WHOIS Lookup
Check who registered a domain, when it expires, and which nameservers are authoritative. Useful for due diligence before acquiring a domain, investigating a suspicious sender, or confirming your own portfolio is locked and not expiring next week.
Why WHOIS Data Matters for Domain Management and Security
WHOIS data is the first place to look when investigating a domain — whether you're verifying ownership, researching a competitor, investigating phishing, or managing your own domain portfolio.
What you can learn from WHOIS data:
- Registration history: How long the domain has been active. Older domains generally rank better in search engines and appear more trustworthy to users.
- Expiry date: Critical for domain owners to track. An accidentally expired domain goes offline immediately and can be snatched by competitors or domain squatters.
- Registrar information: Useful if you need to transfer a domain, contact support, or verify the legitimacy of a domain.
- Nameservers: Shows which DNS provider is being used. Unexpected nameserver changes can indicate an account compromise or unauthorized transfer.
- Status codes: Tell you exactly what operations are locked or pending. Multiple "prohibited" statuses usually mean the domain is properly locked against theft.
Reading EPP status codes
The status field is the most misunderstood part of a WHOIS response. The important ones:
clientTransferProhibited— the registrar will refuse transfer requests. You want this on production domains.clientUpdateProhibited/clientDeleteProhibited— equivalent locks against changes and deletion. Together they form the standard "registrar lock" against hijacking.serverHold— the registry has removed the domain from the DNS root. Usually the result of expiry, abuse complaints, or a UDRP action. Site will be offline until this clears.pendingDelete— domain is on the way out. After ~5 days it is released back for registration.redemptionPeriod— domain expired; the owner still has a short (and expensive) window to recover it.okon its own — no locks. Acceptable for a throwaway domain, risky for a production one.
Common issues and fixes
Registrant info is redacted and you need to reach the owner
Since GDPR, most personal data is hidden. Use the registrar's abuse/privacy contact form (visible in the response) or send email to the standard abuse@<registrar> address for legal/abuse matters.
Expiry date shown here does not match your registrar dashboard
WHOIS data is cached by registries for up to 24 hours. If you just renewed, wait and re-check. If a week passes and the two still disagree, escalate with the registrar — a failed renewal payment often leaves the dashboard showing success while the registry never received the update.
Nameservers changed without your knowledge
Treat this as a potential compromise. Log into the registrar, enable 2FA, enable registrar lock, review recent account activity, and rotate credentials on the DNS host as well.
What to do next
A WHOIS lookup is a snapshot of a single moment. The fields that matter most — expiry, nameservers, registrar lock — change silently. Worth doing now:
- Confirm
clientTransferProhibitedis set on every domain that earns revenue. - Turn on auto-renewal and, separately, set external expiry monitoring on FlashMon.app so a failed credit card charge does not become a lost domain.
- Store the registrar, auth code, and expiry in a shared vault — not just in one person's inbox.
Never let your domain expire
FlashMon monitors your domain expiry continuously and sends alerts at 90, 30, and 7 days before expiry.
Frequently Asked Questions
WHOIS is a query/response protocol used to look up registration information for domain names, IP addresses, and autonomous systems. When a domain is registered, the registrant's information — including the registrar, registration and expiry dates, and nameservers — is stored in a public database maintained by ICANN-accredited registries. WHOIS allows anyone to query this database to see who registered a domain, when it was created and expires, and which DNS servers it uses. This transparency was designed to ensure accountability and enable abuse reporting. Since GDPR came into effect in 2018, personal data (names, emails, addresses) is often redacted for individuals registering European domains.
You can look up domain registration data using our WHOIS tool above. However, since GDPR and similar privacy regulations, most registrars now mask personal information like names, email addresses, and phone numbers with generic privacy-service data. What you can reliably find: the registrar (the company that sold the domain), registration and expiry dates, nameservers, and domain status codes. For domains where the registrant has not opted for privacy protection, you may see the registrant's name and organization. Many country-code TLDs (like .uk, .de, .fr) have their own WHOIS policies and may expose or hide different data.
When a domain reaches its expiry date, it typically enters a grace period (15–30 days depending on the registrar) during which the owner can still renew it at the regular price. After this, it enters a redemption period (usually 30 days) where renewal is possible but with a significant premium fee (often $50–200+). After redemption, the domain enters a pending delete phase (5 days) before being released back to the public for anyone to register. During expiry and redemption periods, the domain may stop resolving — meaning your website and email go offline. FlashMon monitors domain expiry and sends alerts at 90, 30, and 7 days before expiry so you never miss a renewal.
DNSSEC (Domain Name System Security Extensions) adds a layer of cryptographic signatures to DNS records, allowing resolvers to verify that the DNS data they receive is authentic and hasn't been tampered with. Without DNSSEC, attackers can use DNS cache poisoning to redirect traffic from your domain to malicious servers — even if your site is properly secured with HTTPS. DNSSEC doesn't encrypt DNS queries (that's DoH/DoT), but it verifies integrity. You should enable it if: your domain is used for banking, healthcare, or any sensitive application; you want to maximize user trust; or your registrar/DNS provider offers it at no extra cost. Cloudflare, AWS Route 53, and most enterprise DNS providers support DNSSEC.
Domain renewal is done through your registrar — the company where you originally registered the domain (shown in the WHOIS Registrar field). Log into your registrar's control panel and look for a renewal or auto-renew option. Most registrars offer 1-year, 2-year, 5-year, and 10-year renewal terms. Best practices: enable auto-renewal so you never accidentally miss a deadline; keep your payment method and contact email up to date (a bounced renewal email is a common cause of accidental expiry); set up external expiry monitoring like FlashMon as an independent safety net separate from registrar emails, which can end up in spam. Note: you don't need to renew through your original registrar — you can transfer to a different registrar and renew there.
Mostly yes, with two caveats. First, the creation date reflects when the current registration began — if the domain was previously registered, dropped, and re-registered, WHOIS resets to the most recent registration even though search engines may remember the older history. Second, some ccTLDs (especially .uk, .de) do not expose a creation date. For SEO trust signals, combine WHOIS creation date with archive.org first-seen date and backlink history — any one source on its own can mislead.
Since GDPR (General Data Protection Regulation) came into force in May 2018, most domain registrars are required to redact personal data from public WHOIS records when the registrant is an individual in the European Economic Area. This means names, email addresses, phone numbers, and physical addresses are replaced with generic placeholder text like 'REDACTED FOR PRIVACY' or 'Contact Privacy Inc.' You can still see the registrar, dates, nameservers, and status codes. If you need to contact a domain owner, use the registrar's privacy contact form (often linked in the WHOIS data), or for abuse/legal matters, contact the registrar directly through their abuse contact email (also shown in WHOIS data). Businesses that register domains as organizations often have their company name visible.