Skip to content
SenderProbe
Transport and ownership check

Check who a domain is registered with, and until when

Every record you publish rests on a registration that somebody has to renew. SenderProbe queries the registry and the registrar, parses the fields each spells differently, and reports the expiry date, the status codes and the locks the domain carries.

Free to run No mail is sent to your domain

What a WHOIS record contains

A WHOIS lookup asks the registry for a top-level domain what it holds about a name, and follows the referral to the registrar that sold it. Between them they hold the registrar of record, the dates the registration was created, last updated and expires, the status codes in force, the nameservers the delegation uses and whether the zone is signed.

Registries do not agree on how to spell any of it. SenderProbe parses the common variants — the expiry date alone appears as Registry Expiry Date, Expiration Date, paid-till and expires depending on who answers — so the same fields come back whichever registry replied.

An abridged WHOIS response, showing the fields the lookup parses out of whatever shape the registry returns them in.
Domain Name: EXAMPLE.COM
Registrar: Example Registrar, Inc.
Creation Date: 2015-04-12T09:31:44Z
Registry Expiry Date: 2027-04-12T09:31:44Z
Domain Status: clientTransferProhibited
Domain Status: clientDeleteProhibited
Name Server: NS1.EXAMPLE.NET
Name Server: NS2.EXAMPLE.NET
DNSSEC: signedDelegation

Expiry is a mail outage waiting to happen

A lapsed domain does not fail politely. The delegation is withdrawn, every name under it stops resolving, and mail to and from it stops at once — MX, SPF, DKIM and DMARC records all disappear together, because they are all names in a zone that is no longer delegated.

Recovery runs through a redemption period with a fee, and takes days rather than minutes. This is why a monitor on the domain expiry date is worth more than it looks: the failure is total, it is scheduled, and it is entirely avoidable.

Domain status codes and the locks worth having

The domain status codes a registry publishes say what may currently be done to the registration. The client-prefixed ones are set by your registrar at your request: clientTransferProhibited blocks a transfer to another registrar, clientDeleteProhibited blocks deletion, clientUpdateProhibited blocks changes to the record including the nameservers.

Turn them on. A domain hijack is usually a transfer or a nameserver change made with stolen registrar credentials, and these locks turn that into a request that has to be lifted deliberately first. The server-prefixed codes are set by the registry instead, and serverHold — which removes the domain from the zone — is one you want to notice quickly.

Redaction, privacy services and RDAP

Registrant contact details are mostly gone from public WHOIS output, redacted for privacy reasons or replaced by a privacy service that forwards mail to the real owner. This is normal and it is not a finding. The fields that matter operationally — registrar, dates, status, nameservers, DNSSEC — are still published.

RDAP is the structured successor to the WHOIS protocol: the same registration data served as JSON over HTTPS, with access to contact fields governed by who is asking. Both are queried the same way in practice, and both return the same public subset to an anonymous caller.

Domain age, and what a receiver reads into it

Filters weigh the age of a domain, because domains registered days ago and sending immediately are a common pattern in phishing and throwaway bulk mail. A newly registered domain therefore starts with no credit, whatever its records say.

Nothing fixes this except time and consistent sending. If you are launching on a new domain, register it well before the first campaign and warm it gradually, rather than reading a poor early result as a fault in the authentication records.

Run this check on your own domain. A workspace takes a minute to create and runs every one of the eleven checks against the domain you name.

Check my domain

Common questions

What does a WHOIS lookup show?
It returns the registration data a registry and registrar publish for a domain: the registrar of record, the creation, update and expiry dates, the status codes in force, the delegated nameservers and whether DNSSEC is enabled. Registrant contact details are usually redacted or replaced by a privacy service, which is expected rather than a problem.
What does clientTransferProhibited mean?
It is a lock your registrar sets, at your request, that prevents the domain being transferred to another registrar until it is lifted. It is one of the standard protections against domain hijacking, alongside clientDeleteProhibited and clientUpdateProhibited. Seeing it in a WHOIS record is a good sign, not a warning.
Why is the registrant's name hidden?
Because most registrars now redact personal contact data from public output for privacy reasons, and many customers additionally buy a privacy service that substitutes a forwarding address. The operational fields are unaffected: registrar, dates, status codes, nameservers and DNSSEC are still published in full.
Does a domain expiring affect email?
Completely. When a registration lapses the delegation is withdrawn, so nothing under the domain resolves: no MX record to route to, no SPF or DKIM record for a receiver to check, no DMARC policy. Mail stops in both directions, and recovery through the redemption period costs a fee and takes days.
What is RDAP?
RDAP is the Registration Data Access Protocol, the structured replacement for WHOIS. It serves the same registration data as JSON over HTTPS, with consistent field names and access to contact data governed by who is asking. Anonymous queries return the same public subset that redacted WHOIS output does.

Keep reading

Related checks, definitions and guides.