A domain is about to expire and nobody knows which registrar holds it. A migration is planned and you need to see the name servers the registry actually delegates to, not what a DNS panel claims. Or an IP address keeps appearing in your logs and you want to know which network it belongs to. These are registration questions, and they are answered by the registries through WHOIS and RDAP.
The Whois tool looks up a domain or public IP address at the authoritative registry and shows the registrar, key dates, EPP status codes, name servers and DNSSEC state for domains, or the network name, range and country for IP addresses. It uses RDAP wherever the registry offers it, and falls back to classic port-43 WHOIS for top-level domains that have no RDAP service.
What is Whois?
In simple terms
Every domain is registered through a registrar at the registry that runs its top-level domain (Verisign for .com, for example), and every IP address block is allocated by a regional internet registry. WHOIS is the long-standing way to ask those registries "who registered this, when, and through whom?". The answer today is mostly about the registration itself (registrar, dates, status, name servers), because personal owner details are redacted.
Technical background
WHOIS (RFC 3912) is very simple: open a TCP connection to port 43, send the query followed by CRLF, and read plain text until the server closes the connection. There is no fixed format, no standard field names and no way to discover the right server, which is why WHOIS clients carry lists of servers and parsers per registry.
RDAP replaces it with a REST interface over HTTPS that returns JSON (RFC 9082 for queries, RFC 9083 for responses). The responsible server is found through IANA bootstrap registries (RFC 9224): JSON files at data.iana.org that map each TLD, IPv4 block, IPv6 block and AS number range to its RDAP base URL. A domain query is GET <base>/domain/example.com, an IP query GET <base>/ip/<address>.
Domain records carry EPP status codes (RFC 5731, also listed by ICANN), such as client transfer prohibited or server hold, plus events such as registration, expiration and last change, the delegated name servers and whether the delegation is DNSSEC-signed (a DS record exists in the parent zone).
Why use Whois?
- Track expiry. See the registry's expiration date before a domain lapses.
- Find the registrar. Know where to log in, renew, unlock or start a transfer.
- Check delegation. The name servers in the registry record are what the internet uses, regardless of what any DNS panel shows.
- Diagnose holds and locks. Status codes explain why a domain does not resolve (
server hold,client hold) or cannot be transferred. - Confirm DNSSEC at the registry. A signed delegation after a provider change without new DS records breaks resolution.
- Identify IP networks. See which network and registry an address belongs to.
Who should use it?
- Domain administrators and IT teams managing renewals, transfers and DNS provider moves.
- Network and security engineers identifying address blocks from logs or incidents.
- Web agencies taking over a client's domain.
- Support staff checking why a domain stopped resolving.
How Whois works
Your browser sends the domain or IP address to the NetTools.tech server in Latvia. The server validates it (only public IP addresses and syntactically valid public domain names; internationalized names are converted to punycode) and then:
For a domain:
- Loads the IANA DNS bootstrap file (cached for 24 hours) and finds the RDAP base URL for the longest matching suffix of the name, normally the TLD.
- Requests
domain/<name>from that server over HTTPS, following at most 3 redirects and only to HTTPS hostnames, never to raw IP addresses, with a response size limit of 1 MB. - Extracts the domain name, the registrar (the entity with the registrar role), registration, expiration and last-changed dates, status codes (up to 20), name servers (up to 20) and the DNSSEC delegation flag.
If the TLD has no RDAP service (some country-code TLDs, such as .lv), the server switches to classic WHOIS:
- Asks
whois.iana.orgon port 43 for the TLD and reads the registry's WHOIS server from the referral (cached for a day). - Sends the query to that server on port 43, with a 10-second timeout and a 128 KB answer limit. A few registries need their own query syntax to return public fields, and the tool uses it (for example DENIC for .de and JPRS for .jp).
- Parses the text into the same fields. It handles the common
Key: valuelayout and sectioned layouts such as[Domain]/[Holder]/[Nservers]. A holder is only shown when the registry marks it as a legal person or organization; natural persons are never extracted. - Shows the cleaned answer text (registry comment and disclaimer lines removed, up to 8,000 characters) as Full WHOIS answer.
For an IP address, the server picks the regional internet registry from the IANA IPv4 or IPv6 bootstrap file (the most specific matching prefix wins) and requests ip/<address> via RDAP. Registries often redirect to the RIR that actually holds the block; those redirects are followed under the same HTTPS rules. It returns network name, handle, start and end address, allocation type, country and dates. There is no port-43 fallback for IP addresses.
