How do you read a WHOIS or RDAP lookup result?

Why a lookup result has so many fields

A single WHOIS or RDAP query packs together several unrelated pieces of information: who registered a name, when, through which company, under what restrictions, and which servers answer for it. That breadth is intentional — the original WHOIS protocol (RFC 3912) was designed in an era when “who do I contact about this domain or IP block” was the whole point, and registries have kept extending the same record ever since rather than splitting it into separate lookups. RDAP, the modern replacement, carries the same categories of data but as structured JSON instead of loosely formatted text, which is what lets a tool like AdminKit’s Whois / RDAP lookup parse and label each field reliably instead of guessing at a registry-specific text layout.

The domain fields that matter

Registrar. The company the domain is registered through — not necessarily who runs the website, which can be a different provider entirely. If you don’t recognize the registrar name on a domain you believe you control, that’s worth investigating immediately.

Key dates. Registration date, last-updated date, and expiry date. The expiry date is the one with real consequences: once it passes without renewal, most registries put the domain through a grace period and then release it for anyone to register. Losing a domain this way requires no attack at all, just a missed renewal — see our guide on domain expiry and renewal for the realistic timeline and how to avoid it.

Status codes. These are standardized EPP codes, not free text, so the same code means the same thing regardless of registrar or registry. clientTransferProhibited and clientDeleteProhibited are locks your registrar applies, usually on by default, that block an unauthorized transfer-away or deletion — a protective feature you want to see present, not a warning sign. Status codes starting with server instead of client are set by the registry itself and more often indicate a dispute, a policy action, or a domain already moving through deletion.

Nameservers. The authoritative nameservers listed here are what actually control where the domain’s DNS records (A, MX, TXT and so on) are published. These should match what you configured with your DNS provider; a nameserver you didn’t set is one of the clearest signs of a hijack at the registrar level, distinct from a router-level DNS hijack — see is my router’s DNS hijacked? for that separate failure mode.

The IP fields that matter

An RDAP lookup for an IP address returns different information: the allocated address range it falls within, the organization that range is assigned to, and which regional internet registry (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC) manages it. This is useful for a different kind of question than a domain lookup answers — not “who owns this name” but “who operates this network,” which matters when you’re trying to judge whether traffic from an address looks like a residential ISP, a cloud provider, or something else. AdminKit’s DNS lookup tool complements this by resolving a domain to the IP addresses it currently points at, so you can chain the two lookups together.

Why some data is redacted

Since the EU’s GDPR took effect, most registrars operating globally redact registrant personal data (name, email, phone, postal address) from public WHOIS/RDAP output by default, replacing it with a privacy-proxy service’s contact details or an empty field. This applies most consistently to individual registrants; organizational registrants are more likely to have their business name remain visible, since the legal protection is narrower for a company than a natural person. A redacted result is the normal, expected case today — it does not by itself indicate anything suspicious about the domain.

Reading a result as a quick trust signal

None of this is a substitute for a dedicated security check, but a WHOIS/RDAP result gives you two cheap sanity checks worth running on any domain you’re relying on: does the registrar match who you actually registered through, and are the nameservers the ones you configured. Both are fields an attacker who compromises a registrar account would typically change, so an unexpected value in either is worth investigating before you trust anything else about the domain. For a deeper look at whether a domain’s current DNS configuration has actually been tampered with — rather than just its registration record — pair this with is my router’s DNS hijacked?, which also covers the registrar/provider-level case.