What Is WHOIS? What a Lookup Shows, Status Codes and the Expiry Timeline
By Thomas Lovas Lokoy — researched and drafted with AI assistance, then fact-checked and approved by Thomas before publishing · Editorial policy
WHOIS is the public record attached to every registered domain name, and the protocol used to look it up. The record says which registrar holds the domain, when it was created and when it expires, which status codes are set on it, and which nameservers answer for it. Since 21 August 2025, wherever data protection law applies, and at many registrars for every record, it no longer shows the owner's name, address or phone number; it shows an anonymised contact route instead. A lookup is free, takes a second, and is the first thing to run before you buy, sell, transfer or trust a domain.
What a WHOIS record contains
ICANN's Registration Data Policy, in force since 21 August 2025, fixes what every registrar and registry must publish (section 9.1, read on 16 October 2026):
| Field | What it tells you |
|---|---|
| Domain name | The name the record describes |
| Registrar, with its IANA ID | The company that manages the registration, and its unique number |
| Creation date | When the current registration began |
| Registry expiry date | When the registration runs out unless renewed |
| Updated date | The last change to the record |
| Domain status codes | Locks, holds and pending operations (see the table below) |
| Nameservers | Who runs the domain's DNS: often the host or a CDN |
| DNSSEC | Whether the zone is signed |
| Registrant state/province and country | The owner's jurisdiction, published even when everything else is redacted |
| Registrant organisation | Published only if the registrant agrees |
| Registrar abuse contact | An email address and phone number, always published |
The fields that are missing from that table are the ones most people expect to see. Where redaction applies, the policy requires the registrant's name, street address, postcode, phone and fax numbers to be redacted (section 9.2.2), and the registrant's email address to be replaced by either an anonymised email address or a web form that reaches the registrant without revealing who they are. Where the domain was registered through a privacy or proxy service, the service's own details are published in full, which is why a record often names a privacy company.
Try it on any domain with our WHOIS lookup. An RDAP lookup of this site's own domain on 16 October 2026 returned the registrar, the creation and expiry dates, a single status code, two Cloudflare nameservers and the registrar's abuse contact, and nothing at all about the registrant. That is the normal shape of a record now.
WHOIS and RDAP: same record, two protocols
"WHOIS" names both the record and the 1980s text protocol that originally served it. Its replacement is RDAP, the Registration Data Access Protocol, which returns the same registration data as structured JSON over HTTPS, with consistent field names and proper support for international scripts. ICANN's own lookup at lookup.icann.org queries RDAP, and the public bootstrap service at rdap.org forwards a query to whichever registry or registrar serves the domain.
For a reader the difference is cosmetic: the fields are the same, the redaction rules are the same, and the status codes are the same. "WHOIS" has simply stayed on as the everyday name for the whole thing.
Why the record changed
Before 2018 a lookup on almost any domain returned the registrant's full name, postal address, email and phone number. The EU's General Data Protection Regulation took effect in May 2018, ICANN adopted a Temporary Specification that let registrars redact personal data, and that interim arrangement was replaced by the Registration Data Policy on 21 August 2025. The policy applies redaction wherever "redaction of Personal Data contained in Registration Data is required in order to comply with applicable law", and allows registrars to redact more broadly where they have "a commercially reasonable purpose to do so". The policy lets a registrar take the registrant's location into account but does not require it to, and many registrars simply redact every record rather than sort customers by country.
What did not change is that the registrar still holds the full data, must verify it, and must disclose it to lawful requests. Redaction hides the record from the public; it does not make a registration anonymous. WHOIS privacy explained covers the difference between this default redaction and the privacy service some registrars sell on top of it, and the domain privacy protection guide covers which registrars charge for that service and which include it.
Domain status codes, in ICANN's words
Every record carries one or more EPP status codes. They are the most useful part of a lookup and the least often read. ICANN publishes a definition for each on its EPP status codes page; the common ones, with its wording as read on 16 October 2026, are:
| Status code | Set by | ICANN's description |
|---|---|---|
| ok | Registry | "This is the standard status for a domain, meaning it has no pending operations or prohibitions." |
| clientTransferProhibited | Registrar | "tells your domain's registry to reject requests to transfer the domain." The normal locked state; the registrar removes it before a legitimate transfer. |
| clientUpdateProhibited | Registrar | "tells your domain's registry to reject requests to update the domain." |
| clientDeleteProhibited | Registrar | "tells your domain's registry to reject requests to delete the domain." |
| clientHold | Registrar | "tells your domain's registry to not activate your domain in the DNS." The domain stops resolving; ICANN names legal disputes, non-payment and pending deletion as the usual reasons. |
| serverTransferProhibited | Registry | "prevents your domain from being transferred from your current registrar to another." Often a registry lock or a dispute hold. |
| serverHold | Registry | "set by your domain's Registry Operator." The domain is kept out of the DNS by the registry itself. |
| pendingTransfer | Registry | "a request to transfer your domain to a new registrar has been received and is being processed." |
| addPeriod | Registry | "provided after the initial registration of a domain name." An informational grace period. |
| autoRenewPeriod | Registry | The registration was "extended (renewed) automatically by the registry." |
| renewPeriod | Registry | The registration was "explicitly extended (renewed) by the registrar." |
| transferPeriod | Registry | Shown "after the successful transfer of a domain name from one registrar to another." |
| redemptionPeriod | Registry | "indicates that your registrar has asked the registry to delete your domain." The domain is held for 30 days and can still be restored. |
| pendingDelete | Registry | "indicates that your domain has been in redemptionPeriod status for 30 days" without being restored. The final stage before the name is purged. |
Three readings matter in practice. A domain you own should show clientTransferProhibited and usually clientUpdateProhibited and clientDeleteProhibited; if the transfer lock is missing, put it back. A domain showing clientHold or serverHold is not resolving, and the record tells you which party switched it off. A domain showing redemptionPeriod or pendingDelete is on its way out, and the owner still has a short window to recover it in the first case but not the second.