Placeholder dates of 1 January 1970, which some registries publish when the real date is unknown, are dropped rather than shown. The whole request has a 15-second limit.
How to use the NetTools.tech Whois
- Open Whois.
- Enter a registered domain such as
example.com, or a public IP address such as8.8.8.8, in the Domain or IP field. Use the registered domain, not a hostname likewww.example.com. - Press Run Whois, or click one of the example chips (
example.com,8.8.8.8). - Read the key/value table and the source line at the bottom. For classic WHOIS results, expand Full WHOIS answer to read the registry's text.
- Use Copy to copy the output, or Open in terminal to run
/whois example.com(alias/rdap) in the NetTools terminal.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| "RDAP record for …" / "WHOIS record for …" | Which protocol answered | WHOIS means the TLD has no RDAP service |
| Domain | The registered domain as the registry stores it | Matches what you meant to look up |
| Registrar | The registrar of record | Where renewals, locks and transfers are handled |
| Holder | Organization holding the domain (classic WHOIS, organizations only) | Usually absent; personal data is not shown |
| Registered | Registration (creation) date | Very recent dates on unknown domains are a phishing signal |
| Expires | Registry expiration date | Renew well before this date |
| Updated | Last change of the registry record | Recent changes during an incident are worth checking |
| Status | EPP status codes | client transfer prohibited is a normal lock; server hold or client hold stops the domain resolving; pending delete means it is about to be released |
| Name servers | Delegated name servers at the registry | Must match the DNS provider that hosts your zone |
| DNSSEC | Signed or Unsigned delegation | Signed after a provider change without new DS records causes SERVFAIL |
| Network name, Handle | Name and registry ID of an IP network | The handle can be used at the RIR's own lookup |
| Range | First and last address of the network | How large the block is |
| Type | Allocation type as named by the registry | Allocated to an ISP versus assigned to an end user |
| Country | Country code registered for the network | Registration country, not where the address is used |
| Source | RDAP host, or WHOIS server with "(WHOIS, port 43)" | Which registry answered |
Example: checking a domain before a DNS provider move
An agency is about to move example.net to a new DNS provider and wants to see the registry's view first. The values below are illustrative.
RDAP record for example.net
Domain example.net
Registrar Example Registrar, Inc.
Registered 2009-03-14
Expires 2027-03-14
Updated 2026-02-20
Status client delete prohibited, client transfer prohibited, client update prohibited
Name servers ns1.old-dns.example, ns2.old-dns.example
DNSSEC Signed
Source: rdap.example-registry.netWhat this tells the agency:
- The domain renews in March 2027, so there is no expiry risk during the move.
client update prohibitedis a registrar lock; it must be lifted at the registrar before the name servers can be changed.- The delegation is Signed. The DS record must be updated (or removed and re-added) together with the name server change, otherwise validating resolvers will return SERVFAIL.
- After the change, the Name servers row should show the new provider. Use the DNS Propagation Checker to watch resolvers pick up the new delegation.
For an IP address such as 8.8.8.8, the same tool returns an "RDAP record" with network name, handle, range, type, country and dates from the responsible regional registry.
Common use cases
- Checking expiry dates of a domain portfolio before renewals.
- Finding the registrar of an inherited or forgotten domain.
- Confirming registry delegation and DNSSEC during DNS provider changes.
- Investigating why a domain stopped resolving (hold status, expired, removed name servers).
- Assessing a suspicious domain by its registration date and registrar.
- Identifying the network and registry behind an IP from logs.
Troubleshooting
"No registration record found"
The registry has no object for that exact name. Check for a subdomain (www., mail.) and look up the registered domain instead, and check the spelling. A domain that was never registered or has been deleted also returns this.
".xx publishes neither RDAP nor a WHOIS server"
IANA lists no RDAP service and no WHOIS server for that TLD. Use the registry's own website.
"The registry is rate limiting requests"
The RDAP server answered HTTP 429. Registries limit queries per source, and all NetTools.tech lookups come from one server. Try again later.
Name servers differ from what my DNS provider shows
The registry record wins. If the registry lists the old provider's name servers, the change was not made at the registrar, or is still pending. Change the name servers in the registrar's panel.
