WHOIS lookup

What the WHOIS lookup shows

A WHOIS lookup asks the registry who holds a domain or an address block. For most domains and all addresses the question goes over RDAP, the structured successor to WHOIS, starting at the rdap.org bootstrap and following its redirect to the registry that owns the suffix; each hop is checked and connected to at the exact address checked, within seven seconds for the whole chain. A domain yields the registrar with its IANA id, the registration handle, the registration, expiry and last-changed dates, the status codes, the nameservers and whether the registry records the delegation as signed. An address yields the block, CIDR, network name, country, type and handle, the dates and the contacts with their roles.

.ir domains and the Persian top-level domain are asked of IRNIC's own WHOIS over port 43, because that registry publishes no RDAP. IRNIC filters its public output down to the nameservers and contact handles: no dates and no status, so those rows are empty rather than guessed, and the handles are not passed on.

How to read the result

For a domain, Expires is the date to act on, and the status list says what the registry allows: clientTransferProhibited is an ordinary registrar lock, serverHold or clientHold means the domain has been taken out of the DNS, redemptionPeriod or pendingDelete mean it has lapsed. The nameservers here are the registry's copy; the NS record tool shows the zone's own and the Delegation check compares them. The DNSSEC row shows Enabled or Disabled; for .ir domains, where IRNIC publishes nothing about it, a dash.

For an address, the block is the allocation it belongs to, Type says whether it is assigned to an end organisation or allocated to a provider, and the contacts table lists up to six contacts with their roles, with the abuse contact the usual reason for looking. Domain not found means either unregistered or that the registry for its suffix publishes no RDAP; .co is such a case, and the page says so. A tampered DNS answer for the RDAP service itself is also named, since from inside Iran it is an ordinary outcome.

When it is useful

A domain has stopped working and nobody remembers who manages it: the registrar, the expiry date and the status codes say whether it lapsed, was locked or put on hold, and where to go. For a .ir domain the nameservers are the only field IRNIC gives, so pair this with the Delegation check.

An address in your logs is attacking or spamming you: WHOIS on the address names the organisation holding the block and its abuse contact's name and handle; the address itself is not shown. Reverse DNS shows what name it announces, and Email blacklist check whether others have already reported it.

Common questions

Why does a WHOIS lookup of a .ir domain show only nameservers?

Because that is all IRNIC publishes in its public output. Dates and status are not given, and the page leaves those rows empty rather than inventing them; the holder's contact handles are deliberately not shown.

Why is the owner's name and email not shown?

Most registries have withheld personal contact details from public WHOIS since 2018, and RDAP carries roles and handles rather than names. For an address block the contacts table shows the organisation and abuse contact, which registries do publish.

The lookup says the domain was not found, but it exists. Why?

The registry for that suffix publishes no RDAP, so there is nothing to ask; .co is a common example. The registry's own WHOIS page is then the only source.