What Is a WHOIS Lookup?
A WHOIS lookup is a search of a domain's registration record: it shows who registered the name, which company manages it, when it was created and when it lapses, and which nameservers answer for it. Buyers use it to check a name's history before paying, site owners use it to confirm renewals and locks, and investigators use it as a first step when tracing scam or phishing domains. This guide explains what a WHOIS record contains, why personal details are usually hidden today, and how to read each line with confidence. Try it yourself with our free domain search, and pair it with the networking side in our guide to how DNS works.
You will see annotated examples of real record fields, a plain-language tour of status codes, and the practical checks to run before buying, renewing, or reporting a domain. The focus stays on everyday uses: verifying a seller, avoiding an accidental lapse, and contacting the right party when something goes wrong. Along the way we note where privacy rules draw the line, so your expectations match what any public record can actually show in 2026.
What Is a WHOIS Lookup?
WHOIS is one of the oldest directory protocols on the internet. When someone registers a domain, the registrar stores details about that registration and makes defined parts available through WHOIS servers. A lookup tool sends the domain name to the right server and prints the record it holds. The system is split by ending: registries such as the .co.za administrator and the various .com operators each publish records for their own zones, while registrars add their view for names they manage.
A typical record answers six questions. Who manages the name: the registrar and its WHOIS server. What state it is in: status codes such as clientTransferProhibited. When it matters: creation, update, and expiry dates. Where it points: the delegated nameservers. How it is identified: registry and registrar IDs. And who to contact: abuse or technical contacts, with personal registrant details usually redacted. Each line has one job, and once you know the jobs, scanning a record takes under a minute.
It helps to separate WHOIS from nearby tools. Registration data says who holds the name and under what terms. DNS data, covered in our DNS explainer, says where the name points right now. A website's content says what the owner publishes. WHOIS answers the ownership and timing questions, DNS answers the routing question, and neither one reveals the site's files or private account data.
Why a WHOIS Lookup Matters
Before buying a domain from its current owner, WHOIS is basic due diligence. Creation date hints at history: a name held for ten years differs from one registered last week. Expiry date shows urgency: a name lapsing next month needs fast transfer handling. Status codes reveal locks that would block a move. Skipping these checks is how buyers pay for names the seller cannot cleanly transfer, so a two-minute lookup belongs before any money moves.
For owners, WHOIS is a renewal and security dashboard. The expiry date confirms auto-renew is working, the registrar field confirms where to log in, and the status codes confirm transfer locks are on. Small businesses lose domains every year through expired cards and forgotten inboxes, and recovery after a lapse can mean auctions or buy-backs at far higher prices. A yearly WHOIS review of each company domain costs nothing and prevents the most common loss.
For everyone else, WHOIS supports safer browsing. A suspicious shop link can be checked in seconds: a days-old registration with privacy shielding and odd nameservers deserves caution, while a years-old record with steady nameservers looks more ordinary. No single signal settles the matter, but WHOIS gives you facts where guesswork stood. Combined with careful password habits, such as those in our guide to creating strong passwords, it forms part of a calm everyday security routine.
How a WHOIS Lookup Works
The lookup path has three steps. First, the tool identifies which registry handles the domain's ending and queries it. Second, the registry reply points to the registrar's own WHOIS record for full detail. Third, the tool merges both views into the result you read. This is why records sometimes show two similar blocks: a thin registry section with core facts, and a fuller registrar section beneath it. When the two disagree on dates, the registrar's data is usually the fresher source for customer domains.
Reading the dates is the core skill. The creation date marks first registration, not current ownership, since names change hands without resetting it. The updated date marks the last change to the record, such as a lock toggle or contact update. The expiry date marks when the current paid period ends. Treat expiry as a deadline for action: confirm payment method, confirm the notification email still works, and confirm auto-renew state at least a month ahead.
Status codes then describe the locks. The common protective set includes clientTransferProhibited, which blocks transfers requested at the registrar, and clientUpdateProhibited or clientDeleteProhibited, which block changes and deletion. Registry-level variants starting with "server" are set higher up the chain. Codes containing "pending" signal a process under way, such as a transfer or deletion. The exact list comes from EPP standards used across registrars, so the same codes appear worldwide with steady meanings.
Privacy shapes what you can see. Since data-protection laws such as the EU GDPR and South Africa's POPIA took practical effect at registrars, personal names, emails, and phone numbers are redacted by default for most individual registrations. What remains public are the technical facts: registrar, dates, statuses, nameservers, and abuse contacts. Company registrations sometimes still publish organisation names. Where identity is hidden, registrars provide gated contact forms or disclosure request paths rather than raw addresses.
