Every domain name has a paper trail. Who registered it, through which company, when, when it expires, and where it currently points — all of that is recorded and, for the most part, public. If you audit a company's domains, chase down a phishing site, protect a trademark, or just want to know why a domain isn't resolving, that record is the first place to look.
The WHOIS lookup on ServerRecords pulls that record for any domain and lays it out in plain terms: the registrar, the creation, expiry, and last-updated dates, the authoritative nameservers, and the domain's status codes with an explanation of what each one means. Behind the scenes it queries RDAP, not the old text-based WHOIS protocol — which is worth understanding, because it explains why the record looks the way it does today.
WHOIS, RDAP, and why the difference matters
The original system was simple to the point of being fragile. A WHOIS query opened a connection on TCP port 43 to a server run by the registry or registrar, and got back a blob of text. There was no agreed format — every registrar laid it out differently — no real support for internationalized names, and no access controls to speak of. You parsed it by eye or with brittle regular expressions, and hoped the next registrar formatted things the same way. They rarely did.
That history also gave us the thin-versus-thick split. Some registries (historically .com and .net) kept only minimal data centrally — the domain, its registrar, the dates, the nameservers — and you had to query the registrar's own server for anything more. Others (.org, most country-code TLDs) held the full set of details in one place. It meant a single lookup might tell you everything or almost nothing, depending on the extension.
RDAP, the Registration Data Access Protocol, was ICANN's fix. It returns structured JSON over HTTPS with a consistent schema, proper support for international names, and a foundation for access control. The ServerRecords tool speaks RDAP directly and parses the response into a readable summary — so what you see is the modern, standardized version of the record rather than a screen of unformatted port-43 text.
The lifecycle dates
Three dates tell you most of the story:
- Creation date — when the domain was first registered. A domain that's been around fifteen years reads very differently from one registered this morning.
- Expiry date — when the current registration lapses if nobody renews it. The tool flags this when it's coming up soon, because a missed renewal on a domain that matters is a genuinely bad day.
- Last updated — the most recent administrative change. A sudden update on an otherwise quiet domain is a useful signal that something changed hands or got reconfigured.
EPP status codes
The status codes are the part people skip and shouldn't. These are EPP (Extensible Provisioning Protocol) codes, and they describe what state the domain is in and what actions are currently locked or blocked. A domain can carry several at once. The tool shows them with plain-language notes, but here are the ones you'll run into most:
| Status code | What it means |
|---|---|
ok |
Active, no locks applied. Note that ok can also mean nobody has bothered to lock the domain against transfer — not always reassuring. |
clientTransferProhibited |
The registrar has locked the domain against transfer to another registrar. Extremely common and generally a good thing. |
serverTransferProhibited |
Same lock, but applied by the registry rather than the registrar. |
clientHold |
The domain is suspended in DNS and will not resolve — nothing loads. Often a billing or abuse issue. |
serverHold |
The same suspension, imposed at the registry level. |
clientDeleteProhibited |
Deletion is blocked, guarding against accidental or malicious removal. |
redemptionPeriod |
The domain has expired and is in a grace window before deletion — recoverable, but usually only by the original owner and often for a fee. |
autoRenewPeriod |
A short window just after expiry during which the registrar may still auto-renew. |
If a domain won't load and you're staring at a clientHold or serverHold, you've found your answer — the DNS delegation is intentionally switched off, and no amount of checking your own records will change that.
Nameservers and registrar
The record also names the authoritative nameservers — the ones the registry has delegated the domain to, like ns1.cloudflare.com. This is worth a sanity check: if the nameservers in the registration record don't match the ones in the DNS dashboard you've been editing, your changes are being published to a delegation nobody is actually asking. That mismatch is behind a surprising share of "I updated the record hours ago and nothing changed" complaints. When you need to look at the delegation on its own, the NS record lookup shows you exactly which nameservers a domain is delegated to.
Alongside that sits the registrar — the ICANN-accredited company that manages the domain, names like MarkMonitor, Gandi, Tucows, or Cloudflare. Practically speaking, that's the login you need if you want to renew, unlock, or move the domain.
What you won't see: the owner's contact details
Older WHOIS records used to include the registrant's name, postal address, phone number, and email right there in the output. That changed with GDPR in May 2018. ICANN's Temporary Specification pushed registrars to redact personal registrant data, so today those fields typically come back as REDACTED FOR PRIVACY or point at a privacy-proxy service. Non-personal details for organizations — a company name on a corporate domain, say — often remain visible, but individual contact information generally does not.
This is background worth knowing rather than a feature to look for: RDAP omits that redacted personal data by design, so the ServerRecords tool doesn't display registrant contact details. If you came expecting to find out who personally owns a domain, that era is largely over, and it's a legal change rather than a limitation of any one tool.
Where this actually earns its keep
A few situations where the record pays off:
- Catching an expiry before it catches you. When a core domain lapses, its nameservers get pulled, and the website, APIs, portals, and email can all go dark at once. Glancing at expiry dates across your domains is cheap insurance.
- Sizing up a suspicious domain. A convincing-looking domain registered two hours ago through a bargain registrar and already sitting on
clientHoldtells you plenty. Recent update timestamps can also reveal when someone quietly took over an abandoned name. - Due diligence before a deal. Anyone acquiring a business wants to confirm the domains are actually owned by the seller, check the transfer locks, and make sure nothing lapses mid-handover.
If you want a broader read on a domain rather than just its registration, the Domain Health Check rolls the registration record together with DNS and mail configuration. And when your question is really about an IP address rather than a domain name — who owns a block, which network it sits in — the IP ownership / ASN lookup answers that instead.
The short version
A registration lookup answers four practical questions fast: who manages the domain, when it expires, where it's delegated, and whether anything is locked or suspended. Read the status codes rather than skimming past them, cross-check the nameservers against the DNS you're actually editing, and don't expect the owner's phone number — that hasn't been public since 2018. Everything else is right there in the record.