Authoritative WHOIS & Domain Intelligence
Query root TLD registry databases via raw TCP Port 43 sockets and modern ICANN RDAP protocols. Inspect domain lifespan, expiration countdowns, registrar accreditation, authoritative DNS delegation, and EPP security locks in real time.
CLOUDFLARE.COM
REGISTERED & ACTIVE DNSSEC Signedwhois.verisign-grs.com:43
Registry ID: 1542998887_DOMAIN_COM-VRSN
2,298 days remaining before registrar sponsorship expires. Auto-renewal policies typically initiate 30 days prior.
Cloudflare, Inc.
Official sponsoring registrar maintaining this domain registration record in the TLD registry.
whois.cloudflare.com
Authoritative Name Servers
Root registry DNS delegation pointing domain traffic to authoritative nameservers.
Registrant & Legal Entity
Legal domain holder details subject to ICANN Temporary Specification & GDPR.
ICANN EPP Domain Security & Lock Telemetry
Client Deletion Protection
Prevents accidental or unauthorized deletion of the domain registration by registrar staff or api.
Client Transfer Lock
Prevents unauthorized or fraudulent domain transfers to another registrar. Standard ICANN security.
Client Update Lock
Disallows unauthorized modifications to DNS nameservers, contact information, or auth codes.
Server (Registry) Deletion Lock
The registry operator blocks any domain deletion command. Essential for high-value enterprise domains.
Server (Registry) Transfer Lock
Direct registry-tier transfer lock enforced by the TLD operator. Maximum transfer security.
Server (Registry) Update Lock
Root registry prohibits modifications to authoritative domain delegation.
Authoritative Port 43 Stream Dump
Unmodified RFC 3912 response payload from whois.verisign-grs.com
Domain Name: CLOUDFLARE.COM
Registry Domain ID: 1542998887_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.cloudflare.com
Registrar URL: http://www.cloudflare.com
Updated Date: 2024-01-09T16:45:28Z
Creation Date: 2009-02-17T22:07:54Z
Registry Expiry Date: 2033-02-17T22:07:54Z
Registrar: Cloudflare, Inc.
Registrar IANA ID: 1910
Registrar Abuse Contact Email: registrar-abuse@cloudflare.com
Registrar Abuse Contact Phone: +1.6503198930
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
Name Server: NS3.CLOUDFLARE.COM
Name Server: NS4.CLOUDFLARE.COM
Name Server: NS5.CLOUDFLARE.COM
Name Server: NS6.CLOUDFLARE.COM
Name Server: NS7.CLOUDFLARE.COM
DNSSEC: signedDelegation
DNSSEC DS Data: 2371 13 2 32996839A6D808AFE3EB4A795A0E6A7A39A76FC52FF228B22B76F6D63826F2B9
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2026-11-03T07:01:34Z <<<
For more information on Whois status codes, please visit https://icann.org/epp
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.
TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability. VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.
The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
The Architecture of WHOIS, DNS & Domain Lifecycle Operations
A technical masterclass for systems administrators, network engineers, cybersecurity analysts, and domain portfolio investors on how top-level domains, root registries, registrars, and the DNS hierarchy function across the modern internet.
The 7 Phases of the ICANN Domain Name Lifecycle
From initial availability to expiration, redemption, and drop-catching, every top-level domain (gTLD and ccTLD) operates under strict protocol timers governed by the Internet Corporation for Assigned Names and Numbers (ICANN).
Available to Register
The domain has zero active registry records. Available for public registration on a first-come, first-served basis through accredited registrars.
Active Registration (1–10 Yrs)
Domain is actively delegated to authoritative nameservers with standard security locks (clientTransferProhibited). DNS records resolve globally.
Auto-Renew Grace Period (0–45 Days)
Domain passes its expiration date. Authoritative DNS resolution is paused or parked. Original registrant may renew at standard registrar renewal pricing.
Redemption Grace Period (30 Days)
Registrar cancels sponsorship. Domain enters registry RGP status. Original owner can restore domain but must pay an ICANN redemption surcharge ($80–$250).
Pending Delete Queue (5 Days)
Domain cannot be renewed or recovered by anyone. It sits in registry purge queue for 5 calendar days before dropping.
The Drop & Backordering
Automated drop-catching engines (SnapNames, DropCatch, NameJet) compete to register high-value expired domains the microsecond they are released.
Public Release
Unclaimed domains return to the public registry pool, available for standard registration by any internet user worldwide.
Registrar Transfer Process
Requires disabling clientTransferProhibited, obtaining an EPP Auth-Info Code, and completing 5-day ICANN inter-registrar transfer.
