What is WHOIS? A domain-dispute definition
WHOIS is the longstanding query-and-response protocol that returns the registered name, contact details, and registration dates for a domain name – historically the primary public record linking a domain to its holder.
WHOIS data tells you who registered a domain, when they registered it, when it expires, and which registrar holds the account. That record sits at the heart of every domain dispute: it is the starting point for identifying a respondent, establishing the registration date, and tracing transfers. Since January 2025, RDAP – the Registration Data Access Protocol – has replaced WHOIS as the technical standard mandated by ICANN, though the term "WHOIS" remains in wide use as shorthand for any domain registration lookup.
This page defines WHOIS precisely, explains what it is not, grounds it in the dispute rules that rely on it, and describes the practical patterns that matter most when a domain is challenged or stolen.
What does WHOIS contain – and what does it not contain?
A standard WHOIS record carries the domain name itself, the registrar's identity, the creation date, the expiry date, the name servers, and the registrant's contact fields – name, organization, address, phone, and email. These fields are what counsel, panels, and brand owners use to identify a disputed domain's holder.
What WHOIS does not contain is proof of ownership in any trademark or property-law sense. Holding a domain registered in your name is not the same as owning a trademark in that name, and a WHOIS record does not resolve a rights dispute. That is a confusion worth naming directly: WHOIS tells you who holds the registration, not who has the legal right to the name.
The closest term readers confuse WHOIS with is WHOIS privacy or proxy service – a product offered by registrars and third-party providers that substitutes the registrant's details with those of an intermediary. The underlying holder is not publicly visible in such a record. That is a distinct concept, addressed separately in What is WHOIS privacy and proxy services?
Why does the shift from WHOIS to RDAP matter for domain disputes?
As of 28 January 2025, ICANN no longer requires registrars to operate a WHOIS service; RDAP is now the standard source of domain registration data. RDAP returns structured JSON rather than free-text output, supports access controls, and handles internationalized data more cleanly than the legacy protocol.
In practice the change means that public lookups now frequently return redacted registrant fields, particularly for individuals, because RDAP accommodates data-protection law in a way the old WHOIS architecture could not. A complainant or counsel who queries RDAP for a disputed domain may see only the registrar's identity and a set of blank or generic contact fields.
Identifying the underlying registrant now requires an additional step: a disclosure request through ICANN's Registration Data Request Service, or RDRS, which launched as a pilot and was extended beyond its original two-year term. ICANN announced on 20 November 2025 that the RDRS pilot was extended while next steps are decided – confirm the current status before relying on it. Disclosure through the RDRS is not automatic: each request is assessed by the registrar, and a response is not guaranteed. For dispute purposes, where quick identification matters, this adds a variable the filing timeline cannot fully absorb.
How WHOIS data functions in UDRP and other dispute procedures
Under the UDRP, the registration date in the WHOIS or RDAP record is central to the third element of Paragraph 4(a): the domain must have been registered and used in bad faith. The date the domain was created sets the point from which bad faith must be shown. A registrant who took the name before a complainant's mark existed may have a complete defense on this fact alone.
Beyond the creation date, WHOIS history – the sequence of past registrants as a domain changed hands – is equally significant. Panels examining a domain that has been transferred multiple times will look at each registrar transfer to determine whether any holder acquired the domain in knowledge of an existing mark. A gap between the original registration date and the most recent change of registrant can reopen the bad-faith clock, or close it, depending on the facts.
In the Nominet DRS for .uk domains – now administered by the WIPO Arbitration and Mediation Center following the transition on 7 July 2026 – the registration record serves the same evidentiary function, though the legal test is "abusive registration" rather than the UDRP's conjunctive bad-faith standard. The DRS reads "registered or used" abusively, a lower bar, but the registration date shown in the record still governs the timing analysis.
Recognizable patterns where WHOIS data is decisive
Three fact patterns recur across disputes in our practice, each turning on what the registration record shows.
Pattern one: domain theft and unauthorized transfer. A registrant's domain stops resolving, and an RDAP query shows a new holder – a registrant name the owner has never encountered – and a creation-date entry overwritten by a recent transfer date. The discrepancy between the original registration history and the current record is the first forensic marker in a hijacking investigation. Recovery depends partly on establishing, through registrar logs and account records, that the transfer was unauthorized. Our court recovery practice handles exactly this sequence: registrar escalation, documentation of the compromise, and pursuit of transfer reversal.
Pattern two: privacy or proxy masking a bad-faith registrant. A complainant queries the domain and sees only a privacy service's details. The underlying holder cannot be identified from the public record. In this situation, filing a UDRP complaint names the domain rather than the person; the provider identification procedure under the UDRP Rules requires the registrar or privacy service to disclose the underlying holder's identity for service of process. Panels regularly proceed to a decision even where the respondent defaults, treating the masked registration itself as consistent with bad faith where other circumstances support it.
Pattern three: historical WHOIS data in cybersquatting litigation. A brand owner pursuing a court action for cybersquatting needs to show the registrant's knowledge of the mark at the time of registration. Archived WHOIS records – accessible through historical lookup services – establish the chain of registrants, the dates each held the name, and the contact information each supplied. Courts and arbitral panels have used this historical chain to identify the registrant who first acquired the domain in bad faith, even where the domain subsequently changed hands. For an example of how a prior dispute decision is enforced across borders, see case enforce udrp decision de.
Why WHOIS matters to a brand owner or registrant in a dispute
For a brand owner, the registration record is evidence. The creation date, registrant identity, and transfer history are the raw materials of a UDRP complaint or a court filing. An inability to identify the holder delays filing and may affect the forum choice: if RDRS disclosure fails, the complainant may need to proceed against the domain as holder rather than against a named individual.
For a registrant facing a complaint, the same record is a shield. The creation date may predate the complainant's mark. The registrant name may reflect continuous use of the domain under a business name. The absence of any transfer may rebut a pattern-of-conduct argument. Accurate, current registration data – verified before a dispute arises – is part of legitimate-interest preparation.
Is your domain's registration record consistent with the rights you want to assert? Is the contact information current and accurate? These are not administrative details. In a domain dispute, the WHOIS or RDAP record is often the first document a panel reads.
COGNOMEN handles domain disputes exclusively, across gTLDs and ccTLDs – recovery, defense, and transactions. To discuss a dispute where the registration record is in issue, contact info@cognomenlaw.com.
COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. To discuss a domain, contact info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
What is WHOIS?
WHOIS is the protocol – and colloquially the record it returns – that identifies the registrant of a domain name, along with registration and expiry dates and the registrar handling the account. Since January 2025 RDAP has replaced WHOIS as ICANN's mandated technical standard, though the shorthand "WHOIS" remains in common use. The record is the starting point for identifying a party in any domain dispute, whether under the UDRP, a ccTLD procedure, or court proceedings.
How is WHOIS data proven or established in a dispute?
A party establishes WHOIS data by submitting a timestamped printout or structured RDAP response at the time of filing. Historical WHOIS records – archived snapshots showing past registrants and transfer dates – are equally admissible and are often decisive when a domain has changed hands. Where current data is redacted, a disclosure request through the registrar or ICANN's Registration Data Request Service is the recognized mechanism, though disclosure is not guaranteed and response time is outside the requester's control.
Why does WHOIS matter to my domain situation?
If your domain was transferred without your consent, the registration record is the first forensic evidence of the unauthorized change. If you are filing a UDRP complaint, the creation date in the record anchors the bad-faith timeline. If you are defending a complaint, an early registration date may be your strongest single fact. Errors or stale data in your own record – an outdated email, an old registrant name – can complicate service of process and delay any proceeding that touches your domain.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.