and is normal and desirable; it prevents unauthorised transfers. clientHold means the domain has been removed from the zone and will not resolve at all, usually for non-payment or an abuse complaint. pendingDelete means it is about to become available. redemptionPeriod means it expired and can still be recovered by the previous owner, usually for a substantial fee.

Thin versus thick registries

Some registries hold full records centrally, called thick. Others, notably .com and .net, hold only a pointer to the registrar, called thin, so a complete answer requires a second query to that registrar. A first query returning almost nothing is normal for a thin registry rather than evidence of unusual privacy measures.

RDAP is the successor

Registration Data Access Protocol returns structured JSON instead of WHOIS's inconsistent free text, supports internationalised data properly, and allows authenticated access to fields that are redacted for anonymous queries. ICANN has been migrating registries to it, and tooling should prefer RDAP where available.