WHOIS Lookup Guide: Find Who Owns a Domain

A WHOIS lookup is the standard way people try to find out who owns a domain, whether it is available, when it was registered, when it expires, and which company manages it. In plain terms, you enter a domain name and review the registration record. That record may still reveal useful operational details even if the owner's personal information is hidden.

Today, the phrase "whois lookup" is still widely used, but the data source has changed for many domains. For gTLDs, RDAP became the definitive source for registration data on 28 January 2025. So if you want the most accurate answer for a .com, .net, .org, or other gTLD, you should expect modern lookup tools to rely on RDAP-backed results, even if the page still calls itself a WHOIS lookup.

What is a WHOIS lookup and what does it show?

A WHOIS lookup is a search for the registration record of a domain name. Most people use it to answer a practical question: who owns this domain, is it free to register, when does it expire, and which registrar controls it. It is less a single field than a bundle of clues about the domain's status and management.

In a typical lookup result, you will usually see core registration data such as:

• the registrar
• the creation date
• the last updated date
• the expiry date
• the name servers
• registry status codes

Those details matter for different reasons. A buyer may want to know whether the domain is old, recently moved, or close to expiry. A site operator may want to confirm which registrar account should hold the name. A researcher may be checking whether several domains share the same DNS setup or management pattern.

What many users most want, however, is the registrant's identity. In many cases, that personal information is no longer visible. Since privacy rules and redaction became standard, lookup results often hide the registrant's name, email address, phone number, and postal details.

So a WHOIS lookup is still useful, but it now works more like an intelligence check than a phone book entry. The value is often in the surrounding registration and DNS data.

WHOIS lookup vs RDAP: what changed for gTLDs

The biggest recent change is that RDAP became the definitive source for gTLD registration data on 28 January 2025. On that date, WHOIS port 43 obligations ended for gTLD registries and registrars. In practical terms, this means the old WHOIS protocol stopped being the required reference point for gTLD registration records.

Many people still search for a "whois lookup" because the term is familiar and widely understood. That is fine as shorthand. But for accuracy, it helps to know that a modern lookup tool for gTLDs should now be drawing from RDAP data rather than relying on legacy WHOIS output.

This matters because users often assume WHOIS is one thing. It is not, at least not anymore. There is the everyday label people use, and there is the underlying source of truth for domain data. For gTLDs, that source is now RDAP.

If you are looking up a gTLD domain, the practical takeaway is simple:

• keep using the phrase WHOIS lookup if you like
• expect trustworthy tools to be RDAP-backed
• treat older WHOIS-only tools with caution for current gTLD data

For buyers, operators, and investigators, the change is mostly about reliability. You still want the same answers about registrar, dates, status, and DNS. You just want them from the right source.

How to do a WHOIS lookup step by step

A good WHOIS lookup is not just a quick glance at one line. It is a short review process that helps you understand the domain's ownership path, management state, and likely next steps. Whether you are a buyer, site operator, or researcher, use a consistent workflow.

Start by entering the exact domain name into a reputable lookup tool. For gTLDs, the best results should be RDAP-backed, even if the service still labels the search as a WHOIS lookup.

Then review the record in this order:

• confirm the registrar
• note the creation date, update date, and expiry date
• check the status codes
• inspect the name servers
• look for redactions in contact fields

The registrar tells you who manages the domain at account level. The dates help you judge age, stability, and timing. A domain usually cannot be transferred to another registrar for 60 days after registration or a registrar transfer, so recent activity can matter if you are planning a purchase or move.

Status codes deserve careful attention. They may indicate whether the domain is locked, on hold, or in another restricted state. Name servers can show whether the domain is actively used, parked, or tied to a particular provider.

If the result seems incomplete or inconsistent, compare it across more than one source. That can help separate a redaction issue from a data display issue.

