WHOIS Lookup

This shells out to the system whois client, which opens a TCP connection to port 43 and reads whatever the registry sends back. That is the whole protocol. There is no schema, no mandatory field set, and no guarantee that two top-level domains answer in the same shape, so the parser can only work with what it is handed.

Some gTLD registries withhold registrant name, address, phone, and email for privacy, a consequence of GDPR and the access policies that followed. A blank registrant field therefore usually means the registry declined to publish or does not carry the data at all, not that the domain is unregistered or anonymous. Absent and empty are different states, and a text response flattens them into the same thing.

Dates are another trap. The registrar's own page and the registry record can disagree on creation and expiry, sometimes by several days, because each side keeps its own clock and grace periods. Query an IP address instead of a name and you get an allocation record from a regional internet registry describing who the block was assigned to, which is not necessarily who is routing it, who owns the hardware, or who terminated the traffic you are chasing.

Watch the referral chain. Many registries return a thin record plus a pointer to the authoritative server, and the system client follows it automatically; if the tool shows only a handful of fields, run whois directly and compare. Rate limits are real as well. Bursting queries at a registry gets the requesting IP throttled or blocked, which looks like a broken lookup rather than a policy response.