How to run a WHOIS lookup

What a WHOIS record tells you

WHOIS is the internet's original phone book for domains. For any registered domain you can usually see:

• Registrar — the company the domain is registered through (GoDaddy, Cloudflare, Namecheap, and so on).
• Dates — when the domain was created, last updated, and when it expires.
• Nameservers — the DNS servers the domain delegates to, which tells you where its DNS is actually managed.
• Statuses — flags like clientTransferProhibited that describe locks and holds on the domain.
• Registrant — the owner. Since GDPR, this is redacted for most domains, so expect "REDACTED FOR PRIVACY" rather than a name and address.

The two things worth checking on any domain you own are the expiry date(an expired domain takes your website and email down with it) and thenameservers (if they point somewhere you don't recognize, your DNS lives in an account you may not control).

Method 1: a free web lookup

1. Go to ICANN Lookup — ICANN runs the domain system, so this is the closest thing to a source of truth.
2. Type the domain (just example.com, no https:// and no www).
3. Read the registration data: registrar, dates, nameservers, and statuses are all on the first screen.

Most registrars offer the same lookup on their own sites, and the data comes from the same registries. If two tools disagree, trust ICANN's — the others are sometimes cached or incomplete.

Method 2: the command line

On macOS and most Linux systems, whois is either built in or one package install away. On Windows it is a free download from Microsoft's Sysinternals suite. Run:

whois example.com

The fields that matter in the output:

Registrar: Cloudflare, Inc.
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2026-08-13T04:00:00Z
Name Server: NS1.EXAMPLE.COM
Name Server: NS2.EXAMPLE.COM
Domain Status: clientTransferProhibited

• Registry Expiry Date — count the days left. Under 30 days on a domain you care about means renew today, not soon.
• Domain Status — ok and clientTransferProhibited are healthy (the second just means the transfer lock is on, which you want). clientHold or serverHold means the domain is suspended. redemptionPeriod or pendingDelete means it expired and is on its way to being released for anyone to register.
• Name Server — these should match the provider where you edit DNS records. A mismatch is the usual cause of "I changed my DNS and nothing happened."

Problems a WHOIS lookup catches early

• Silent expiry. The number one cause of "our website and email just stopped" for small businesses. Domains feel permanent; they are rentals.
• The domain is in someone else's account. A web designer or ex-employee registered it years ago. The WHOIS record won't name them anymore, but the registrar field tells you where to start the recovery conversation.
• Privacy is off. Look up your own domain. If your home address and phone number are visible instead of a redaction notice, turn on WHOIS privacy at your registrar — it is free at most of them now.

Speaking of privacy: a WHOIS lookup tells you about a domain, but it doesn't keep your own traffic private on networks you don't control. For that I use a VPN — NordVPN is the one I run myself, and there's a deal linked on thehomepage if you want it.

The automated way

If you are checking one domain once, the methods above are all you need. If you are checking many domains, or you want an agent or a script to do it, that is what the PapaCasper MCP Toolbelt is for. Its whois_lookup tool returns the record as parsed JSON — registrar, dates, nameservers, statuses, and the days remaining before expiry already computed — for $0.01 per call, no signup or API key. The domain_health_check tool ($0.05) adds DNS and mail-record health on top of the same lookup.