Pull up a WHOIS record for the first time and it can look like a wall of cryptic fields and codes with names like clientTransferProhibited. But every line tells you something useful once you know what you're looking at — and a couple of those fields can explain exactly why a domain is behaving strangely or has gone offline. Here's how to read a WHOIS record field by field, including the all-important status codes that most people ignore.

The main parts of a WHOIS record

A WHOIS record is organized into a few sections: who registered the domain and through whom (registrant and registrar), the key dates, the nameservers, and the status codes. If you're not sure how to pull one up in the first place, our guide to checking a domain's registration covers running the lookup — this article is about reading what comes back.

Registrar and registrant

Two "who" fields sit near the top:

  • Registrar — the company the domain was registered through (like GoDaddy, Namecheap, or Cloudflare). You'll often also see a Registrar IANA ID and an abuse contact email for reporting problems.
  • Registrant — the actual owner. In most modern records this is redacted or replaced with a privacy service, thanks to privacy regulations like GDPR. That's normal — the registrar and technical details remain visible even when the owner's identity is hidden.

The key dates

Three dates tell the domain's story, and they're some of the most useful fields:

  • Creation / Registered date — when the domain was first registered. A very recent date on an unfamiliar site can be a red flag for scams.
  • Updated date — when the record last changed (a transfer, a nameserver change, a renewal).
  • Expiry / Expiration date — when the registration lapses unless renewed. This is the field to watch: a lapsed domain takes a site and its email offline. Our guide on what happens when a domain expires explains the timeline that follows.

Nameservers

The record lists the domain's nameservers — the servers authoritative for its DNS. These often reveal the DNS or hosting provider, and they should match what's actually serving the domain's records. Our guide to checking nameservers explains why a mismatch here can break a whole domain.

Domain status codes: the part most people skip

The status codes (formally EPP status codes) are the most overlooked and most revealing part of a WHOIS record. They describe the domain's current state — whether it's locked, pending an operation, or in trouble. There are two families:

  • client codes are set by the registrar (e.g. clientTransferProhibited).
  • server codes are set by the registry itself (e.g. serverHold), and are usually more serious.

Here's what the common ones mean:

  • ok (sometimes shown as active) — the domain has no restrictions or pending operations. Note this also means it's unlocked, which is actually less secure than having transfer protection on.
  • clientTransferProhibited — the registrar has locked the domain against being transferred away. This is normal and good; it protects you from unauthorized transfers. Seeing it is reassuring, not a problem.
  • clientUpdateProhibited / clientDeleteProhibited / clientRenewProhibited — additional registrar locks preventing changes, deletion, or renewal. Common on important domains for extra protection.
  • clientHold — this is the one to worry about. It means the registrar has told the registry to remove the domain from the DNS zone, so it stops resolving entirely — the website and email go dark. It's often triggered by non-payment or an unverified contact. If a site is down and you see clientHold, that's very likely your cause, and it explains errors like DNSPROBEFINISHEDNXDOMAIN.
  • serverHold — the same effect as clientHold, but applied at the registry level, sometimes for legal or compliance reasons.
  • pendingTransfer / pendingRenew / pendingUpdate — an operation is in progress.
  • autoRenewPeriod / redemptionPeriod / pendingDelete — stages of the expiration lifecycle. redemptionPeriod means the domain has expired and can still be recovered (for a fee), while pendingDelete means it's about to be released and can't be saved. These are stages of the domain expiration lifecycle.

Why the status codes matter

Reading these codes turns a WHOIS record from trivia into a diagnostic tool:

  • Transfer/update/delete "prohibited" codes are protective — they mean the domain is locked down safely.
  • Hold and redemption/pending-delete codes are warnings — they mean the domain isn't resolving or is heading toward loss, and they often explain a site that's suddenly gone offline.

So if a domain won't load, checking its WHOIS status is a smart early step. And to confirm whether the domain is unreachable for everyone or just you, run it through our live website down checker.

The bottom line

A WHOIS record isn't as cryptic as it first looks. Read it in sections: the registrar (who it's registered through), the dates (especially expiry), the nameservers (who runs its DNS), and the status codes (its current state). The status codes are the hidden gem — clientTransferProhibited is a good, protective lock, while clientHold, redemptionPeriod, and pendingDelete are red flags that often explain why a domain has gone dark. Pull up any record with a free WHOIS Lookup, and you'll be able to decode a domain's full situation at a glance.