How to Read a WHOIS / RDAP Record (and What Each Field Means)

Every domain name and every IP address on the internet has a public registration record. For a domain, it tells you who registered it, when it was created, when it expires, and which company hosts the DNS. For an IP, it tells you which organization was assigned the block and how to contact their abuse team.

This guide explains what every field in the record means, what to do with the information, and how to look up any domain or IP in seconds using the Uttir WHOIS / RDAP tool.

WHOIS vs RDAP: what's the difference?

They are the same information, in two different formats. WHOIS is the 1980s protocol: a plain-text response, one field per line, served on port 43. RDAP (Registration Data Access Protocol) is its modern replacement, standardized in 2015: a JSON response over HTTPS, with internationalization, redirects to the right registry, and authentication support.

For the user, both give you the same fields. For developers, RDAP is strictly better because it is JSON and machine-readable. The Uttir tool uses RDAP by default because every modern registry (Verisign for .com, ARIN for North American IPs, etc.) supports it.

How to look up a domain in 10 seconds

1. Open /whois-lookup.
2. Paste a domain like example.com or an IP like 8.8.8.8.
3. Click Look up. The result is the full registration record.

The query goes directly from your browser to the appropriate registry (Verisign for .com, ARIN for IPs, etc.). Uttir never sees the query or the response.

Anatomy of a domain record

Here is the record for example.com, with every field explained. You can compare it to any record you pull yourself with the Uttir tool.

Domain name and handle

The domain name is what you queried (example.com). The handle is a unique internal ID the registry uses to refer to the registration in their database (2336799_DOMAIN_COM-VRSN in this case). The handle is useful for support tickets but is otherwise internal.

Status flags

Status flags tell you what is and is not allowed to be done to the domain. The common ones, in plain English:

• client transfer prohibited — the domain cannot be transferred to another registrar without the owner explicitly unlocking it.
• client update prohibited — the owner has locked the domain so DNS and contact changes require extra authentication.
• client delete prohibited — the domain cannot be deleted accidentally.

For a domain you manage, these are usually all set. For a domain you are investigating, they tell you whether the owner is actively protecting it or whether it is a "parked" or stale registration.

Key dates

Three dates matter for any domain:

• Registered — when the current registration was created. For very old domains, this can be 1995.
• Last changed — when the record was most recently updated. Spikes here often indicate ownership transfers or re-registrations.
• Expires — when the registration lapses if not renewed. Most registrars auto-renew, so this date is mostly informational.

If you are evaluating a domain for purchase, the registered date tells you its age (a factor in SEO), and the expires date tells you the renewal cycle.

Nameservers

Nameservers are the servers that answer DNS queries for the domain. A record like NS1.EXAMPLE.COM tells you the domain uses example.com's own nameservers. Other common patterns:

• Cloudflare: anna.ns.cloudflare.com, karl.ns.cloudflare.com — the domain uses Cloudflare DNS.
• Route 53: ns-123.awsdns-12.com — the domain uses AWS DNS.
• GoDaddy: ns01.domaincontrol.com, ns02.domaincontrol.com — the domain uses GoDaddy's default DNS.

Nameservers are the source of truth for "where is this domain's DNS hosted" — which then tells you a lot about how the site is operated.

Registrar and contacts

The registrar is the company through which the domain was registered (GoDaddy, Namecheap, Google Domains, etc.). The registrant, admin, tech, and billing contacts are the people authorized to manage the domain.

For most domains, contact information is redacted by the registrar due to GDPR. Instead of a real name, you see "REDACTED FOR PRIVACY" or a privacy service like Domains By Proxy. This is normal. It is not the registrar hiding anything nefarious; it is the registry complying with privacy law.

The exception: business and government domains usually have their real contact info visible. usa.gov, for example, shows the real administrative contact.

Abuse contact

The abuse contact is the email address you send abuse reports to (spam, phishing, malware hosted on the domain). It is usually [email protected] or the hosting provider's abuse address. If you need to report a malicious site, this is the email to use.

Anatomy of an IP record

For an IP like 8.8.8.8, the record looks different. Instead of a domain, you get the IP block, the organization that owns it, and the abuse contact for that block.

CIDR and address range

IPs are assigned in blocks, not individually. The CIDR field tells you the block: 8.8.8.0/24 means the block runs from 8.8.8.0 to 8.8.8.255 (256 addresses). The start address and end address spell out the range explicitly.

Use the CIDR Subnet Calculator if you want to understand the block size and how many addresses it contains.

Organization and handle

The organization is the entity that was assigned the block. For 8.8.8.8, it is Google (this is Google's public DNS service). The handle is the registry's internal ID for the allocation (e.g. NET-8-8-8-0-1 at ARIN).

Abuse contact for IPs

Every IP block has an abuse contact. If you are receiving abuse from an IP (e.g. SSH brute-force attempts, spam), the abuse contact is the address to report to. The registry's WHOIS / RDAP record is the source of truth.

What you can do with this information

WHOIS / RDAP is one of the most useful free tools in IT. Common things to do with the data:

• Verify a domain is what it claims to be — if yourbank.com was registered last week and the nameservers change every 48 hours, that is a phishing setup. The Uttir tool is the fastest way to check.
• Find the right abuse contact for a malicious IP — pull the IP record, get the abuse email, send the report with logs.
• Check if a domain is about to expire — useful for security research, due diligence, or watching a competitor's portfolio.
• Diagnose a DNS issue — if your domain is not resolving, the WHOIS record tells you which nameservers it should be using. Cross-check with the DNS Lookup tool to see what they are actually returning.
• Domain research for a purchase — age, nameservers, and current registrar all inform negotiation and SEO strategy.

Privacy and the future of WHOIS

WHOIS started in the 1980s when the internet was small and trust was implicit. Every contact field — name, address, phone, email — was public. After GDPR took effect in 2018, ICANN was forced to allow redaction of personal contact info for individuals, which is why most records you look up now show "REDACTED FOR PRIVACY".

RDAP gives registrars a structured way to control who sees what, with proper access controls. In practice, the public record is still public, but personal contact data is now opt-in to disclose. For legitimate abuse handling, the abuse contact is always available, regardless of privacy settings.

Common questions

Is WHOIS the same as DNS?

No. WHOIS / RDAP is the registration database (who owns it, when it expires, which nameservers serve it). DNS is the live system that translates names to IPs. They overlap (the nameservers in the WHOIS record are the source of truth for DNS), but they are different systems. The DNS Lookup tool queries DNS; the WHOIS tool queries the registration database.

Why are some records incomplete?

Some TLDs have thin WHOIS (less data available publicly), some registrars proxy all contact data, and some registries are still migrating from WHOIS to RDAP. The Uttir tool queries the canonical registry for each TLD, so the data is as complete as the registry provides.

Can I look up my own domain?

Yes, and you should — it is the easiest way to confirm the nameservers and status flags are what you set. Pull your own domain and verify it matches your DNS provider's records.

Is this legal?

Yes. WHOIS / RDAP is public registration data. There is no permission required to query it. The abuse contact exists specifically so that the public can report problems.

Bottom line

WHOIS / RDAP is the public ledger of who owns what on the internet. Three minutes with the Uttir tool will tell you more about a domain than any other single free resource: who registered it, when, which nameservers serve it, who to contact about abuse. Bookmark it.