WHOIS Domain Database Lookup

Ultimate Guide to WHOIS Protocols & Registry Systems

Every time a domain name is registered, updated, or transferred, information regarding the registrant, nameserver delegations, and administrative contacts is logged. The directory containing these records is known as the **WHOIS Database**.

The word WHOIS is not an acronym; it simply answers the question "Who is responsible for this domain name?". The registry systems operate under guidelines defined by the Internet Corporation for Assigned Names and Numbers (ICANN) and follow standard TCP transaction protocols.

1. How the WHOIS Query Protocol Works

The traditional WHOIS database service communicates over TCP port 43. When a lookup utility queries a domain:

1. It connects to a root WHOIS server, typically whois.iana.org.
2. The root server answers with basic details and a referral line pointing to the specific registry handling the domain's Top-Level Domain (TLD) (e.g. whois.verisign-grs.com for `.com`).
3. The client disconnects from the root and initiates a second query to the referred registry server to fetch the complete registration data.

2. Understanding WHOIS Privacy & GDPR Redactions

Historically, domains published names, phone numbers, and physical addresses of registrants transparently. However, to prevent database harvesting for email spam and phishing, registrars introduced **WHOIS Privacy Protection** (redacting private details behind proxy addresses).

Furthermore, with the enforcement of the European Union's General Data Protection Regulation (GDPR) in 2018, registries are legally restricted from publishing personal details without explicit consent. Modern WHOIS query results generally show redacted contact fields for individual registrations, showing only technical infrastructure settings like Registrar and Name Server delegations.

3. Understanding ICANN EPP Status Codes

WHOIS records contain status flags governed by the Extensible Provisioning Protocol (EPP). These status codes describe domain states:

• active / ok: The domain is configured correctly and functioning.
• clientTransferProhibited: Tells the registry to reject any domain transfer requests out of the current registrar (acting as a lock against theft).
• clientHold: Suspends the domain resolution. The site will not resolve to any IP address. Often triggered by unpaid billing or legal disputes.
• redemptionPeriod: After a domain expires and is not renewed, it enters this state for ~30 days. The original owner can still reclaim it, but at a premium recovery price.