How to find who owns a domain when the WHOIS record is private

This is the question behind most whois lookup searches: how do you find who owns a domain when the record does not show a name or email address. The short answer is that direct identification is often no longer available in the public record, especially after GDPR took effect on 25 May 2018 and most registrant personal data in WHOIS became redacted.

A private result may mean the data is redacted for privacy reasons, or that a privacy or proxy service is being used. In both cases, public lookup data may not reveal the actual individual or business behind the domain.

That does not mean the search is over. Practical routes include:

• checking the website's contact page, terms page, or press details
• using any registrar-provided contact form or relay channel
• reviewing historical domain records where lawfully available
• checking whether the domain resolves to an active site, parking page, or sales lander

Historical records can sometimes show older administrative patterns, though not always a current owner. A live website may provide enough commercial identity to open a conversation even if the registration record is masked.

If you want to reach the owner, keep your outreach simple and credible. Use the website's visible contact points, a sales enquiry form, or a registrar relay if one exists. A lookup may not disclose the owner directly, but it can still show the best route in.

What a domain WHOIS lookup can still tell you after GDPR

Even with personal details redacted, a whois lookup can still be extremely useful. The value now lies less in the identity fields and more in the operational record around the domain. For many commercial and technical questions, that is enough to make an informed judgement.

The most useful fields often include the creation date, last updated date, expiry date, registrar, registry status, and name servers. Together, these can tell you whether the domain is established, recently changed, due for renewal, or held under restrictions that may affect a sale or transfer.

Expiry timing is especially important. After expiry, many gTLD names pass through an auto-renew grace period of up to 45 days, then a 30-day redemption period, then 5 days of pending delete. That sequence helps buyers and operators understand where a lapsed name may sit in its lifecycle.

A lookup can also reveal practical DNS clues. For example, the name servers may suggest whether the domain points to a live website, a parking provider, a holding page, or an enterprise DNS setup. That can help you judge whether the domain is in active use or simply being held.

So while GDPR reduced public identity data, it did not remove the lookup's practical value. It remains a useful tool for due diligence, outreach planning, transfer timing, and basic domain intelligence.

WHOIS lookup fields explained: registrar, statuses, dates and name servers

A whois lookup is most useful when you know which fields matter and what each one can and cannot tell you. For gTLDs, registration data is now commonly accessed through RDAP, which became the definitive source on 28 January 2025 when WHOIS port 43 obligations for gTLD registries and registrars ended. Many tools still label the output as a whois lookup, even when the data source is RDAP.

Start with the registrar. This tells you which company sponsors the domain at registrar level. For acquisitions, it helps you understand transfer logistics and where the current holder may manage the name. For due diligence, it can also explain why one lookup tool shows slightly different formatting from another.

The main date fields are equally important:

• Creation date: often useful for age, brand history and risk review.
• Updated date: may reflect account, DNS or contact changes, not necessarily a sale.
• Expiry date: relevant for renewal timing, not proof that the name will drop.

Status codes deserve a practical reading, not a forensic one. At a high level, they show whether a domain is locked, on hold, pending deletion, or subject to another control state. A lock status often means the name cannot be transferred until the lock is removed. A pending delete status is far more significant if you are watching for a drop.

Name servers show where the domain points for DNS. They can reveal active use, parking, hosting changes or preparations for migration. In acquisition work, they are a useful clue, but only one clue.

Can you see when a domain might become available?

A whois lookup can help you estimate when a domain might become available, but it rarely gives a simple yes or no answer. The most common mistake is treating the expiry date as the day the name becomes free to register. That is not how most gTLDs work.

Expiry means the current registration term has ended unless renewed. It does not usually mean immediate deletion from the registry. After expiry, many gTLD names move through a sequence before they can be re-registered by the public. A common lifecycle is:

• Auto-renew grace period: up to 45 days
• Redemption period: 30 days
• Pending delete: 5 days

Only after those stages does the name typically become available again, assuming it is not renewed, restored or otherwise retained.

This matters because many expired names never drop at all. The current registrant may renew late. The registrar may hold the name during grace periods. There may also be backorder activity or internal registrar processes that affect what happens next.

