Looking up domain WHOIS records

What is WHOIS Lookup and Why Do You Need It?

WHOIS lookup is a process through which you retrieve registered information for a domain from the central database of registrars. This information includes the owner's name, registration date, expiration date, nameservers, and domain lock status. Whenever you want to purchase, renew, or even research the ownership of a domain, you will need this data.

For website administrators, WHOIS lookup is an essential tool. Suppose you are buying a domain from someone; without a thorough WHOIS check, you might purchase a domain that is on the verge of expiration or whose real owner is not that person. Also, if you encounter DNS issues, the first step is to check the domain's nameservers via WHOIS to ensure the settings have been configured correctly.

In this article, you will practically learn how to perform a WHOIS lookup, interpret the output, and recognize the most common errors. It doesn't matter if you are a Windows or Linux user; we cover various methods.

Methods for Performing WHOIS Lookup

There are three main methods for WHOIS lookup: using online websites, command line, and programming APIs. Each has its own advantages and disadvantages.

1. Online Tools and Websites

The simplest method is using WHOIS lookup websites. Sites like whois.icann.org, who.is, and whois.domaintools.com have graphical user interfaces and are suitable for non-technical users. Simply enter the domain name and view the result.

The advantage of this method is speed and simplicity, but it has limitations: they usually display information in a summarized form and may not show some technical fields like DNSSEC or the full Status. For deeper analysis, the command line method is better.

2. whois Command in Linux and macOS

On Unix-based operating systems, the whois tool is not installed by default and you need to install it. On Debian/Ubuntu:

sudo apt update
sudo apt install whois

On CentOS/RHEL:

sudo yum install whois

After installation, a WHOIS lookup is performed with the following command:

whois example.com

The output includes several sections. The first section usually contains registrar information and the second section contains registrant (owner) information. For Iranian domains with the .ir extension, the output is provided by the IRNIC registration center and has a different structure.

3. WHOIS Lookup in Windows

Windows does not have a built-in whois command, but you can use PowerShell and connect to a WHOIS server. A simple method is using telnet:

telnet whois.verisign-grs.com 43

Then type the domain name and press Enter. Another method is installing third-party tools like Sysinternals Whois from Microsoft, which is available for free download.

Interpreting WHOIS Lookup Output

The WHOIS output may seem complex at first glance, but by recognizing key fields, it can be easily analyzed. In the following, we examine the most important sections.

Registrant Information

This section includes the name, email, address, and phone number of the person or organization that registered the domain. Due to GDPR regulations, many registrars hide personal information and display proxy emails instead. For .ir domains, the owner's information is usually displayed in full, unless a privacy service has been activated.

Important note: If you intend to purchase a domain, make sure the owner's email is active. You will need email verification to transfer the domain.

Expiration Date and Domain Status

The Expiry Date or Expiration Date field shows the exact expiration date of the domain. This date is usually displayed in the format 2025-08-15T00:00:00Z. If the domain has expired, its status is displayed as REDEMPTIONPERIOD or PENDINGDELETE.

Common domain statuses include:

• ACTIVE: The domain is active and usable.
• CLIENTHOLD: The domain is locked by the registrar (usually due to non-payment).
• CLIENTTRANSFERPROHIBITED: Transferring the domain to another registrar is prohibited.
• AUTORENEWPERIOD: The domain is in its auto-renewal period.

Nameservers

The Name Server field shows the list of DNS servers that the domain points to. There are usually two or more nameservers. If this field is empty or shows the value NS1.DNS.COM, it means the domain has not yet been connected to DNS servers, and your website will encounter the DNS_PROBE_FINISHED_NXDOMAIN error.

To change nameservers, you need to take action from the domain registrar's panel. After the change, it may take 24 to 48 hours for the changes to propagate across the internet.

Domain Lock Status

The lock status is one of the most important security fields. If the domain is locked, transferring it to another registrar or changing owner information is not possible without additional verification. This lock prevents domain theft. In WHOIS output, this status is displayed with codes like CLIENTTRANSFERPROHIBITED or SERVERHOLD.

Security recommendation: Always keep your domains locked. Only unlock them when you intend to transfer the domain, and re-enable the lock after the process is complete.

Common WHOIS Lookup Errors and Solutions

You may encounter errors during a WHOIS lookup. In the following, we examine the most common ones.

"No match for domain" Error

This error means that the domain in question is not registered and is available for purchase. If you are sure the domain is registered, you have probably made a typo in the domain name or used the wrong extension. For example, example.com is different from example.net.

"WHOIS Server: Not available" Error

This error usually occurs due to access restrictions to the WHOIS server. Some registrars block frequent requests. Solution: wait a few minutes and try again, or use another online tool.

Owner Information is Hidden

If the owner's information is displayed as REDACTED FOR PRIVACY, it means a privacy service is active. In this case, to contact the owner, you must use the contact form available on the registrar's website. For .ir domains, this situation is less common but can occur.

WHOIS Lookup for Iranian Domains

Domains with the .ir extension are managed by the IRNIC registration center. WHOIS lookup for these domains is performed through the website whois.nic.ir or the following command:

whois example.ir

The output for Iranian domains includes fields like domain, expire-date, nserver, and holder. Important note: For .ir domains, the owner's information is displayed in full, and the privacy service is not active by default. Therefore, if you are concerned about privacy, you must ask the registrar to enable the privacy option.

Also, IRNIC regulations do not allow transferring .ir domains to another registrar. The only way to change registrars is to cancel the registration and re-register, which carries the risk of losing the domain. Therefore, before registering an Iranian domain, choose the registrar carefully.

Automating WHOIS Lookup with Scripts

If you need to perform WHOIS lookups for multiple domains, you can write a simple script. Here is an example in Bash that extracts the expiration date:

#!/bin/bash
DOMAIN="example.com"
EXPIRY=$(whois "$DOMAIN" | grep -i "Expiry Date" | head -1 | awk '{print $NF}')
echo "Domain: $DOMAIN"
echo "Expiry Date: $EXPIRY"

For .ir domains, the date pattern is different, and you should use expire-date:

EXPIRY=$(whois "$DOMAIN" | grep -i "expire-date" | awk '{print $2}')

These scripts are very useful for automated domain monitoring. You can run them with cron to send you an email alert before expiration.

Security Tips and Best Practices

WHOIS lookup is not only crucial for checking other people's domains but also for managing your own domains. Here are some practical recommendations:

• Perform a WHOIS lookup on your domains once a month and check the expiration date. Late renewal can lead to losing the domain.
• Always keep your contact information up to date. If your email changes and you no longer have access to the old email, you may not be able to renew the domain.
• Keep the domain lock enabled and only disable it temporarily during a transfer.
• If you are buying a domain, always perform a WHOIS lookup before payment and make sure the expiration date is at least 6 months away.
• For sensitive domains, use DNSSEC to prevent DNS Spoofing attacks.

If you are looking for a stable infrastructure for your domains, ServerNet offers domain registration and management services along with hosting, which can simplify managing these processes.

Conclusion

WHOIS lookup is an essential skill for every website administrator. Using online methods, command line, or automated scripts, you can obtain critical information about ownership, expiration date, nameservers, and domain lock status. This information helps you avoid purchasing problematic domains, maintain the security of your own domains, and prevent unexpected outages.

Remember that WHOIS output may vary depending on the domain extension and registrar. For international domains, the information is usually more summarized, while Iranian domains provide more complete information. With practice and regular use of this tool, you will quickly become proficient.