The domain does not resolve although it is registered
Look at Status for server hold, client hold or pending delete, and at Expires. Then check DNSSEC: a Signed delegation with a broken DS record makes validating resolvers fail. Nslookup will show SERVFAIL in that case.
Dates or registrar missing on a classic WHOIS result
Classic WHOIS text varies by registry and the parser recognizes common field names only. Expand Full WHOIS answer to read the registry's own text.
Common mistakes
- Looking up
www.example.cominstead ofexample.com. - Assuming the registrar is also the DNS host. They are often different companies.
- Reading the IP network's Country as the physical location of a server.
- Treating the absence of owner data as suspicious. Redaction is the norm.
- Relying on the registry expiry date alone when a registrar's auto-renew or grace rules apply.
- Changing name servers while DNSSEC is still signed with the old provider's keys.
Limitations
- Redacted personal data. Registrant names and contacts are not shown, and the tool never extracts personal names.
- Registry data only. RDAP results come from the registry; registrar-level details such as contact forms or reseller data are not fetched.
- Classic WHOIS parsing is best effort. Unusual layouts may leave fields empty; the full text is shown for that reason.
- No port-43 fallback for IP addresses, and AS numbers are covered by the separate ASN Lookup.
- One source address. Registries may rate-limit the NetTools.tech server during busy periods.
- Registration is not ownership proof or location. IP network country and registrant country are what was registered, not where things are.
Security & privacy
The domain or IP address you enter is sent to the NetTools.tech server. RDAP queries go only to servers listed in the IANA bootstrap files, over HTTPS; classic WHOIS queries go to whois.iana.org and the WHOIS server it names for the TLD. Those registries see a query for that name from the NetTools.tech server, not from you. Requests never go to a server you specify, private IP addresses are rejected, and responses are size- and time-limited. Personal registrant data is not extracted. No credentials are needed.
Related tools
- Nslookup – what the delegated name servers actually return; guide: DNS lookup.
- ASN Lookup – registration data for autonomous systems; guide: ASN lookup.
- IP Lookup – network, ASN, abuse contact and location data for an address; guide: IP lookup.
- SSL Checker – the certificate a domain serves; guide: SSL certificate checker.
- Reverse DNS – the hostname of an IP address; guide: Reverse DNS lookup.
- Category overview: DNS & domain tools.
Summary
Whois on NetTools.tech finds the authoritative registry through the IANA bootstrap files and queries it via RDAP, falling back to classic port-43 WHOIS for TLDs without RDAP. For domains it shows registrar, registration, expiry and update dates, EPP status codes, delegated name servers and DNSSEC state; for IP addresses, the network name, range, type and country. Treat the data as the registry's record of the registration, not as proof of who operates a site or where it is.
Frequently asked questions
What is the difference between WHOIS and RDAP?
WHOIS is the original protocol from the 1980s: plain text over TCP port 43, with a different layout at every registry. RDAP (Registration Data Access Protocol) is its standardized successor, served over HTTPS with structured JSON, and is what this tool uses whenever the registry offers it.
Why is the domain owner's name hidden?
Most registries and registrars redact personal registrant data for privacy reasons, for example under the GDPR. Registrar, dates, status and name servers usually remain visible, and the tool deliberately shows a holder only when a classic WHOIS registry marks it as an organization.
How do I find out when a domain expires?
Look at the Expires row, taken from the registry's expiration event. Note that the date is the registry's, and a registrar's renewal or grace-period rules can differ, so confirm details with the registrar before relying on it.
Why does a subdomain lookup fail?
Registries hold records for registered domains such as example.com, not for hostnames like www.example.com. Look up the registered domain instead; for hostnames use Nslookup.
What does clientTransferProhibited mean?
It is an EPP status code (shown by RDAP as client transfer prohibited) set by the registrar that blocks transfers to another registrar, usually as protection against hijacking. Codes starting with server are set by the registry, and codes starting with client by the registrar.
Which TLDs work if they have no RDAP?
If IANA lists no RDAP service for a TLD, the tool asks IANA's WHOIS server for that TLD's registry WHOIS server and queries it on port 43. The result is parsed into the same fields and the full text answer is shown as well.
Can I look up an IP address?
Yes, public IPv4 and IPv6 addresses are looked up via RDAP at the responsible regional internet registry, such as RIPE NCC, ARIN or APNIC. The result shows the network name, handle, address range, allocation type, country and registration dates.