How to do a WHOIS lookup: 3 methods explained

To do a WHOIS lookup, the simplest option is a web tool: type the domain name, press search, and read the result in seconds. You will get the domain's owner details (when not hidden), registrar, registration and expiry dates, and nameservers. This article covers three methods (web tool, command line, and direct RDAP query) so you can pick the one that fits your context.

Method 1: Use a web-based WHOIS tool

For a quick lookup without installing anything:

1. Go to Domain Sentinel and enter the domain name in the search bar. Both github.com and www.github.com work, the tool normalizes the input.
2. Hit Search. Results appear within a second or two.
3. Read the output: registrar, registration and expiry dates, nameservers, and EPP status codes. Domain Sentinel queries RDAP in real time, so the data is not a 24-hour cached snapshot.

Domain Sentinel queries RDAP in real time, results reflect the current state of the registry, not a cached copy that may be hours old.

Two other reputable tools for one-off lookups: ICANN Lookup (lookup.icann.org, the official source) and who.is (broader coverage, includes some historical context). Neither offers continuous monitoring or alerts.

What to look for in the results

Three fields answer most common questions:

• Expiry date, when the domain registration expires. If it is within 30 days, it is at risk of dropping.
• Registrar, the company through which the domain is registered. Useful when you need to file a complaint or initiate a transfer.
• Name servers, usually reveal the DNS provider or hosting infrastructure. Cloudflare nameservers look like ns1.cloudflare.com; AWS Route 53 uses ns-xxx.awsdns-xx.com.

For a full explanation of every field and every EPP status code, see how to read domain registration data.

Method 2: Command-line WHOIS

For users who prefer the terminal, the whois command gives raw output directly in your shell.

On Linux and macOS

Install the whois package if it is not already present:

# Debian/Ubuntu
apt install whois

# macOS (Homebrew)
brew install whois

Then query any domain:

whois github.com

The output is several dozen lines of plain text. The format varies by registry, a .com domain returns Verisign-formatted text, while a .fr domain returns Afnic-formatted text. Expect to scroll.

On Windows

Two options. The simplest is Sysinternals Whois from Microsoft:

whois.exe github.com

Download it from the official Microsoft Sysinternals page. The other option is Windows Subsystem for Linux (WSL), which gives you the same whois command as Linux.

Querying a specific WHOIS server

Sometimes a domain's WHOIS response shows only minimal "thin" data (just the registrar's WHOIS server URL, nothing else). This happens when the registry operates a thin WHOIS model. To get the full record, query the registrar's WHOIS server directly:

whois -h whois.markmonitor.com github.com

The -h flag specifies the server. For .com domains specifically, you can also query Verisign's server:

whois -h whois.verisign-grs.com github.com

Method 3: Direct RDAP query (for developers)

RDAP returns structured JSON, no scraping, no regex, no format guessing. One command:

curl https://rdap.verisign.com/com/v1/domain/github.com | jq .

A trimmed example of what you get back:

{
  "ldhName": "github.com",
  "status": ["client transfer prohibited"],
  "events": [
    { "eventAction": "expiration", "eventDate": "2024-10-09T18:20:50Z" }
  ],
  "nameservers": [
    { "ldhName": "dns1.p08.nsone.net" }
  ]
}

The server URL depends on the TLD. For .com it is rdap.verisign.com; for .org it is rdap.publicinterestregistry.org. To find the right server for any TLD automatically, consult the IANA bootstrap file:

curl https://data.iana.org/rdap/dns.json | jq '.services[] | select(.[0][] == "com")'

For a full comparison of WHOIS and RDAP responses, see WHOIS vs RDAP. For doing this at scale across many domains, see bulk WHOIS lookup.

Common issues and how to fix them

• "No match for domain". The domain is either available or your query hit a server that does not cover that TLD. Try a different tool or query the specific registry server.
• Fields show proxy contact data. The registrant has WHOIS privacy protection enabled. The displayed email and name belong to the registrar's proxy service, not the actual owner. The registrar, dates, and nameservers are still accurate.
• Rate limited. You have sent too many queries too fast. Wait a few minutes. If you need to run many lookups programmatically, add a delay between requests and use RDAP, which handles rate limiting more cleanly.
• Different tools show different data. Tools cache their results for different lengths of time. Some show WHOIS text, others use RDAP. Domain Sentinel always queries RDAP live.

A WHOIS lookup takes under 30 seconds with any web tool. Go to Domain Sentinel, enter any domain, and see the live RDAP result now. If you need to check dozens of domains at once, the bulk WHOIS lookup article covers scripts and APIs for that.