WHOIS is a query/response protocol (RFC 3912) that runs on TCP port 43 and allows anyone to look up registration metadata for a domain name. A WHOIS query returns free-text information including the domain owner, registrar, creation and expiration dates, status codes, and authoritative nameservers.
How it works:
You send a plain-text query to a WHOIS server (usually a domain's registrar or the registry for its TLD); the server responds with registration records and closes the connection. Each registry and registrar maintains its own WHOIS server. The IANA root WHOIS (whois.iana.org) helps direct queries to the correct server for any TLD.
Example query:
whois example.com
Returns output like:
Domain Name: EXAMPLE.COM
Registrar: Example Registrar, Inc.
Registrant: Example Owner
Created: 1995-08-14
Expires: 2025-08-13
Nameserver: ns1.example.com
Nameserver: ns2.example.com
NoteWHOIS privacy and GDPR have restricted public access to registrant contact details in many regions. Modern WHOIS often masks personal information or forwards requests through the registrar instead of exposing it directly.
WHOIS is gradually being replaced by RDAP (Registration Data Access Protocol), a structured HTTP/JSON alternative that provides standardized, machine-readable responses and better access controls.