🔍 Whois Lookup

Whois Lookup retrieves the public registration record of a domain name or the allocation record of a public IP address over the Whois protocol of RFC 3912: one TCP query to port 43 of a registry, registrar or regional internet registry (RIR), answered with free-form text. By default the query runs on a remote worker through the system whois client, which picks the right server for every TLD and address block and follows registrar referrals. Only when no worker answers, because none is registered and healthy or because the attempt fails, does an in-process fallback client answer instead.

Supported inputs

• One domain name or one IP address per query in the host field, at most 253 characters; the page trims surrounding whitespace before sending. Quotes, backticks, embedded whitespace and shell metacharacters such as ;, | and & are rejected before any connection opens, so CR, LF or NUL never reach the port-43 stream.
• Domain names made of ASCII labels, for example example.com. Internationalized names must be entered in Punycode, such as xn--mnchen-3ya.de; a Unicode label is rejected with HTTP 400, not converted.
• IPv4 and IPv6 literals such as 8.8.8.8 or 2001:4860:4860::8888. Private, loopback, link-local, carrier-grade NAT, documentation and other reserved ranges are rejected with HTTP 400, as are localhost, names beginning with test. and names ending in .local, .localdomain or .internal.
• No lookup options beyond the host: no whois-server override, no RDAP mode. An optional worker_id pins the lookup to one remote worker; the page shows a worker selector only when more than one healthy whois-capable peer is registered.

Output

• Raw Whois Output panel and raw_output field: the complete server text, unmodified apart from trimmed outer whitespace, with a copy button. Query Details shows the queried host, the answering server and the ISO 8601 timestamp in your local time.
• Remote worker answers (the default) carry only raw_output: server is null, parsed is empty and the Key Information panel stays hidden.
• Fallback answers add parsed: every key: value line, key lowercased, repeats collected into arrays, comments (%, #) and empty values dropped. Its common_fields map fills Key Information from the labels the parser knows: Domain Name/Domain, Registrar, Creation Date/Created, Expiry Date/Expires, Name Server/Nameserver, Domain Status/Status. An IP lookup yields keys such as netrange, cidr, orgname and orgabuseemail instead.
• Errors are JSON with error and timestamp, plus message for worker and upstream failures: 400 for a missing, invalid or blocked host or an unavailable requested worker, 503 when a worker is required and none is healthy, 500 when the upstream server cannot be reached, 429 with retry_after when rate limited.

Example

POST /api/tools/network/whois with body {"host": "example.com"}. A remote worker's raw_output carries the registrar record too, because the whois client follows the Verisign referral. The fallback client queries whois.verisign-grs.com itself and returns this shape (abridged):

{
  "host": "example.com",
  "server": "whois.verisign-grs.com",
  "raw_output": "Domain Name: EXAMPLE.COM\n   Registrar: RESERVED-Internet Assigned Numbers Authority\n   Creation Date: 1995-08-14T04:00:00Z\n   Registry Expiry Date: ...\n   Domain Status: clientDeleteProhibited ...\n   Domain Status: clientTransferProhibited ...\n   Name Server: A.IANA-SERVERS.NET\n   Name Server: B.IANA-SERVERS.NET",
  "parsed": {
    "domain name": "EXAMPLE.COM",
    "registrar": "RESERVED-Internet Assigned Numbers Authority",
    "creation date": "1995-08-14T04:00:00Z",
    "registry expiry date": "...",
    "domain status": ["clientDeleteProhibited ...", "clientTransferProhibited ..."],
    "name server": ["A.IANA-SERVERS.NET", "B.IANA-SERVERS.NET"],
    "common_fields": {
      "domain_name": "EXAMPLE.COM",
      "registrar": "RESERVED-Internet Assigned Numbers Authority",
      "creation_date": "1995-08-14T04:00:00Z",
      "name_servers": ["A.IANA-SERVERS.NET", "B.IANA-SERVERS.NET"],
      "status": ["clientDeleteProhibited ...", "clientTransferProhibited ..."]
    }
  },
  "timestamp": "2026-09-10T12:00:00+00:00"
}

Limitations

• The fallback client uses a fixed server table. It knows registry servers for .com, .net, .org, .info, .biz, .us, .uk and .de, sends every other TLD to whois.iana.org and every IP query to whois.arin.net, so addresses from RIPE NCC, APNIC, LACNIC and AFRINIC return ARIN's ResourceLink stub. It ignores the Registrar WHOIS Server referral, so .com and .net answers stop at the thin Verisign record. A remote worker has none of these limits.
• Parsing is heuristic and fallback-only. Only single-line key: value pairs are recognised, and labels such as Verisign's Registry Expiry Date and DENIC's Nserver are never normalized into common_fields; an IP record fills none of them. Treat raw_output as authoritative.
• Privacy and accuracy. Privacy services, GDPR redaction, stale registrar data and free-form server formats can hide or rename fields; country codes in allocation data describe the holding organization, not a device's location.
• Timeouts and throttling. A remote worker caps the whois command at 30 seconds; the fallback client allows 10 seconds to connect, then reads until the server closes. Registries and RIRs throttle repeated queries. Rate limits: anonymous 2 per minute, 10 per hour, 30 per day; signed in 5, 50 and 200, with a CAPTCHA after 5 requests in an hour.
• No caching. Every lookup is a live port-43 query; nothing is cached server side.

Browser or server processing

This is a server-side tool; nothing is computed in the browser. The page posts the host as JSON to /api/tools/network/whois, so it is visible to this site and to the upstream registry or RIR; every request is rate limited and recorded in the security audit log. Only the Recent Queries list stays in your browser: the last 10 hosts in localStorage, of which the panel shows five.

FAQ

Why is the registrant name or email hidden in the WHOIS result?

Since ICANN's 2018 Temporary Specification and the GDPR most registrars redact personal contact data or use a privacy proxy, so Registrant Name: REDACTED FOR PRIVACY is normal. A fallback-client .com or .net answer also stops at the thin Verisign registry record, which carries no contacts at all.

Why does WHOIS say "No match" or show a TLD record for a domain that is live?

Only registered names are records: www.example.com is accepted but answered with "No match", so query the registered name (example.com, example.co.uk); a URL or anything carrying a scheme or path is rejected with HTTP 400 before a query is sent. A delegation record with a refer: line means the fallback client sent a TLD outside its table to whois.iana.org, which answers for the TLD and not the domain; query the referred server directly.

What is the difference between a domain WHOIS and an IP WHOIS?

A domain record comes from the TLD registry or registrar and describes the registration; an IP record comes from an RIR and describes the address block, so it says who holds the block, not which domain runs on the address. Use a reverse DNS lookup for that.

Does this tool use RDAP?

No, port-43 Whois only. RDAP serves the same data as JSON over HTTPS and is the better choice for structured output; see the references.

References

• RFC 3912: WHOIS Protocol Specification
• RFC 7480: HTTP Usage in RDAP
• RFC 9082: RDAP Query Format
• RFC 9083: JSON Responses for RDAP
• IANA Whois service
• IANA root zone database
• ICANN EPP domain status codes