WHOIS Lookup
Who owns a domain, who it is registered with, when it expires and where it points — read straight from the registry, with every status code explained.
Your browser asks the domain's registry directly — the lookup never passes through zeal.tools. A URL or subdomain works too; the registered name is what gets looked up.
Enter a domain to see who registered it, when it expires and where it points.
Table of contents
How to look up a domain
- 1
Type or paste a domain
A bare name, a subdomain or a whole URL. Registries only know the registered name, so blog.example.co.uk is looked up as example.co.uk — and the tool tells you it did that.
- 2
Read the answer at the top
Whether it is registered, how old it is, when it expires and who it is registered with. A domain that expires within a month is flagged.
- 3
Check who owns it
The registrant's organisation and country where the registry publishes them. Most personal details are withheld by law, in which case the registrar's contact form is linked — that is the legitimate route to the owner.
- 4
Look at where it points
Nameservers, DNSSEC and the live A, MX and TXT records, with the DNS and email provider named where the hostnames make it unambiguous.
WHOIS is now RDAP, and that changes who sees your lookup
For forty years a WHOIS lookup meant opening a raw TCP connection to port 43 and getting back a block of text in whatever layout that registry preferred. A web page cannot open that connection, so every WHOIS website was a middleman: you typed the domain into their form, their server made the query, and they saw everything anyone was curious about — which is a useful list to have if you sell domains, and some of them do.
RDAP replaced it. The Registration Data Access Protocol returns structured JSON over ordinary HTTPS, and ICANN made it the authoritative source for every generic domain in January 2025. Crucially, the registries serve it with a header that lets any web page read the answer. So this page does not need a server in the middle: your browser asks IANA's list which registry runs the ending, asks that registry, and — for endings like .com where the registry keeps only the basics — follows its link to the registrar for the rest.
The registry and registrar do see the lookup, the same as they would from any tool. We do not, and there is no list of what you looked up anywhere on our side to sell, leak or subpoena.
Why the owner is usually hidden
Until 2018 every domain's owner — name, home address, phone and email — was public, and harvested by spammers within hours of registration. GDPR made publishing an individual's personal data without consent unlawful, and ICANN's response was to have registrars redact it by default, for everyone, rather than try to work out who was European.
What is usually left is the organisation and country, which is often enough: a domain registered to "GitHub, Inc." in the US tells you what you needed to know. Some country registries go further and publish full details for organisations, which is why a .fr lookup can show a complete postal address.
Where details are withheld, the registrar normally publishes a contact form that relays your message to the owner without revealing their address. It is linked in the results when the registry provides one. Separately, some owners use a privacy service that registers the domain in its own name — "Domains By Proxy", "Withheld for Privacy" — and the tool labels those as what they are, rather than presenting the service as the owner.
For legal disputes, law enforcement and trademark claims there is a formal route: ICANN's Registration Data Request Service, through which registrars can disclose redacted data to someone with a legitimate reason. No lookup tool can, and any that claims to is guessing.
Reading the status codes
Status codes come from EPP, the protocol registrars use to talk to registries, and they read like error messages. Most are the opposite. Anything ending in "prohibited" is a lock: "client" locks are set by the registrar and lifted by the owner from their account, and "server" locks are set by the registry itself, usually on request for high-value names. A domain with all six is about as protected as a domain can be.
The ones to take seriously are the holds, which mean the domain has been taken out of DNS and does not resolve — usually unpaid fees, unverified contact details or an abuse complaint — and the end-of-life sequence: auto-renew period (it passed its expiry date and is in a grace window), redemption period (it has been deleted, but the owner can still buy it back) and pending delete (it is about to be released to anyone).
If you own a domain and see "pending transfer" that you did not ask for, contact your registrar straight away — that is what a hijacking looks like from the outside.
Frequently asked questions
Sometimes. Registries publish the registrant's organisation and country for many domains, and some ccTLDs — .fr, for example — publish full contact details for organisations. But personal data for individuals has been withheld by default since GDPR took effect in 2018, and most registrars apply that worldwide rather than working out who is European. When the details are withheld this tool says so, and links the registrar's contact form where one is published: that form forwards your message to the owner without revealing their address to you.
No. Your browser asks IANA which registry runs the ending, then asks that registry, then the registrar, then Cloudflare's public DNS resolver. RDAP servers are expected to let web pages read them, and the major ones we checked all do, so none of those requests touches our server. The exception is a registry that refuses web pages, such as .de's: then the tool offers to ask from our server instead, says so in those words, and only does it if you press the button.
It is the replacement for it. WHOIS is a plain-text protocol from the 1980s that runs on port 43 and returns whatever format each registry felt like. RDAP — the Registration Data Access Protocol — returns structured JSON over HTTPS, and ICANN made it the official source for every generic domain in January 2025, retiring WHOIS for them. People still call the lookup "WHOIS", and so does this page.
Because that registry does not run RDAP. Most generic endings (.com, .org, .dev, .app and hundreds more) and many country endings (.uk, .fr, .au, .io) do, but some, including .jp and .cn, have no RDAP service listed with IANA and offer only port-43 WHOIS. That speaks raw TCP, which no web page can open. Their own websites have a lookup form.
It is the opposite of wrong. That status is the lock that stops anyone moving the domain to another registrar without the owner unlocking it first — the main protection against domain hijacking. Most well-run domains show it. The statuses worth worrying about are the holds (the domain has been taken out of DNS), redemption period (it expired and is about to be lost) and pending delete. Every status is explained in plain words in the results.
They are the registry's own records, read live, so they are as accurate as the registry. The expiry date can move: most domains auto-renew, and a registrar may renew a domain a few weeks before the date shown. If a domain has just been renewed and the registrar has not told the registry yet, the old date can show for a day or two.
Yes — a domain the registry has no record of is shown as not registered, which almost always means you can buy it. A small number of names are reserved by the registry or sold at premium prices and also have no record, so the registrar's own search is the final word. There is a dedicated page for this that explains what to do when the name you want is taken.
Reporting phishing, malware, spam or fraud on the domain. ICANN requires registrars of generic domains to publish one and to act on reports, so it is the right address for a complaint — not the owner, and not the registry. Include the full URL and evidence; a specific report gets acted on far faster than a general one.
No. No sign-up, no ads, no lookup limit worth mentioning on the page, and nothing installed. The whole thing is MIT licensed, and the RDAP parser is tested against real responses captured from Verisign, MarkMonitor, Identity Digital, Nominet and AFNIC, because no two of them fill the format the same way.
API — for scripts and agents
The same lookup behind a free REST endpoint. No API key, no sign-up. Returns the parsed record, the live DNS records and the RDAP URLs it read.
curl 'https://zeal.tools/api/v1/whois?domain=example.com' Add &dns=false to skip DNS, or &raw=true for the untouched RDAP responses. Useful for a cron job that warns you a month before a domain lapses. MCP clients can add https://zeal.tools/mcp and call whois_lookup. Unlike the page, the API does run on our server — that is what an API is — and it can therefore also reach registries that refuse web pages.
One known gap: Identity Digital, which runs .io, .ai, .me, .tools and several hundred other endings, rate-limits the shared network addresses our server sends from, so the API answers 429 for those domains. This page is not affected, because your browser asks the registry itself.
The Zeal Promise
Non-negotiable, on every tool we ship.
- No sign-up — ever
- No watermarks on any output
- No ads near the download button
- Works fully on mobile
- Privacy-first: processing stays in your browser
- Open source (MIT) — audit it, contribute, self-host
- Zero runtime dependencies in tool logic