What a WHOIS lookup shows today
A WHOIS lookup returns the public registration record of a domain name. The fields you can rely on are the sponsoring registrar and its IANA ID, the creation, last update and expiry dates, the EPP status codes, the delegated nameservers and whether the domain is signed with DNSSEC. Most records also carry an abuse contact for the registrar.
What it generally no longer shows is the name, address, phone number and email of the person behind the domain. That is a deliberate policy outcome, not a fault of the tool, and it applies to every WHOIS service that queries the same sources.
Why registrant details are redacted
Until May 2018 most generic top-level domains published full registrant contact data. When the GDPR took effect, ICANN adopted a Temporary Specification that allowed registries and registrars to withhold personal data from public output, and the replacement Registration Data Policy keeps that approach. Many registrars apply redaction worldwide because they cannot reliably tell which registrants are covered by which privacy law.
In practice you will see values such as REDACTED FOR PRIVACY, or the details of a privacy or proxy service. Organisations sometimes opt in to publishing their name. If you have a legitimate need to reach a registrant, for example in a trademark or abuse case, use the registrar's contact form or abuse address. Registrars are required to provide a way to relay messages and to consider disclosure requests.
RDAP: the protocol behind this lookup
The original WHOIS protocol sends free text over TCP port 43. Every registry formatted its output differently, there was no standard error handling, no internationalisation and no encryption. RDAP, the Registration Data Access Protocol, replaces it with JSON over HTTPS, defined fields, standard status values and a bootstrap registry published by IANA that tells clients which server is authoritative for each top-level domain.
ICANN has required gTLD registries and registrars to run RDAP since 2019, and the contractual obligation to operate port 43 WHOIS for gTLDs ended in January 2025. OrbitProbe queries RDAP directly. Some country-code domains still do not offer a public RDAP service; for those the tool reports the domain as unsupported instead of scraping a web form.
How to read domain status codes
Status codes come from EPP, the protocol registrars use to talk to registries. Codes beginning with client are set by the registrar, codes beginning with server by the registry. clientTransferProhibited is the normal transfer lock and is a good sign on a domain you own. clientHold or serverHold removes the domain from the zone, so it stops resolving; this is typical for unpaid renewals, unverified contact data or disputes.
After expiry, a gTLD domain usually passes through autoRenewPeriod, then redemptionPeriod, where the previous registrant can still restore it for a fee, and finally pendingDelete, after which it is released for registration. A domain with the status ok or active simply has no restrictions set.
Expiry date: registry versus registrar
The expiry date in the registry record is not always the date your registrar will act on. Many registries auto-renew a domain for one year at the moment it expires and give the registrar a grace period to cancel that renewal if the customer never pays. During that window the public record may show an expiry a year in the future while the registrar has already suspended the domain.
Some records also include a separate registrar registration expiration date. When the two differ, the registrar's billing date is the one that decides whether your domain stays online. For domains you depend on, renew early and do not read a far-off registry date as proof that everything is paid.