WHOIS is one of the internet's oldest services: a public directory of who registered a domain. It was designed in an era when the network was small and accountability mattered more than privacy. Both of those assumptions have since changed, and the records look very different as a result.
What a record contains
A WHOIS response covers several distinct things, and it is worth separating them because they have different reliability.
- Registration, expiry, and last-updated dates.
- The registrar — the company through which the domain was bought.
- Nameservers, which reveal where DNS is hosted.
- Status codes such as clientTransferProhibited.
- Registrant, administrative, and technical contact details.
The dates and nameservers come from registry systems and are reliable. The contact details are the part that has largely disappeared.
Why the owner is usually hidden
Two separate developments emptied out the contact fields. The first is commercial: registrars began offering privacy protection, substituting proxy details for the registrant's own. It is now bundled free with most registrations and enabled by default, so a redacted record usually reflects a default setting rather than any deliberate concealment.
The second is legal. GDPR made publishing personal data of EU residents in an open directory untenable, and rather than maintain separate behaviour by jurisdiction, ICANN adopted broad redaction. Most records now show a registrar-provided contact form instead of an email address.
One useful distinction survives: many organisations do not qualify for redaction the way individuals do, so corporate domains more often still show real registrant details.
What remains genuinely useful
Even fully redacted records answer practical questions.
- Creation date. A domain registered three weeks ago and claiming twenty years of trading is worth scepticism — this is one of the fastest checks against a fraudulent shop.
- Expiry date. Useful for your own portfolio, and for spotting a domain about to lapse.
- Registrar and nameservers. Tells you where infrastructure lives, which matters when planning a migration or diagnosing an outage.
- Status codes. clientTransferProhibited indicates a transfer lock; pendingDelete means the domain is heading back to the available pool.
WHOIS is not a live protocol in your browser
Worth knowing technically: WHOIS runs over a raw TCP connection on port 43, which browsers cannot open. Any web-based WHOIS tool necessarily performs the query server-side on your behalf, meaning the domain you look up is sent to that service. That is unavoidable rather than a design choice.