If your whois lookup shows an expiry date in the past, read it as an early signal, not a release date. The more telling indicators are status changes such as redemption or pending delete. Even then, timing can vary by extension and provider practice.

For serious acquisition planning, monitor the status, dates and DNS behaviour together rather than relying on expiry alone.

Can a WHOIS lookup show whether a domain can be transferred?

A whois lookup can often indicate whether a domain appears transferable, but it does not provide a complete answer on its own. It is best viewed as a screening tool rather than a final transfer clearance.

The first point is timing. A domain usually cannot be transferred to another registrar for 60 days after registration or a registrar transfer. That means a recently registered name, or one moved between registrars not long ago, may be ineligible for an immediate registrar transfer even if the owner wants to sell.

Status fields can also help. If the domain shows a transfer prohibition or client lock status, that usually means the name cannot move to another registrar until the lock is lifted. In many cases this is routine security rather than a sign of dispute or trouble.

It is also important to separate registrar transfer from ownership change. A domain can change hands without an immediate move to a new registrar. For example, control can pass by account change at the same registrar, with a registrar transfer happening later when eligible. So a whois lookup may suggest that a registrar transfer is blocked for now, while a transaction between parties is still possible by other means.

Use the lookup to ask better questions:

• Is the domain newly registered or newly transferred.
• Do the statuses suggest a lock.
• Does the registrar have specific transfer procedures.

Those clues are valuable, but they should be confirmed before any deal timetable is agreed.

Why WHOIS lookup results differ between tools

It is common to run a whois lookup in two places and get outputs that do not match perfectly. That does not always mean one tool is wrong. Often, the difference comes from source, timing and display.

For gTLDs, RDAP became the definitive source on 28 January 2025, after WHOIS port 43 obligations for gTLD registries and registrars ended. Some services have adapted fully to RDAP. Others still present legacy-style layouts or rely on older collection methods. The underlying facts may be similar, while the presentation differs.

Timing also matters. Lookup services may cache results, refresh on different schedules, or show a delayed copy. A recent status change, nameserver update or transfer may appear in one tool before another.

Another source of variation is whether the tool emphasises registry-level or registrar-level data. One may show concise registry records. Another may expand registrar information, status descriptions or historical notes. That can make one result seem richer even when both are based on the same registration state.

Privacy and policy changes matter too. Since GDPR took effect on 25 May 2018, most registrant personal data in WHOIS has been redacted. Some tools therefore show less contact detail than older guides suggest. ccTLDs can differ again, because local rules, data publication practices and query formats are not uniform.

When results differ, compare the dates, statuses and source notes before drawing conclusions. Usually, the variation is procedural, not mysterious.

Best practices when using WHOIS lookup data

A whois lookup is a starting point, not a verdict. Used well, it helps with acquisition strategy, basic due diligence and troubleshooting. Used poorly, it can lead to false assumptions about ownership, availability or risk.

Begin with respectful outreach. If contact details are published, keep messages concise, relevant and professional. If details are redacted, avoid guessing the owner from scraps of public information. Since GDPR took effect on 25 May 2018, redaction has been normal for many records, so absence of data is not itself suspicious.

Good process matters:

• Save dated copies of lookup results.
• Cross-check important fields in more than one tool.
• Compare registration data with live website use, DNS and historical context.
• Treat statuses and dates as signals, not proof of intent.
• Re-check before making an offer, filing a complaint or relying on a drop timeline.

It also helps to separate three questions that buyers often blur together. Who appears to sponsor the domain. Whether the domain is in active use. Whether the domain is realistically obtainable. A whois lookup may illuminate one or two of those questions, but rarely all three on its own.

Most importantly, avoid overconfidence with redacted or incomplete records. Multiple signals usually produce better judgement than a single lookup page. This article is informational only and is not legal advice. If you need a discreet second view on a sensitive name, Westmore can review the position confidentially.