How Does WHOIS Work?
Updated 12 August 2026
A plain-English guide to WHOIS lookups — how domain and IP registration records work, what information they reveal, why most registrant details are now redacted, and how to run one yourself.
The basics
WHOIS (pronounced "who is") is a query-and-response protocol used to look up the registered owner of an internet resource — a domain name, an IP address block, or an Autonomous System Number (ASN). Every domain registrar and every regional internet registry runs a WHOIS server, and querying it returns a plain-text record of who registered that resource and when.
It predates the modern web by decades — the protocol dates back to 1982 (RFC 812) — and is still the standard way to check domain ownership, registration status, and expiry dates today.
How a WHOIS query actually works
WHOIS runs over TCP port 43 (RFC 3912). A client opens a connection to a WHOIS server, sends the domain or IP as a single line of text, and the server replies with a plain-text record before closing the connection — no HTML, no JSON, just a flat block of key–value pairs.
For domains, the lookup is usually two-step. First your client asks the relevant registry WHOIS server (e.g. Verisign for .com) which registrar the domain is with, then it queries that registrar's own WHOIS server for the actual registration details. Tools like DataToolkit's WHOIS lookup handle both hops automatically.
Why registrant details are usually hidden
Older WHOIS records used to show the registrant's full name, email, phone number, and postal address in plain text — a long-standing source of spam and harassment. Since GDPR took effect in 2018, ICANN's Temporary Specification requires registrars to redact personal data for registrants covered by EU/EEA privacy law, and most registrars now apply the same redaction globally by default rather than maintaining two different systems.
In practice this means a typical WHOIS lookup today shows the registrar, dates, nameservers, and domain status, with contact fields replaced by something like REDACTED FOR PRIVACY unless the registrant has explicitly opted to make their details public.
WHOIS for IP addresses and ASNs
WHOIS isn't only for domains. The five Regional Internet Registries — ARIN (North America), RIPE NCC (Europe), APNIC (Asia-Pacific), LACNIC (Latin America), and AFRINIC (Africa) — each run WHOIS servers covering the IP address blocks and Autonomous System Numbers they've allocated. Looking up an IP address's WHOIS record typically shows the organisation the block was assigned to, not an individual — useful for identifying which hosting provider or ISP an address belongs to.
Common uses
- Checking domain availability and expiry — see whether a domain is registered, and when it's due to expire or drop.
- Verifying ownership — confirm a domain belongs to the organisation you expect before trusting it.
- Investigating abuse or spam sources — identify the registrar or hosting provider responsible for a domain or IP so abuse can be reported to the right place.
- Due diligence before a purchase — check a domain's registration history and status before buying it on the secondary market.