The expiry timeline, as the rules set it
The popular version of this timeline, with fixed day counts for every stage, is not how the rules are written. For generic extensions such as .com, two ICANN documents govern it: the Expired Registration Recovery Policy, which registrars and registries have had to follow since 31 August 2013, and the EPP status definitions above. Country-code registries set their own timelines.
- Before expiry. The registrar must send at least two renewal reminders, one "approximately one month prior to expiration" and one "approximately one week prior to expiration". If the domain is not renewed within five days after it expires, at least one more notice must follow.
- After expiry, while still renewable. How long the registrar lets you renew after the date is set by the registry's grace period and the registrar's own terms, and it varies. Whatever that window is, if the domain will be deleted eight or more days after expiry the registrar must interrupt the domain's DNS for at least the last eight consecutive days in which you can still renew, so an expired site visibly stops working before it is lost. If the registrar redirects the domain to a page during that time, the page must state that the registration has expired and explain how to renew.
- Redemption. Once the registrar deletes the registration, the domain enters a 30-day Redemption Grace Period, shown as redemptionPeriod. The registrant can still have it restored, usually for a restore fee on top of the renewal. Section 4.1 of the policy requires registrars to make their renewal, post-expiry renewal and redemption fees reasonably available, and ICANN's notes on it say that includes the registrar's website if it has one, so the fee for your registrar is published; we do not quote one here because it differs by registrar and changes.
- Pending delete. After the 30 days the domain moves to pendingDelete for several more days. Nothing can be done at this stage; the name is then purged and becomes available to register again, which is the moment drop-catching services compete for. How domain backorders work covers that end of the process.
The practical rule for owners is the one in renewing and protecting domains: auto-renew on, a card that will not expire before the domain does, and an email address on the account that you read.
Where the data comes from, and your part in it
The registrar collects your contact details when you register. Under the 2013 Registrar Accreditation Agreement and its WHOIS accuracy specification, it must verify your email address or phone number, and if it does not receive an affirmative response "within fifteen (15) calendar days" it must "either verify the applicable contact information manually or suspend the registration". The same agreement makes a registrant's "failure to respond for over fifteen (15) days to inquiries by Registrar concerning the accuracy of contact details" a material breach and grounds for suspension or cancellation.
So the verification email after you register is not optional, and neither is the one that arrives after you change your details. A domain suspended for an unanswered accuracy check stops resolving exactly as if you had stopped paying for it.
What a lookup is for
- Before buying a domain from its owner. The creation date tells you how long the name has been held, and the status codes tell you whether it can move at all. If you are negotiating, how to buy a domain that is taken covers approaching the owner.
- Before trusting a website. A shop registered three weeks ago, with privacy on and a registrar you have never heard of, is not proof of anything, but it is a reason to look harder. Our guide to finding out who owns a domain covers the routes that still work after redaction.
- Before transferring. A missing clientTransferProhibited, a recent creation or transfer date, and an expiry inside the next few weeks each change how a transfer should be run; the domain transfer guide walks through it.
- Watching an expiring name. The expiry date plus the timeline above tells you roughly when a name you want could drop, if its owner does nothing.
- Checking your own domains. Once a quarter, look up each domain you hold and confirm the registrar, the expiry date and the locks are what you expect. Hijackings are often discovered in a lookup.
Where to go next
Run the WHOIS lookup on a domain you own and read the status codes against the table above; if the transfer lock is off, your registrar's control panel is where it goes back on. If you are choosing a registrar and want the privacy service included rather than sold as an add-on, Spaceship and Namecheap both include it, and EuroDNS sells it as a paid extra, listed at EUR 5.00 a year on its domain privacy page on 16 October 2026; our EuroDNS review covers where that registrar earns its price regardless.
Frequently asked questions
What does a WHOIS lookup show in 2026?
The registrar and its IANA ID, the creation, update and expiry dates, the domain status codes, the nameservers, DNSSEC data, the registrant's state or province and country, and the registrar's abuse contact. The registrant's name, street address, phone and email are redacted and replaced by an anonymised email address or a web form that reaches them.
Is WHOIS the same as RDAP?
They carry the same registration record. WHOIS is the original text protocol and still the everyday name; RDAP is its structured HTTPS replacement, which ICANN's lookup.icann.org uses and most registrars now serve. The fields, redaction rules and status codes are identical.
What does clientTransferProhibited mean?
It is the registrar-set lock that, in ICANN's words, "tells your domain's registry to reject requests to transfer the domain". It is the normal state for a domain you are keeping, and the registrar removes it only when you unlock the domain to transfer it.
How long after expiry can a domain be recovered?
For as long as your registrar's post-expiry renewal window lasts, which varies by registrar and registry, and then for a further 30 days in the Redemption Grace Period, usually for a restore fee that the registrar must make available to you. Those are the rules for generic extensions such as .com; country-code registries set their own. Once the domain shows pendingDelete, it can no longer be recovered and will be released.
Why did my registrar ask me to verify my email address?
The 2013 Registrar Accreditation Agreement requires registrars to verify a registrant's email address or phone number, and to verify manually or suspend the registration if there is no affirmative response within fifteen calendar days. Ignoring that email can take your domain offline.
Sources
Last updated:
