How to Run a WHOIS Lookup on Windows (and When to Use RDAP)

A registration lookup can help you identify a domain’s registrar, registration dates, nameservers, and published abuse contacts. On Windows, Microsoft’s Sysinternals Whois utility provides a direct command-line workflow; for newer, structured data, PowerShell can query an authoritative Registration Data Access Protocol (RDAP) service. This guide explains both approaches and their limitations.

What Is a WHOIS Lookup?

WHOIS is a query service for registration records associated with domain names and IP address ranges. It is not the same as DNS: a WHOIS or RDAP result describes registration data, while a DNS query returns records used to locate or configure network services.

The classic WHOIS protocol sends a text query to a server, traditionally over TCP port 43, and receives a human-readable response. The response format is not consistent across registries, so the same field can have different labels or may not appear at all. RFC 3912 specifies the protocol and notes limitations such as the lack of strong security and internationalization.

RDAP is the standards-based alternative for registration-data access. It uses HTTP and structured JSON responses, with query patterns defined by RFC 9082 and response objects by RFC 9083. RDAP does not guarantee that every record is public or complete; registry policy and privacy rules determine what a server returns.

Why Do Registration Lookups Exist?

Domains need a registry record so operators can manage registrations, delegations, renewals, and abuse reports. Lookup tools expose the portions of those records that a registry makes available. Administrators use the information to check registrar details, investigate unexpected domain changes, or find published reporting channels.

The two protocols have different trade-offs. Traditional WHOIS is widely recognized and supported by older tools, but its text output and server discovery conventions vary. RDAP provides a more consistent data model and uses HTTPS, but clients still need to find the correct service and handle registry-specific availability, access limits, and redaction.

How WHOIS and RDAP Work

With WHOIS, a client sends a domain or address to a WHOIS server. A response may include registrar and registry names, status codes, dates, nameservers, and contact fields. Some servers refer the client to another server for more detail; Microsoft’s tool supports a verbose mode for following those referrals.

RDAP adds a discovery step. A client uses the domain’s top-level domain to find the responsible service in the IANA RDAP DNS bootstrap registry, then requests the domain record at that service’s HTTPS endpoint. The registry returns a JSON object containing the fields it supports. This is why a reliable RDAP client should not assume that one fixed server handles every suffix.

In practice, either protocol can return partial data, a referral, a not-found response, or an access-limit error. A lookup result does not prove who operates a website, whether its content is trustworthy, or which server currently hosts it.

Lookup Methods for Windows

Microsoft’s Sysinternals Whois documentation provides the official download and syntax. For a browser-based option, use ICANN Lookup. On Windows, the Linux whois utility is also available inside WSL; see the WSL installation guide.

Real-World Uses

• Domain administration: Confirm the listed registrar, status, and nameservers after a transfer or registration change. Use DNS tools separately to check whether the records resolve as expected.
• Abuse triage: Look for a published registrar or abuse-reporting contact when investigating a suspicious domain. Contact details may be hidden or replaced by a privacy service.
• Asset inventory: Compare known domains against registration dates and registrar data as one signal in an inventory. Do not treat this as proof of ownership or current hosting.
• Troubleshooting: Check whether a lookup failure is limited to a registry service rather than assuming the domain’s DNS is broken.

Practical Guide: Sysinternals and PowerShell

Install and run Microsoft Sysinternals Whois

Download the official Whois ZIP archive, then extract it to a user-writable tools folder. The following PowerShell commands download and extract it without requiring an administrator account:

$toolDir = Join-Path $env:LOCALAPPDATA 'Programs\Sysinternals'
New-Item -ItemType Directory -Path $toolDir -Force | Out-Null
$archive = Join-Path $toolDir 'WhoIs.zip'

Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/WhoIs.zip' -OutFile $archive
Expand-Archive -LiteralPath $archive -DestinationPath $toolDir -Force

& (Join-Path $toolDir 'whois.exe') example.com

Use -v to request referral information:

& (Join-Path $toolDir 'whois.exe') -v example.com

To call whois.exe without its full path, add the extracted directory to your user Path environment variable in Windows Settings, then open a new terminal. You can also add it for the current PowerShell session with $env:Path += ";$toolDir".

Query RDAP from PowerShell

This example reads the IANA bootstrap data, selects a service for the domain’s top-level domain, and requests the domain object. It avoids hard-coding a registry endpoint:

$domain = 'example.com'
$tld = $domain.TrimEnd('.').Split('.')[-1].ToLowerInvariant()
$bootstrap = Invoke-RestMethod -Uri 'https://data.iana.org/rdap/dns.json'
$service = $bootstrap.services |
  Where-Object { $_[0] -contains $tld } |
  Select-Object -First 1

if ($null -eq $service) {
  throw "No RDAP service was found for .$tld in the IANA bootstrap data."
}

$rdapBase = $service[1][0].TrimEnd('/')
$encodedDomain = [uri]::EscapeDataString($domain.TrimEnd('.'))
$record = Invoke-RestMethod `
  -Uri "$rdapBase/domain/$encodedDomain" `
  -Headers @{ Accept = 'application/rdap+json' }
$record | Select-Object ldhName, handle, status, events

The response is an object, so scripts can inspect fields instead of scraping formatted text. A registry can omit fields, return an error, or rate-limit requests; handle those responses explicitly in automation. For broader Windows scripting patterns, see the PowerShell automation guide.

Common Misconceptions

• A registration record always names the owner. Privacy services and registry policies often redact personal contact details. A record may identify a registrar or proxy rather than the person operating a site.
• WHOIS and DNS answer the same question. WHOIS and RDAP expose registration data. DNS lookups return records such as A, AAAA, MX, and NS. Use the DNS record lookup guide when checking resolution.
• Every domain has the same fields. Registries use different policies and may publish different information. WHOIS output in particular is not a standardized data format.
• A successful lookup proves a site is safe or hosted at a particular address. Registration data is only one source of context; it is not a security verdict and does not identify the live web server.
• RDAP makes all data public. RDAP standardizes query and response formats, not disclosure policy. Access restrictions and redactions still apply.

Related Articles

• Learn how DNS records direct traffic in how to check DNS records for a domain.
• Follow a query from a client to authoritative servers in the DNS lookup process guide.
• See another Windows command-line example in the internet speed test guide.