RDAP
The registries' own structured replacement for WHOIS: JSON over HTTPS, with the right server for each top-level domain named authoritatively by IANA. No scraping and no guessing.
Since GDPR, registries withhold registrant names and addresses for the great majority of domains. Any tool still promising to tell you who owns a domain is promising data that does not exist — so this one reports what is published, and says plainly when a field was withheld rather than leaving it blank.
The registries' own structured replacement for WHOIS: JSON over HTTPS, with the right server for each top-level domain named authoritatively by IANA. No scraping and no guessing.
The one field here that can cost you something. A lapsed domain stops resolving, then enters a redemption period, then becomes available to anyone.
What the registry will and will not allow. Codes beginning client were set by the registrar; server codes by the registry itself.
clientTransferProhibited. Free, instant, and the single most effective protection against a domain being taken. Its absence is worth fixing today.
The expiry date, and whether renewal will actually happen. Domains are lost to expired payment cards far more often than to anything dramatic. Auto-renewal being on is not the same as auto-renewal working, and the registrar's reminder emails go to whatever address was on the account years ago.
The locks. A domain with no transfer lock can be moved to another registrar by anyone who obtains the authorisation code, and that code is often retrievable by anyone with access to the registrar account or the administrative mailbox. Turning on the transfer lock takes a moment and blocks the entire class of attack. Add the delete and update locks too for a domain that does not change often — they are equally free, and the inconvenience of removing one before a legitimate change is small next to the alternative.
On redaction: the fields are not missing because the registry is unhelpful, and a privacy service in front of the registrant is not suspicious. It is now the default arrangement. For a genuine dispute the route is the registrar's abuse contact or a formal process, not a lookup tool.
Because it is no longer published. Registries redact registrant contact details for individuals to comply with GDPR, and many apply it to all registrants regardless of jurisdiction. What remains public is the registrar, the dates, the nameservers and the status codes — which is what this page shows.
RDAP is the replacement. WHOIS is unstructured text that differs between every registry and has to be parsed by guesswork; RDAP is JSON with defined fields, served over HTTPS, with an authoritative directory of which server answers for which top-level domain. This tool uses RDAP wherever it exists.
Check the spelling, and check which name is actually registered — a lookup for www.example.com has to fall back to example.com, and a name under a multi-label suffix like .co.uk is registered at the third level. If the domain is genuinely registered and this says otherwise, the registry's RDAP service may be returning something unexpected, and the registrar's own control panel is the authority.
A few registries publish no RDAP service, and a handful publish neither RDAP nor port-43 WHOIS, offering only a web form with a captcha. There is nothing a tool can do about that, and we would rather say so than scrape a form.
No. The lookup goes to the registry, not to the domain, and registries do not report lookups to registrants.
A record changed by someone who left, a registrar nobody has the login for, a zone signed but never delegated. We take over the operation of this properly — documented, monitored, and changed through a process rather than through whoever is awake.