RDAP first, port 43 as the fallback
The lookup starts with RDAP, the JSON successor to WHOIS. The server asks rdap.org, a bootstrap service that forwards the request to the registry responsible for the top-level domain, and waits up to six seconds. A good reply is parsed into the cards you see and the Source badge reads RDAP. The raw JSON is available at the bottom of the result.
When RDAP times out, returns an error or simply does not exist for that top-level domain, the tool opens a TCP connection to port 43 of the registry's WHOIS server and sends the domain name. Common registries are known in advance (Verisign for .com and .net, Public Interest Registry for .org, DENIC for .de, Nominet for .uk). For other suffixes it asks whois.iana.org for the referral. The Source badge then reads WHOIS_FALLBACK and the raw text is shown instead of JSON.
Only the registry is queried. For thin registries such as .com, where contact data lives with the registrar, the tool does not make a second trip to the registrar's server. That keeps lookups fast and predictable, but it means contact fields are often empty even where the registrar would publish them.
The fields on the result card
The header shows the domain, the data source and the sponsoring registrar. Three date cards follow: creation, last update and expiration, with a days-left badge that turns red under 60 days. Below them sit the registrar details (IANA ID and abuse contact when RDAP supplies them), a DNSSEC Signed or Unsigned badge, the EPP status flags and the list of nameservers delegated at the registry.
In WHOIS fallback mode the fields are pulled from the text with pattern matching on labels such as Registrar:, Creation Date:, Registry Expiry Date:, Domain Status: and Name Server:. Registries that use different wording leave a field blank or showing Not reported. Open the raw output to read the original response when something looks missing.
The DNSSEC badge comes from the registry's secureDNS data in RDAP, or from a signedDelegation line in WHOIS. Signed means a DS record is published at the parent. It does not prove the zone's signatures validate. The DS lookup and DNSKEY lookup tools check that.
EPP status codes and what they mean
The status flags are EPP codes set by the registrar (client prefix) or the registry (server prefix). A healthy, actively managed domain usually carries three client locks. Codes that start with server, or that mention hold, redemption or delete, deserve a closer look before you rely on the domain.
- clientTransferProhibited, clientDeleteProhibited, clientUpdateProhibited: registrar locks that block transfers, deletion and changes until the owner lifts them. Normal and desirable.
- serverTransferProhibited, serverUpdateProhibited: the same locks applied by the registry, often after a legal or abuse case. Only the registry removes them.
- clientHold or serverHold: the domain is removed from the zone and stops resolving, typically for unverified contact details or non-payment.
- redemptionPeriod, pendingDelete: the domain has expired and is on its way out. See the lifecycle below.
- ok: no locks at all. Fine for a parked name, risky for one you care about.
- inactive: no nameservers are delegated, so the domain does not resolve.
Dates and the expiry lifecycle
The creation date gives the age of the registration, which is one of the quickest signals when judging a suspicious link. The phishing link checker uses it for that reason. The updated date moves whenever the registrar changes anything, including nameservers, contacts or locks, so a recent value is not by itself a sign of a sale.
For generic top-level domains the expiration date is followed by an auto-renew grace period of up to 45 days at the registrar's discretion, then a 30-day redemption grace period during which the registrant can restore the name for a fee, then around five days of pendingDelete before the name is released. Country-code registries set their own rules, and some have no redemption phase at all.
Country-code and some newer registries report fewer dates. A missing expiration date on a .de domain is a feature of that registry's policy, not a parsing error. When all three dates are empty, check the raw output before assuming the domain is unregistered.
Privacy redaction and other limits
Since 2018 most registrars redact the registrant's name, address, email and phone from public output under GDPR and ICANN's Temporary Specification. The tool shows a Privacy Redaction Active notice when it finds a redacted or privacy-service entity, and leaves the contact fields out rather than showing placeholder text. What remains is still useful: registrar, dates, locks, nameservers and DNSSEC are never redacted.
This page is for domain names only. For the holder of an IP address, its network and location, use the IP lookup. If the registry answers that there is no match, the tool reports that the domain is not registered. To test many suffixes at once use the domain availability checker.
Registries rate limit port 43 heavily, so repeated lookups of the same name within a short time may fail at the WHOIS stage even when RDAP works. Lookups are limited per visitor IP and are not stored, as the privacy policy explains. Compare the delegated nameservers here with the live NS records from a DNS lookup if a domain resolves unexpectedly.