WHOIS lookup: 4 simple fields for a safe decision

A WHOIS lookup is useful when you need to know who registered a domain, when it expires or which nameservers answer for it. The raw response is a block of text with different formats for every registry. Parsing it yourself is a maintenance job.

The WHOIS lookup endpoint queries the registry and returns parsed fields plus the raw text.

curl "https://api2.globus.studio/v2/whois?query=example.com&format=json"

What a WHOIS lookup returns

Fields vary by registry. A domain response can include the registrar, creation date, expiry date, status flags and nameservers. An IP range response can include the network, the organisation and the country. Missing fields are omitted rather than filled with a guess.

The raw text is included for cases where the parser does not recognise a field. Keep it for support, not for logic.

Dates and status

Creation and expiry dates are strings in registry format. Parse them with a date library and store them as dates. Status flags are not consistent across registries. A domain can be on hold, pending transfer or client transfer prohibited. Treat unknown flags as unknown.

Privacy and redaction

Many registries redact registrant data for privacy. You will see a proxy service or a redacted string. That is the correct answer. Do not try to work around it.

Rate limits and terms

WHOIS servers limit queries and some registries restrict automated use. The endpoint caches responses for an hour to reduce the load. Do not use it to build a copy of the registry. Use the data for a specific check, such as expiry monitoring or abuse investigation.

A practical use

A WHOIS lookup fits a few narrow jobs. A security team can watch the expiry date of its own domains. A support tool can show the registrar when a customer cannot change nameservers. An abuse team can check the network owner for an IP range.

$data = json_decode(file_get_contents(
    'https://api2.globus.studio/v2/whois?query=' . urlencode($domain) . '&format=json'
), true);
if (!empty($data['expiry_date'])) {
    $days = (strtotime($data['expiry_date']) - time()) / 86400;
    if ($days < 30) {
        echo "Renew soon: $domain";
    }
}

Limits

A WHOIS lookup waits for the registry, so it is slower than a local lookup. The response size is capped. Some registries answer in a format that needs a fallback to the raw text. Read the endpoint documentation for parameters and examples.

Every registry formats dates differently

One registry returns an ISO date. Another returns a local format with a month name. A parser that works for one domain can fail for another. The endpoint returns the fields it recognises and keeps the raw text for the rest. Store the parsed value and the raw value together.

For expiry monitoring, parse the date once and store a timestamp. If the parse fails, alert on the raw text instead of guessing. A wrong expiry date is worse than a missing one.

Redaction and proxies

Registrant data is often redacted. A privacy proxy may appear as the registrant, with its own country and email. That is not the domain owner. Use the field for contact routing only when the registry says it is the registrant, not a proxy.

Caching and repeated checks

Registry data changes slowly. Cache the response for an hour and store the parsed fields you need. A monitoring job that checks a thousand domains does not need a fresh query for each one on every run. Spread the checks over the day and keep the last known good value.

WHOIS lookup without parsing registry text