Definition
WHOIS is the public lookup protocol that returns ownership and registration details for an internet domain: the registrant, the registrar, the registration and expiry dates, the name servers, and historically a contact email. Queries run over a simple text protocol, traditionally TCP port 43, and return a plain-text record rather than structured data. WHOIS dates back to the early ARPANET and remains the standard way to ask who owns a domain, though its output format varies by registry and can be inconsistent between TLDs. Modern privacy rules (GDPR, ICANN policy) have redacted most personal data from public WHOIS since 2018, so individual registrant names and emails are usually replaced with a privacy-proxy contact rather than shown outright. Registrars (Namecheap, Cloudflare, Porkbun, Gandi) handle WHOIS records on registrants' behalf, updating them automatically at registration and renewal. RDAP is gradually replacing WHOIS as the more structured, permission-aware successor.
How it works
WHOIS queries go to the registry responsible for the TLD (Verisign for .com, ICANN-accredited registries for others) and return a text record. Modern alternatives (RDAP, the Registration Data Access Protocol) provide structured JSON output and better privacy handling.
Why it matters
WHOIS is the canonical record of who controls a domain and when it expires. Letting a domain expire because the WHOIS contact email was outdated is the classic loss-of-website disaster. Keeping WHOIS contact data current matters; using a privacy-proxy service is fine and now common.