How to Read a WHOIS Record, Field by Field
A WHOIS lookup returns more than a name and a date — each field tells you something specific about a domain's situation. Here is what to look at, in the order experienced buyers check it:
| Field | What it tells you | What to watch for |
|---|---|---|
| Registrar | The company managing the registration (GoDaddy, Namecheap, MarkMonitor…) | Corporate registrars like MarkMonitor or CSC usually mean a brand-owned domain that is not for sale |
| Creation date | When the domain was first registered | Age matters: a 1998 registration signals an established domain; check archive.org for its history |
| Expiry date | When the current registration term ends | A domain 2–9 years pre-paid signals a committed owner; one expiring next month may be worth monitoring |
| Updated date | Last change at the registrar | A very recent update can indicate a transfer, sale, or ownership change in progress |
| Status codes | EPP flags controlling what can happen to the domain | See the status code guide below — these are the most misread part of WHOIS |
| Nameservers | Where the domain's DNS is hosted | Parking nameservers (sedoparking, bodis, afternic) usually mean the domain is for sale |
EPP Status Codes Decoded
Status codes confuse more people than any other WHOIS field, yet they answer the question buyers care about most: can this domain move?
clientTransferProhibited— the registrar has locked transfers. This is a normal security default, not a red flag.clientHold/serverHold— the domain has been suspended and removed from DNS. Often unpaid renewal or a policy violation. Treat with caution.redemptionPeriod— the registration lapsed and the owner has roughly 30 days to restore it at a penalty fee. The domain may drop soon.pendingDelete— restoration is no longer possible; the domain will be released within about 5 days. Drop-catchers are already watching it.ok / active— no restrictions. Nothing notable is happening to the domain.
WHOIS vs. RDAP: What Changed
The WHOIS protocol dates back to 1982 — before the web itself — and returns free-form text that every registry formats differently. RDAP (Registration Data Access Protocol), mandated by ICANN for gTLDs since 2019, replaces it with structured JSON over HTTPS: consistent fields, proper internationalization, and tiered access to redacted data. This tool queries RDAP first, which is why results are consistent across registries, and falls back to a commercial WHOIS API when a registry's RDAP service is incomplete.
Why "Privacy Protected" Doesn't End Your Research
Since GDPR took effect in May 2018, most registrars redact personal contact details by default, so the registrant often shows as "Privacy Protected" or "Redacted for Privacy." That does not make ownership research impossible. Practical next steps: check the domain's historical WHOIS through a paid service (records from before 2018 are often unredacted), look at the site itself and its imprint or terms pages, search the nameservers for other domains by the same owner, or simply submit the registrar's mandatory contact-relay form — legitimate owners of for-sale domains usually respond.