If you ran a WHOIS lookup ten years ago you got a name, an email and a phone number. Run one today and you get a registrar, some dates, and the word REDACTED. Two things changed: privacy law, and the protocol itself.
What happened to WHOIS
WHOIS is a 1982 protocol. It returns unstructured text over port 43, in a format each registry invented independently. Parsing it reliably across TLDs was always miserable.
Two forces killed it:
GDPR, in 2018. Registrant contact data is personal data. ICANN's response was the Temporary Specification, which redacts registrant name, email, address and phone for most domains. Registrars now publish an anonymised relay address instead.
RDAP, ratified 2015. The Registration Data Access Protocol returns structured JSON over HTTPS, supports internationalised data, and has real authentication so authorised parties (law enforcement, trademark holders) can request the redacted fields through a defined process. ICANN required gTLD registries to run RDAP from 2019 and has been sunsetting port-43 WHOIS since.
The practical upshot: any tool still parsing WHOIS text is reading a legacy interface that is increasingly incomplete. RDAP is the current source of truth.
Free toolWHOIS LookupLook up any domain's registrar, registration date, expiry, status codes and nameservers using live RDAP registry data.What you can still see
Redaction covers the registrant. Everything about the registration itself stays public:
- Registrar - the company the domain was bought through.
- Registration date - when it was first created. Not redacted, and the basis for any domain age claim.
- Expiry date - when it lapses if not renewed.
- Last changed - the last modification to the registration record.
- Status codes - the locks and states applied to the domain.
- Nameservers - which DNS servers are authoritative, which tells you the hosting and DNS provider.
That is enough for almost every legitimate use: checking whether a domain is available, judging how established a site is, seeing whether a domain is about to expire, or working out who hosts a competitor.
Reading status codes
The codes look alarming and mostly are not. They come in two families.
Client codes are set by the registrar, usually at the owner's request:
| Code | Meaning |
|---|---|
clientTransferProhibited | Transfer lock. Normal and desirable - it is what stops a domain being stolen. |
clientUpdateProhibited | Registration data cannot be changed. Extra protection on valuable domains. |
clientDeleteProhibited | Cannot be deleted. |
clientHold | The domain is deactivated and will not resolve. Usually non-payment or a dispute. |
Server codes are set by the registry itself and are more serious:
| Code | Meaning |
|---|---|
serverTransferProhibited | Registry-level lock, often during a dispute. |
serverHold | Deactivated by the registry. Frequently a legal action. |
pendingDelete | Deletion in progress; the domain is days from being released. |
redemptionPeriod | Expired, deletable, still recoverable by the owner for a fee (usually 30 days). |
ok (sometimes active) means no locks at all - which is not a good thing. A domain with ok and no transfer lock is the easiest kind to hijack.
Checking a domain before you buy it
If you are buying a domain, particularly an expired one, read the record before you pay:
- Registration date. A domain registered in 1999 with continuous renewals is different from one registered in 1999, dropped in 2019, and re-registered last month. If
registeredis recent but the domain is old-looking, it dropped and reset. - Status.
pendingDeleteorredemptionPeriodmeans it is not actually for sale yet. - Nameservers. Parked nameservers (
sedoparking.com,bodis.com) mean it is monetised parking, which often correlates with a spam history. - The archive. RDAP does not tell you what the domain was used for. Check the Wayback Machine - a domain that hosted a pharmacy spam site for five years carries that history into your project.
A dropped and re-registered domain loses essentially all of its accumulated SEO value once the topic changes. Do not pay a premium for "aged" domains on the assumption that age transfers. It does not.
Limits worth knowing
Not every ccTLD publishes RDAP. Most do, but some national registries - particularly smaller ones - still only offer WHOIS, and a few offer neither publicly. A lookup returning no record does not always mean the domain is unregistered.
Registration dates can be wrong for transferred domains. Some registries reset the creation date on transfer between registrars. It is rare, but it explains occasional implausible values.
Rate limits are real. Registry RDAP endpoints throttle aggressively. Any tool doing bulk lookups is either caching or getting blocked.
Privacy services obscure the registrar picture. A domain behind a privacy service shows the privacy provider, not necessarily the underlying registrar.
Launch it where the numbers are checked
RankCert ranks products on domain control we verify ourselves. Listing is free and the link stays dofollow whether or not you display the badge.