WHOIS Protocol (RFC 3912) vs. Registration Data Access Protocol (RDAP)
Designed in 1985 (RFC 954) and revised in 2004 (RFC 3912), traditional WHOIS relies on bare TCP sockets over port 43. ICANN mandated RDAP (RFC 7480 through RFC 7484) as the modern, secure RESTful JSON alternative.
| Technical Feature | Legacy WHOIS (RFC 3912) | Modern ICANN RDAP (RFC 7480-7484) | Architectural Advantage |
|---|---|---|---|
| Transport Layer | Raw TCP Port 43 Socket | HTTPS (Port 443 / TLS 1.3) | Firewall friendly, zero corporate network port blocks |
| Payload Serialization | Unstructured Free-Text (Unstandardized) | Structured JSON (jCard / RFC 7483) | Machine-readable with zero regex parsing failures |
| Access Control & Auth | Anonymous unauthenticated stream | OAuth 2.0 Role-Based Access | Tiered access for law enforcement & trademark auditors |
| Internationalization | ASCII only (Punycode xn-- format) | Native UTF-8 Internationalized Domains | Seamless support for Arabic, Chinese, Cyrillic IDNs |
| Error Handling | Text string ("No match for...") | Standard HTTP 404, 429, 503 Codes | Deterministic programmatic error detection |
| Rate Limiting | Arbitrary IP socket disconnects | Standard HTTP 429 Retry-After Headers | Predictable backoff algorithms for enterprise monitoring |
Thin WHOIS Registries
In a Thin Registry model (notably VeriSign for .com and .net), the central registry holds minimal technical metadata: the domain name, registrar IANA ID, registration creation/expiration dates, and authoritative nameserver delegations.
- Registry database contains zero registrant contact data.
- Requires a secondary query to the sponsoring registrar's WHOIS server.
- Reduces centralized database liability and privacy exposure.
- Governed by VeriSign Global Registry Services.
Thick WHOIS Registries
In a Thick Registry model (such as Public Interest Registry for .org, Afilias for .info, and most modern new gTLDs), the central registry maintains the complete administrative, technical, billing, and registrant dataset.
- One authoritative query provides the complete operational record.
- Uniform data format across all participating registrars.
- Enhanced disaster recovery and registrar failover resiliency.
- Direct enforcement of ICANN privacy redaction policies.
Comprehensive ICANN EPP Status Codes Reference
Extensible Provisioning Protocol (EPP) status codes (also termed domain lock states) inform sysadmins whether a domain is locked, delegating traffic, pending transfer, or queued for deletion.
Client lock preventing unauthorized domain transfers between registrars. The gold standard for preventing domain hijacking.
Prevents accidental or unauthorized deletion of the domain from the registry database.
Disallows changes to authoritative nameservers, contact details, or authorization passphrases.
Stops manual out-of-band renewal requests to avoid duplicate billing charges on automated systems.
The registrar suspended DNS resolution. The domain will not resolve to IP addresses in the global DNS.
Direct registry suspension due to legal dispute, abuse complaint, non-payment, or ICANN sanction.
Registry-level transfer restriction. Cannot be overridden by registrar APIs without registry intervention.
Grace period (0-45 days) immediately following domain expiration. Renewal remains available to owner.
30-day registry hold. The domain can be redeemed only by the original registrant upon paying penalty fees.
DNSSEC: Securing the Root Delegation Chain of Trust
Domain Name System Security Extensions (DNSSEC) adds cryptographic digital signatures to DNS records using public key cryptography. By publishing a Delegation Signer (DS) record at the parent TLD registry, resolvers verify that incoming DNS responses have not been intercepted, forged, or poisoned via man-in-the-middle (MitM) cache attacks.
Hash of public Key Signing Key stored in root registry zone.
Zone-signing and key-signing public keys held in authoritative zone.
Digital signatures validating each A, AAAA, MX, and TXT record set.
Tech100 WHOIS parses the authoritative DNSSEC: attribute to verify whether DS delegation is signed at root level or unsigned.
Authoritative Root Registry Servers & Ports
Tech100 connects directly to official top-level domain registries across North America, Europe, and Asia over TCP Port 43.
| Top-Level Domain (TLD) | Registry Operator | Authoritative WHOIS Server | Model | Port |
|---|---|---|---|---|
| .com, .net, .edu | VeriSign Global Registry | whois.verisign-grs.com | Thin | TCP 43 |
| .org | Public Interest Registry (PIR) | whois.pir.org | Thick | TCP 43 |
| .top | Jiangsu Bangning Tech | whois.nic.top | Thick | TCP 43 |
| .io | Identity Digital / NIC.IO | whois.nic.io | Thick | TCP 43 |
| .ai | Offshore Information Services (Anguilla) | whois.nic.ai | Thick | TCP 43 |
| .uk, .co.uk | Nominet UK | whois.nominet.uk | Thick | TCP 43 |
| .de | DENIC eG (Germany) | whois.denic.de | Thick | TCP 43 |
Frequently Asked Questions: WHOIS, DNS & Domain Management
Answers to common architectural and administrative questions regarding WHOIS lookups, registrar transfers, DNS propagation, and privacy protections.
To initiate an inter-registrar transfer under ICANN policy, follow these steps:
- Unlock the domain: Log in to your current registrar and disable the Transfer Lock (
clientTransferProhibited). - Generate Auth-Info Code: Request your EPP Authorization Code (transfer secret) from the registrar dashboard.
- Verify contact email: Ensure the administrative contact email is reachable to approve the Transfer Authorization email.
- Submit transfer request: Purchase the transfer at your new registrar (this extends your domain registration by +1 year).
- Authorize transfer: ICANN permits 5 calendar days for the losing registrar to release the domain, after which transfer completes automatically.