Skip to content

Domain WHOIS Field Reference

May 22, 2025

The Domain WHOIS Collection provides parsed registration data for domain names. It includes ownership information, creation and expiration dates, registrar details, and contact points.

Property Description
Document Each document represents WHOIS registration details for a domain name.
Unique Identifier The domain field serves as the unique identifier for each document.
Default Fields No default fields are defined for this collection.

Addressing

Addressing fields identify the domain name, its structure, and hierarchical details.

domain

The domain for which the data was requested.

Field type: WILDCARD

Examples: example.com, example.co.uk

Usage in queries:

domain:example.com

id

Unique identifier for the WHOIS record assigned by the registrar.

Field type: TTEXT

Examples:

  • 1f378468bddb44f3a084571e1e028e55-DONUTS
  • 1542998887_DOMAIN_COM-VRSN

level

Domain hierarchical level, where the top-level domain (TLD) is level 1. For example, example.com has level 2, and example.co.uk has level 3.

Field type: #LONG

Examples: 2, 3

name

The second-level domain name without subdomains or TLD (pure label).

Field type: WKEYWORD

Examples: example, google

Usage in queries:

  • Search for domains with a specific brand name: 
    name:example
  • Search for similar domains: 
    name:netlas~1

punycode

Punycode-encoded version of the domain, used for Internationalized Domain Names (IDNs).

If the domain is not internationalized, it matches the original domain name.

Field type: WILDCARD

Examples: xn--wgv71a119e.jp, xn--d1acpjx3f.xn--p1ai

zone

Top-level domain (TLD) or public suffix zone of the domain. Common examples include com, net, org.

Field type: WKEYWORD

Examples: com, net, co.uk, edu.au

Usage in queries:

  • Search Chinese domains: 
    zone:ac.uk

Contacts

Contact information fields contain registrant, registrar, administrative, technical, and billing contacts.

These fields include names, organizations, addresses, emails, and phone numbers. Many WHOIS providers redact or mask this data for privacy.

administrative

Administrative contact for the domain.

This person or organization is typically responsible for domain-level decisions and communication with the registrar. Structure is identical to the registrant group.

Field type: OBJECT

billing

Contact responsible for handling payment and invoicing for the domain registration.

This role is less commonly populated and may be the same as administrative or registrant contacts. Structure is identical to the registrant group.

Field type: OBJECT

registrant

Contact details of the entity or individual that owns the domain name. This is the legal domain holder as registered with the domain registrar.

Field type: OBJECT

registrant.city

City of the registrant.

Field type: TTEXT

Examples: Reykjavik, Mountain View

registrant.country

Country of the registrant, represented as a 2-digit code, following the ISO 3166-1 alpha-2 standard.

Field type: TTEXT

Examples: IS, US

registrant.email

Email address of the registrant.

Field type: WKEYWORD

Examples:

Usage in queries:

  • Search by email address 

    registrant.email:[email protected]

  • Search by email server 

    registrant.email:*gmail.com

registrant.fax

Fax number of the registrant.

Field type: TTEXT

Examples: +1.6502530001, +49.892307030

registrant.fax_ext

Fax extension for the registrant, if applicable.

Field type: TTEXT

Examples: 123, 001

registrant.id

Unique ID for the registrant in the WHOIS database.

Field type: TTEXT

Examples: REG-12345678, ABCD1234

registrant.name

Full name of the registrant.

Field type: TTEXT

Examples: Redacted for Privacy, John Doe

registrant.organization

Organization name of the registrant.

Field type: TTEXT

Examples:

  • Privacy service provided by Withheld for Privacy ehf
  • Example Corporation

Usage in queries:

registrant.organization:"Meta Platforms"

registrant.phone

Phone number of the registrant.

Field type: TTEXT

Examples: +354.4212434, +1.6502530000

registrant.phone_ext

Phone extension for the registrant, if applicable.

Field type: TTEXT

Examples: 456, 002

registrant.postal_code

Postal code for the registrant.

Field type: TTEXT

Examples: 101, 94043

registrant.province

State or province of the registrant.

Field type: TTEXT

Examples: Capital Region, California

registrant.street

Street address of the registrant.

Field type: TTEXT

Examples:

  • Kalkofnsvegur 2
  • 1600 Amphitheatre Parkway

registrar

Information about the registrar company that manages the domain registration.

Structure is identical to the registrant group, with an additional referral_url field.

Field type: OBJECT

registrar.referral_url

URL to the registrar’s management portal or referral page.

Field type: TTEXT

Examples: https://www.example-registrar.com

technical

Technical contact responsible for maintaining domain services such as name servers or DNS configuration.

This is the primary contact for resolving technical issues related to the domain. Structure is identical to the registrant group.

Field type: OBJECT

Information

The information block includes general WHOIS metadata about the domain: important dates, DNSSEC status, name servers, current status, and WHOIS server details.

created_date

Date when the domain was registered.

Field type: DATE

Examples: 2003-03-03T00:00:00Z

Usage in queries:

  • Search for domains registered in the last 90 days: 
    created_date:[now-90d TO now]
  • Search for domains registered before a specific date: 
    created_date:<2023-01-01

dnssec

Boolean field indicating if DNSSEC is enabled for the domain.

A flag is included only if the corresponding feature is supported. The value is always true.

Field type: BOOLEAN

Examples: True, False

expiration_date

Date when the domain registration will expire.

Field type: DATE

Examples: 2026-03-03T00:00:00Z

name_servers

List of authoritative name servers for the domain.

Field type: WILDCARD

Examples: ns1.example.com, ns2.example.com

status

Represents the current status flags assigned to the domain name as defined by ICANN and registrars. These flags indicate restrictions or permissions on domain operations such as transfers, deletions, or updates.

Common values include:

  • clientTransferProhibited: The domain cannot be transferred without registrar intervention.
  • clientDeleteProhibited: Prevents the domain from being deleted.
  • clientUpdateProhibited: Prevents updates to domain information.
  • serverHold: Domain is not in the DNS and will not resolve.
  • ok: No restrictions — the domain is in good standing.

Field type: TTEXT

Examples: ok, pendingDelete

Usage in queries:

COM-domains, that will be deleted in 30 days or less: 

status:redemptionPeriod zone:com

updated_date

Date when the domain information was last updated.

Field type: DATE

Examples: 2024-03-01T00:00:00Z

whois_server

The WHOIS server specified in the response as authoritative for the domain.

Field type: WILDCARD

Examples: whois.verisign-grs.com, whois.nic.io

Uncategorized

Additional fields extracted from WHOIS records that don't fit into the main model. These fields are collected for flexibility and advanced use cases.

extension

Custom WHOIS extensions or additional notes provided by registrars.

Field type: TTEXT

extracted_domain

Re-parsed domain name extracted from raw WHOIS text. Could countains national characters.

Field type: WILDCARD

Examples: 看剧.vin

server

The server that was used to request the WHOIS data.

Field type: WILDCARD

Examples: whois.verisign-grs.com, whois.nic.io

Service Fields

Internal metadata fields related to document processing.

@timestamp

The timestamp when the document was indexed. This time is usually very close to the scan time, with only a few hours difference.

Field type: DATE

Examples:

  • 2023-01-01T12:00:00Z
  • 2023-10-15T08:30:00Z

Usage in queries:

@timestamp:>=now-30d

@timestamp:[now-7d TO now]

@timestamp:[2024-01-01 TO 2024-12-31]

last_updated

The timestamp indicating when the document was last updated. This field is no longer in use as a new index is created for each scan cycle.

Field type: DATE

raw

Full unstructured raw WHOIS response text captured during parsing.

Field type: TTEXT