WHOIS Domain Lookup

Pulls domain, registrar, registrant/admin/technical contact, DNSSEC status, domain age, expiry countdown and nameserver details for a domain via RDAP, grouped the way a full WHOIS record actually breaks down — plus a raw data view with the complete, unfiltered RDAP response underneath, for anything the structured view doesn't surface. Useful for verifying ownership before you buy a domain from someone, checking expiry ahead of a transfer, reporting abuse to the right address, or just working out who's actually behind a suspicious domain.

RDAP vs the old WHOIS protocol

RDAP (Registration Data Access Protocol) is the modern replacement for legacy text-based WHOIS — it returns structured JSON instead of loosely formatted plain text, handles internationalised domain names properly, and deals with privacy-protected registrations more consistently across registrars. This is what actually gets queried behind the scenes here; the old WHOIS protocol is increasingly a compatibility layer rather than the primary source of truth.

Why the registrant fields are often blank

Most gTLD registries have redacted registrant name, email and phone from public WHOIS/RDAP output by default since 2018 (driven by GDPR), replacing them with a privacy-proxy address or nothing at all. That's expected, not a failure of this tool — the registrar abuse contact shown here is a separate, deliberately non-redacted field required by ICANN's RDAP profile specifically so abuse reports have somewhere to go even when the registrant themselves is hidden. If you need to report phishing, malware distribution or spam from a domain, the registrar abuse email/phone is the address that actually gets acted on — not a redacted registrant contact.

Reading DNSSEC status

"Signed" means the domain's zone is cryptographically signed and its DS record is registered with the parent zone — a resolver that validates DNSSEC will reject forged responses for that domain. "Not signed" is still the default for most domains and isn't inherently suspicious; it just means that specific protection against DNS spoofing and cache poisoning isn't in place for this one.

Status codes, decoded

• clientTransferProhibited — locked against transfer until the registrant explicitly unlocks it. Normal, not a red flag on its own.
• serverHold — suspended at the registry level, not resolving. This one is a red flag — usually abuse action or a legal/compliance issue.
• pendingDelete — on its way out and about to be released back into the pool
• redemptionPeriod — expired but still renewable, at a significantly higher cost than a normal renewal
• clientDeleteProhibited — can't be deleted by the registrant without first removing this lock — a normal protective setting, not a problem

If you're checking a domain before buying it secondhand, or investigating one that showed up somewhere it shouldn't have, the registration date and registrar tell you a surprising amount at a glance — a domain registered days ago through a registrar known for abuse-friendly policies is a very different signal than one that's been held by the same registrant for a decade.