What a WHOIS record contains
A typical WHOIS record for a domain includes the registrar (the company through which the domain was registered), the registration date, the expiry date, the nameservers, and the registrant contact information. For many domains, the registrant details are now redacted by GDPR privacy rules or replaced with the registrar's privacy service contact.
The creation date tells you when the domain was first registered. The expiry date tells you when it needs to be renewed. An expired domain may be available to register or may be in a redemption period where the original owner can still reclaim it.
Nameserver records in WHOIS tell you which DNS servers are authoritative for the domain. This is separate from DNS records themselves — WHOIS shows you the nameservers, DNS lookup shows you what records those nameservers contain.
- Registrar: which company the domain is registered through
- Creation date: when the domain was first registered
- Expiry date: when registration expires
- Nameservers: DNS servers authoritative for the domain
- Registrant: owner contact info (often redacted for privacy)
- Status: current domain status (active, expired, pending delete, etc.)
Common reasons to check WHOIS
The most common reason is checking if a domain is available to register. If the WHOIS record shows an expiry date that has passed and no active registration, the domain may be available — though popular expired domains are often snapped up by registrar auctions.
Security researchers use WHOIS to investigate suspicious domains. Checking when a domain was created can indicate whether it's a recently registered phishing domain. Very new domains that are already sending email or mimicking known brands are a red flag.
Webmasters use WHOIS to find contact information for site owners when they need to reach out about linking, partnerships, or copyright issues.
Privacy protection and GDPR
Since GDPR took effect in 2018, WHOIS data for .com and many other TLDs has been substantially redacted. Registrant names, email addresses, and phone numbers are now commonly replaced with generic contact addresses or the registrar's privacy service.
This protects legitimate domain owners from spam and harassment, but it also makes investigating suspicious domains harder. ICANN maintains a process for authorized parties to request non-redacted WHOIS data for legitimate purposes.
Country-code TLDs (like .uk, .de, .fr) have their own WHOIS policies that vary by registry. Some are more transparent than others.