Read the WHOIS record#

The registry tells you who holds a name, since when and under which locks, and the raw block keeps anything the parser could not fit into a row.

The Registration (WHOIS) section reports who registered a domain, through which registrar, when, and until when. It is the administrative record behind a name rather than anything about the servers it points at.

The parsed WHOIS fields#

Most of a WHOIS response uses field-and-value pairs, and the section shows those as a table. Expect the registrar and its abuse contact, the creation, updated, and expiry dates, the name servers, the domain status codes, and whether DNSSEC is signed.

Three of those fields repay attention:

  • Creation date: tells you how long the name has existed, which is the quickest signal that a domain is newly registered.
  • Status codes: record the locks placed on the domain. A name that shows a transfer prohibition is protected against a move without the registrar's involvement.
  • Name servers: should agree with the NS records in DNS. A disagreement means the delegation is mid-change or misconfigured.

The registry usually redacts the registrant contact details, so their absence is the norm and not a gap in the lookup.

Read the raw registry response#

Registries do not agree on a format. The parser stops as soon as the response stops looking like field-and-value pairs. Everything from that point on goes into the Raw Output / Disclaimer block underneath, and it is typically the legal notice and terms of use.

The Raw Output and Disclaimer block showing the unparsed tail of a WHOIS response

Read the raw block whenever the table misses a field you expected. Registries for country-code domains in particular use layouts the parser does not recognise, and the value is often present in the raw text even when it did not make it into a row. A copy button beside the heading copies the whole response.

When no WHOIS data returns#

The section reads No WHOIS data available when the lookup returned nothing.

One case is worth knowing. The WHOIS lookup runs only when the target you entered contains a dot or a colon. Network Recon skips a bare hostname with neither, and the section completes with no data rather than an error.