Examples
Consider a fictional buyer eyeing example-shop.co.za from a private seller. The lookup shows creation in 2019, expiry eight months away, status clientTransferProhibited, and steady nameservers at a known host. Reading it: history looks established, there is time for a clean transfer, and the lock must be lifted by the seller before the move. The buyer asks the seller to remove the lock, obtains the transfer authorisation code, and initiates the move at their own registrar. Each decision traces to one record line, which is the point of the exercise.
| Field | Example value | What it tells you |
|---|---|---|
| Domain name | example-shop.co.za | Exact name the record describes |
| Registrar | Example Registrar (Pty) Ltd | Company to contact for transfers |
| Creation date | 2019-04-12 | Age and history signal (about 7 years) |
| Updated date | 2026-02-03 | Last record change, e.g. lock toggled |
| Expiry date | 2027-06-12 | Renewal deadline, about 8 months out |
| Status | clientTransferProhibited | Transfer lock is on; seller must lift it |
| Name servers | ns1.host.example, ns2.host.example | Where DNS is managed right now |
| Registrant contact | Redacted for privacy | Personal details withheld by default |
A second example: a site owner checks their own domain and finds expiry 20 days away with auto-renew off and an old card on file. The arithmetic is unforgiving: 20 days minus festival-season distraction leaves little margin, and a lapsed .co.za or .com name can pass through grace into redemption or release. The fix takes ten minutes: update the card, enable auto-renew, confirm the notification email, and re-check the record. Compare that with the cost of rebuying a lapsed trading name, and the yearly review habit pays for itself many times over.
Common Mistakes
Expecting the owner's personal email in the record. For most registrations today it is redacted, which surprises people used to older guides. Use the registrar's contact form, the abuse contact, or the published organisation details instead of hunting for a private address that is no longer shown.
Reading creation date as a safety verdict. Age alone does not clear a domain: old names can be repurposed for scams, and new names can be fully legitimate. Combine age with nameserver stability, site content, and payment caution rather than deciding on one line.
Ignoring status codes before paying. Locks such as transfer prohibitions must be lifted by the current holder before a move. Confirm the code set, ask the seller to unlock, and only then start the transfer. Money first and checks later is the order that causes disputes.
Confusing expiry with deletion day. Expiry starts a process with grace and possible redemption stages that differ by ending. The name does not always drop instantly. Read your registrar's lapse policy in advance so a missed renewal becomes a routine fix rather than a crisis.
Using WHOIS as the only availability check. A missing record often means a name is free, but premium reserves, registry holds, and thin records can mislead. Confirm with a registrar checkout or a live domain search before printing business cards around an unchecked name.
Frequently Asked Questions
What is a WHOIS lookup?
A WHOIS lookup queries the registration record for a domain. It shows the registrar, status codes, key dates, and nameservers. Personal contact details are usually redacted, while these technical facts stay public.
Why is WHOIS data redacted?
Registrars withhold personal details to comply with privacy laws such as GDPR and POPIA and to cut spam and harassment. The domain's technical facts remain visible, and gated contact or disclosure paths replace raw addresses.
How can I tell if a domain is available?
A missing WHOIS record suggests availability, but confirm through a registrar or a live domain search, since reserves and holds can hide names. Only a successful registration attempt settles the question.
What do WHOIS status codes mean?
They describe locks and processes on the domain. Codes with "Prohibited" block transfers, updates, or deletion as protection, while codes with "Pending" show an action under way. The EPP standard keeps meanings steady worldwide.
How do I find when a domain expires?
Read the expiry or paid-up-until date in the record, then act at the registrar named there. Enable auto-renew, keep the payment method current, and re-check yearly so a lapse never surprises you.
Can I find the owner of any domain?
Not always. Privacy services and default redaction hide personal contacts for most names. Organisation details sometimes appear for companies, and trademark holders can use formal dispute processes where the rules allow.
Related Tools
- Domain Search, check name ideas and availability before you buy.
- Password Generator, secure registrar and hosting logins after your checks.
- Word Counter, draft clear transfer and dispute notes at the right length.
- Text Cleaner, tidy pasted records before quoting them in emails.
Browse the full tools collection and all guides, including how DNS works and creating strong passwords, for the full domain-safety picture.
Conclusion: a WHOIS lookup turns a domain from a bare name into a dated, managed record you can reason about. Read the registrar, the three dates, the status codes, and the nameservers; expect redacted contacts; and run the check before buying, renewing, or reporting. It takes minutes and prevents the costliest domain mistakes.