Free domain lookup tools: WHOIS, DNS, classification and company data

Free domain lookup tools answer four different questions, and no single tool answers all of them. Registration data (registrar, creation date, expiry) comes from RDAP or WHOIS, free through ICANN Lookup or the command line. DNS records come from dig or a free DNS-over-HTTPS endpoint. What kind of domain it is and which company is behind it come from a classification or enrichment API, such as pingutil's free tier.

Start by deciding which question you have. Most bad domain lookups come from asking a WHOIS tool something only DNS knows, or expecting registration data to tell you about a company.

Free domain lookup tools by question

Registration data: RDAP first, WHOIS as fallback

Registration data lives with the registry for each top-level domain. There are two protocols for reading it. WHOIS is the old one: a plain-text protocol over TCP port 43, specified in RFC 3912, with no standard response format. RDAP is its replacement: HTTPS and JSON, with a standard schema (RFC 9083) and a standard way to find the right server for any TLD (RFC 9224).

For generic TLDs, the switch is done. ICANN made RDAP the definitive source for gTLD registration data on 28 January 2025, and its RDAP FAQ says gTLD registries and registrars are no longer required to run WHOIS from that date, except for .com, .name and .post. The full comparison is in RDAP vs WHOIS.

The quickest free RDAP lookup is a single request. rdap.org redirects you to the right registry server:

curl -sL https://rdap.org/domain/stripe.com | jq '.events'
# [
#   { "eventAction": "registration", "eventDate": "1995-09-12T04:00:00Z" },
#   { "eventAction": "expiration",   "eventDate": "2027-09-11T04:00:00Z" },
#   ...
# ]

ICANN Lookup does the same in a browser and is the better choice for non-developers.

Country-code TLDs are where you'll still need WHOIS. As of 2026, IANA's RDAP bootstrap file lists servers for 72 of the 248 two-letter country-code TLDs. .uk, .fr, .nl, .br and .ca are in; .de, .io, .co, .cn, .jp and .eu are not. So rdap.org/domain/stripe.io returns a 404, while whois stripe.io returns a creation date. Coverage differs by registry, too: DENIC's WHOIS output for a .de domain shows a last-changed date but no creation date at all.

What you won't get from either protocol, for most domains, is the owner. Registrant contact details are redacted or simply absent. The registrar's RDAP record for stripe.com lists a registrant entity with no name or address. Plan on the registrar, dates, status codes and nameservers, and treat anything more as a bonus.

DNS records: free, fast and authoritative

DNS answers the practical questions: does the domain resolve, where does its mail go, does it have a website, what TXT records (SPF, domain verification) does it publish. You don't need a paid tool for any of it.

On a laptop, dig is the standard:

dig +short MX stripe.com
dig +short A stripe.com
dig +short TXT stripe.com

In serverless code where you can't open raw DNS sockets, use a DNS-over-HTTPS JSON endpoint. Both Google Public DNS and Cloudflare offer one for free:

curl -s "https://dns.google/resolve?name=stripe.com&type=MX" | jq '.Answer[].data'

curl -s -H 'accept: application/dns-json' \
  "https://cloudflare-dns.com/dns-query?name=stripe.com&type=MX" | jq '.Answer[].data'

Google documents its format in the JSON API for DNS over HTTPS. Reading the answers correctly takes some care: an empty MX answer doesn't mean "no mail" (there's an implicit fallback to the A record), and a null MX record (0 .) means the domain explicitly refuses mail. Checking MX records to see if a domain can receive email covers those cases, and DNS-over-HTTPS for domain checks in serverless code covers timeouts and caching.

Web tools such as MxToolbox wrap the same lookups in a browser, which is handy when you're debugging one domain and don't want to remember record types.

Classification: what kind of domain is it?

Registration and DNS data won't tell you that mailinator.com is a throwaway inbox service, that btinternet.com is a consumer ISP, or that cs.ox.ac.uk is a university. That's classification, and it's what most signup and lead flows actually need.

You can build a basic version from free open lists: the community disposable-email-domains list, a list of webmail providers, and TLD rules for .edu, .ac.<cc>, .gov and their variants. Or call an API that does it. pingutil's free tier returns the category, and for email input, signals about the local part:

curl -s -X POST https://pingutil.com/v1/lookup \
  -H "Authorization: Bearer $PINGUTIL_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "input": "btinternet.com", "skip_enrichment": true, "check_dns": true }'
# "category": "isp",
# "domain_signals": { "domain_exists": true, "can_receive_email": true, "has_website": true }

check_dns: true adds three DNS facts (domain_exists, can_receive_email, has_website) so you don't have to make the DoH calls yourself. Each key is limited to 60 requests per minute and there's no bulk endpoint, so it suits per-signup or per-lead lookups, not scanning a zone file.

Company data: who is behind the domain?

For a company domain, the useful lookup is the company profile: name, industry, size, headquarters, funding stage, LinkedIn URL. Registration data almost never gives you this, because companies register through brand-protection registrars and redaction hides the rest.

Free options come in a few forms: capped free tiers of commercial company databases, LLM-generated profiles, and scraping the company's own website. We compare them in free company enrichment APIs: what you actually get. pingutil is in the LLM-generated group. Drop skip_enrichment and a company domain comes back with a structured profile and a confidence score. It's useful for routing and personalization, and it can be wrong, especially for small or recently renamed companies. Treat low confidence values as a hint, not a fact.

What none of these free tools give you is person-level data. If you need a named contact, their title or a phone number, that's the paid contact-data market, and pingutil doesn't do it.

Picking the right free lookup

1. Fraud or signup screening: classification first, then DNS. Registration age can help as a supporting signal where RDAP covers the TLD.
2. Lead routing and personalization: classification to filter out webmail, then company data for the rest.
3. Debugging mail delivery: DNS only. dig and a DoH endpoint are all you need.
4. Investigating a suspicious domain by hand: ICANN Lookup for dates and registrar, dig for infrastructure, then look at the website.

For a single domain, the fastest way to see category, DNS facts and company profile together is to paste it into the live demo. For the broader picture of what each layer can tell you, see what is domain intelligence.