Who owns a domain? WHOIS and RDAP lookups explained

• WHOIS is the old plain-text protocol; RDAP is its structured, JSON-based successor. For generic extensions such as .com, RDAP has been the authoritative source since January 2025.
• Since the GDPR took effect in May 2018, the owner's name, address and e-mail are redacted in most records.
• The registrar, the dates, the name servers and the status codes stay public, and they are usually what you need.
• An expired .com is not released at once: it first passes through a grace period, a 30-day redemption period and a 5-day pending delete.

WHOIS (port 43) dates back to the early internet: every registry returns free-form text in its own layout, with no standard character set and no way to tell who is asking.

RDAP (Registration Data Access Protocol) answers over HTTPS with JSON in a fixed structure, supports international characters and lets registries show different detail to different users. ICANN made RDAP mandatory for generic-TLD registries and registrars and, from 28 January 2025, no longer requires them to run WHOIS. Many country-code extensions still offer WHOIS only.

whoistool asks RDAP first and falls back to WHOIS when an extension has no RDAP service, so you get the same view either way.

Under the GDPR, a person's name, address, phone number and e-mail are personal data. Since May 2018 generic-TLD registries and registrars redact them by default (you will see entries such as REDACTED FOR PRIVACY), and many country registries publish no owner data at all.

On top of that, many registrars offer privacy or proxy services that show the service's details instead of the owner's. A hidden owner is therefore normal, not a sign that something is wrong.

• Use the contact form or anonymised e-mail address that the registrar shows in the record; messages are forwarded to the owner.
• Look at the website on the domain: a contact page, an imprint or the mail provider in its MX/SPF records often lead to the right person.
• For spam, phishing or malware, write to the registrar's abuse contact shown in the record; registrars are required to handle abuse reports.
• For a legitimate legal need, you can request the redacted data from the registrar or, for participating generic-TLD registrars, through ICANN's Registration Data Request Service (RDRS).
• If the domain infringes your trademark, the UDRP procedure lets you claim it without suing the owner.

For .com and most generic extensions the usual path is: expiry date → registrar grace period (in which the owner can renew at the normal price, up to about 45 days) → redemption period (30 days) → pending delete (5 days) → released. The whole cycle often takes 70–80 days, and valuable names are usually caught by drop-catching services the moment they are released.

Country-code extensions set their own rules, so the timeline can be quite different. To hear about every step, add the domain to Watch: you get an e-mail or Telegram message when its status, expiry date or availability changes.

• Type a domain, a URL or an IP address into the search box. Subdomains and paths are removed automatically.
• The result shows the RDAP/WHOIS record, DNS records, the SSL certificate and the hosting provider side by side.
• Domain age compares the creation and expiry dates of up to 10 domains at once.