What WHOIS Shows

How a WHOIS Query Works

When you enter a domain into a WHOIS lookup tool, the query travels to the registry responsible for that domain's top-level extension. The registry returns a record containing the registrant contact, administrative contact, technical contact, registrar of record, creation date, expiry date, and nameserver entries. This data exists because ICANN requires registrars to collect and store it as part of the domain registration agreement.

Results sometimes look different depending on which tool you use. That is because WHOIS data passes through a chain: the registry holds the authoritative record, and registrars maintain their own copies. Thick registries like the one for .com store all contact data centrally. Thin registries store only the registrar reference and require a second query for full details. Modern lookup tools handle this automatically, but it explains why you occasionally see incomplete or mismatched results from different sources.

WHOIS vs RDAP: What Changed

RDAP (Registration Data Access Protocol) is the official successor to legacy WHOIS. ICANN now requires registrars to support RDAP, and it is gradually becoming the primary lookup method. The practical differences are structural: RDAP returns data in standardised JSON instead of unstructured text, uses HTTPS for secure queries, and integrates access controls so registrars can comply with privacy regulations without disabling lookups entirely.

For most users the transition is invisible. The tool on this page queries both protocols and returns a clean summary regardless of which responds. The practical effect of RDAP is better consistency — results from different registrars now follow the same format, meaning fewer blank fields and fewer misread records.

One detail worth knowing: RDAP responses include a direct link to the registrar's full record, which sometimes contains data not shown in the summary, such as DNSSEC status or update history.

If a WHOIS lookup returns proxy contact details instead of a person's name, the domain has privacy protection enabled. That is normal and does not indicate anything suspicious about the domain.