Glossary
WHOIS
WHOIS is the long-standing protocol for querying a domain's registration record: who registered it, through which registrar, when it was created, and when it expires. Much of the personal data it once returned is now redacted for privacy reasons, so the contact details are usually unavailable. The operational fields — registrar, dates and status codes — remain published, and those are the ones that matter for keeping a domain alive.
What a record still contains
The registrar of record, which is the company through which the domain is managed and the only party that can transfer or renew it.
Creation, last update and expiry dates. The expiry date is the single most consequential field, because a lapsed domain takes the website, the mail and every subdomain with it.
The delegated nameservers, which is the same information the DNS delegation carries.
Status codes such as `clientTransferProhibited` or `clientDeleteProhibited`, which are registrar locks that prevent a domain being moved or deleted without deliberate action.
Why the contact details are gone
Registrant names, addresses, emails and phone numbers were published in full for decades. Data protection law, and the General Data Protection Regulation in particular, made that publication untenable for personal data.
Registrars now redact those fields by default for most registrations and provide an anonymised forwarding address instead.
Privacy or proxy services layer an additional substitution on top, replacing the registrant entirely with the service.
The consequence is that WHOIS is no longer a way to find out who runs a site. It is a way to find out how the domain is administered.
RDAP, the structured successor
RDAP returns the same registration data as JSON over HTTPS, with a defined schema, proper internationalisation and the ability to authenticate a requester for access to non-public fields.
WHOIS was free text over an unencrypted protocol with no consistent format between registries, which made parsing it an exercise in per-registry special cases.
RDAP is now the supported interface for generic TLDs, and most registries offer both while WHOIS is retired.
For everyday checking the two return the same operational fields, and which one a tool uses is an implementation detail.
What to check, and how often
The expiry date, against a calendar reminder you control rather than against a renewal email that may go to an address nobody reads.
That the registrar transfer lock is set. It costs nothing and prevents the most damaging category of domain incident.
That the registrar account itself has multi-factor authentication. Control of that account is control of the domain, and no DNS configuration protects against losing it.
That the administrative email address is one that still exists and is monitored, since expiry notices go there.
Frequently asked questions
- Why is the owner's name hidden in WHOIS?
- Personal data is redacted by default under data protection law. Registrars publish an anonymised contact instead of the registrant's details.
- What is RDAP?
- The structured replacement for WHOIS: the same registration data as JSON over HTTPS, with a defined schema and support for authenticated access.
- What is the most important field to watch?
- The expiry date. A domain that lapses takes the website, the email and every subdomain offline at once, and recovery is neither guaranteed nor cheap.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website