WHOIS Lookup

Look up domain registration details from WHOIS servers.

This tool sends your query through our server to look up live data. We don't store it, and no files are ever uploaded — though the upstream service answering the lookup sees the query too.

Queries a domain's WHOIS server over port 43 and prints the registration record exactly as it comes back — registrar, creation and expiry dates, status codes and nameservers — with no parsing or reformatting in between.

How to use it

1Enter the domain and press Enter, or click Lookup.
2Check the line above the record to see which server actually answered — it is often the registrar's, not the registry's.
3Use the copy button beneath the dark panel to take the whole raw record.

Example

Input: example.com
Output: The unparsed WHOIS text in a scrollable panel, headed with the name of the server that answered

The lookup is a chain, not one call: the server first asks whois.iana.org which WHOIS server owns the TLD, queries that registry, and if the registry names a "Registrar WHOIS Server" it follows one more hop and prefers that fuller answer. Each hop has an eight-second timeout, so a slow registrar produces a connection error rather than half a record. Because the text is passed through untouched, field names differ between TLDs, and gTLD records usually have the registrant contact details redacted.

What happens to your data

WHOIS has no encrypted form: our /api/whois route opens a plain TCP socket to port 43 on the registry's server and writes your domain across it in clear text, so the query is visible in transit — but it leaves from our host, not from your address. The reply is accumulated in memory with a 200,000-character ceiling, after which the socket is destroyed, and it is handed straight back to you without being written anywhere.

Last updated August 2026

The domain you wanted is taken, and the site on it has been a holding page for years. Or an invoice arrives for a domain nobody can find a login for. Or a message turns up from a lookalike domain and you want to know how old it is. Those questions end in the same place — the registration record a registry keeps, asked for over a protocol that predates the web.

Work out first which registration you mean. A domain name and the IP address it resolves to are held by different bodies: the name by the registry for its TLD, the address block by one of the five regional internet registries. Only the first is answered here. A record will not tell you who runs the machine at the other end; the hosting company you infer from it is a guess made from the nameservers.

The format's real limitation is that it has no schema. Field names, order and even which fields exist are each registry's choice, so a .com record and a .de record have little in common beyond the domain. Since 2018, contact fields on most generic domains come back redacted by default, whether or not anyone asked for privacy.

The common mistake is asking with the wrong string. The field wants a registrable domain — example.com — not a URL with https:// attached, not a subdomain, and not a name with an accent in it, which has to be typed in its xn-- punycode form.

How it works

Toolvore asks three servers in turn, from our host rather than from your browser. The first hop goes to whois.iana.org carrying only the last label of what you typed — the TLD — whose refer line names the registry that owns it. The second asks that registry about the whole domain. If the registry's reply carries a Registrar WHOIS Server line pointing elsewhere, a third hop asks the registrar too, and that answer replaces the registry's whenever it comes back longer than a hundred characters. Every connection is a raw TCP socket to port 43 that gives up after eight seconds of silence, and each hostname is resolved and checked to be a public address before anything connects to it. The weak point is that nothing is parsed: no field is normalised or relabelled, and the line above the panel names the registry that was referred to, so a successful registrar hop leaves the header crediting the wrong server. A reply past 200,000 characters is cut where it stands.

Common use cases

Checking how recently a lookalike domain in a phishing email was registered
Finding which registrar holds a domain before starting a transfer
Reading the status codes on a domain that refuses to transfer
Confirming an expiry date nobody can account for
Checking which nameservers a domain is delegated to
Seeing whether a name behind a parking page is registered
Copying a raw record into an abuse report

Frequently asked questions

Why is the owner's name and email replaced with REDACTED FOR PRIVACY?＋

Because most registries stopped publishing them. After GDPR came into force in 2018, ICANN's temporary specification told generic registries and registrars to withhold personal contact fields by default, and it applies whether or not the registrant is in Europe. Some registrars also sell a proxy service that puts their own details there, which looks similar but is a different mechanism with different consequences at transfer time. What usually survives is the country and an organisation field on business registrations. Redaction is the norm, not a sign that somebody is hiding.

How do I contact a domain owner when the record shows no email?＋

Work from the registrar rather than the record. Generic registries publish an anonymised forwarding address or a web form that relays a message to the registrant, and the registrar named in the record must publish an abuse contact that accepts complaints. If the name is merely for sale, the parking page is the intended route. For a trademark dispute the process is UDRP through an accredited provider, not an email. Registrars will not release registrant details on request: disclosure needs a legal basis. Expect slow replies, and some that never arrive.

What do status codes like clientTransferProhibited and serverHold mean?＋

They are EPP status codes, and they describe locks rather than health. A client prefix means your registrar set it: clientTransferProhibited is the ordinary transfer lock most registrars apply by default, and you clear it in their control panel before moving a domain out. A server prefix means the registry set it and you cannot clear it yourself. serverHold is worth recognising — the domain is registered but not published in DNS, so the site is dark although nothing has expired. redemptionPeriod and pendingDelete are stages of an expiry running its course.

Does a WHOIS record tell me whether a domain is available?＋

A record with dates in it means the name is registered, and a reply of no match or not found means the registry holds no entry — which usually, but not certainly, means it is free. A name can be reserved by the registry, blocked as a premium or protected string, or sitting in redemption after an expiry, where nobody new can register it. Only a registrar's search can price it and take the order. Do not read a parking page as availability either: plenty of registered domains serve nothing.

What happens to a domain after its expiry date?＋

The expiry date is not the date the name returns to the pool. Most generic TLDs allow an auto-renew grace period of up to 45 days after it, during which the registrar may keep the name alive and the record can show a date already passed. A 30-day redemption period follows, in which only the original registrant can recover it, usually for a restoration fee far above the renewal price, then about five days of pendingDelete before release. That is why a domain that expired last month is still unavailable.

Why does a .uk or .de record look nothing like a .com one?＋

Because the protocol standardises the transport and nothing above it: a client sends a line of text, a server sends text back, and the rest is registry policy. Nominet for .uk names its fields its own way and adds a registrant type; DENIC for .de returns little more than status and technical contact; several country registries answer only through a web form. A second split sits underneath: a thin registry keeps only a pointer to the registrar, a thick one the full record, so the detail depends on the model the TLD chose.

Does the owner find out that I looked up their domain?＋

The connection is made from our server, not your browser, so the registry sees our address rather than yours. There is no encrypted version of the protocol — the query crosses port 43 as clear text, so the domain you asked about is readable by anything on the path. The reply is held in memory only long enough to reach you, and written nowhere. No registrant is told that a lookup happened, though registries do rate-limit by source address, which is why bursts of automated lookups get refused while occasional ones pass.

What is RDAP, and is it replacing WHOIS?＋

RDAP is the replacement: the same registration data over HTTPS as JSON, with defined field names, a specification for the response and a way to authenticate the requester. Generic registries have been required to run one for years, and ICANN has published a path to retiring port 43. Two things follow. Responses are parseable, so regular expressions over free-form text stop being necessary. And an authenticated requester can be shown more than an anonymous one, which is meant to soften blanket redaction. Many country-code registries still answer only the old way.