Free Domain Lookup — WHOIS, DNS, SSL, Subdomains & Email Security
Type a domain to get its registration, DNS records, live SSL certificate, subdomains and SPF/DMARC/DKIM in one report. No signup, no ads.
Checking a supplier email that changes bank details? Use the free payment-change check.
What you get
Each report has five sections, with the same data the API returns.
WHOIS / RDAP
Registrar, registration and expiry dates, nameservers and status codes. RDAP first, with a 4-tier fallback that ends in port-43 WHOIS for 50+ TLDs, including most ccTLDs.
DNS records
A, AAAA, MX, TXT, NS, CAA and SOA, resolved live. Useful for checking configuration changes and mapping infrastructure.
SSL/TLS certificate
A live TLS handshake on port 443: issuer, subject, validity dates, SANs and days until expiry. No third-party scanner.
Subdomains
Live hosts with their IPs, kept apart from historical names. From certificate transparency logs, passive DNS (25+ sources) and DNS brute-force, with wildcard filtering.
Email security
SPF and DMARC records, plus DKIM keys found on 29 common selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid, Postmark, Mandrill, Klaviyo, Mailgun and others.
Every report also offers free daily change alerts for that domain (beta).
Common workflows
Security and threat intel
Pull DNS, WHOIS, SSL and subdomain context for a domain from an alert, and pivot on shared registrars, SANs or nameservers.
Phishing and scam investigation
Check a look-alike domain's age, certificate issuer and SPF/DMARC, then compare it with the real brand.
IP-to-domain verification
Confirm whether an IP is in a domain's live A or AAAA records during incident response or allowlist checks.
Subdomain discovery
List live subdomains with their IPs, plus historical names, for asset discovery and pentests.
SSL certificate checks
See issuer, validity, SANs and days until expiry, or confirm a new certificate after a deploy.
Email security audit
Check SPF, DMARC and DKIM in one lookup for deliverability or compliance work.
Brand protection
Use certificate transparency data and WHOIS to spot look-alike domains and certificates issued for your brand.
Sales and lead enrichment
Domain age, mail provider from MX, DMARC posture and subdomain footprint before a company enters your CRM.
How it compares
Most free WHOIS sites show registration data only, often with ads or a signup wall.
| OTI Labs Lookup | whois.com / who.is | ICANN Lookup | WhoisXMLAPI (free) | |
|---|---|---|---|---|
| WHOIS / RDAP | RDAP + port-43 WHOIS (4-tier) | WHOIS | RDAP only | WHOIS + RDAP |
| DNS records | A, AAAA, MX, TXT, NS, CAA, SOA | — | — | Separate paid product |
| SSL/TLS certificate | Live handshake | — | — | Separate paid product |
| Subdomains | Live hosts with IPs + historical names | — | — | Separate paid product |
| Email security | SPF, DMARC, DKIM (29 selectors) | — | — | Separate paid product |
| Ads / signup wall | None | Heavy ads | None | Registration required |
| Open source | MIT on GitHub | — | — | — |
Frequently asked questions
What is a domain lookup?
A domain lookup collects the public registration and infrastructure data for a domain name. This tool returns WHOIS/RDAP registration data, DNS records (A, AAAA, MX, TXT, NS, CAA, SOA), the live SSL/TLS certificate, subdomains, and email security (SPF, DMARC, DKIM) in one report.
Is this lookup tool really free?
Yes. There is no signup and no limit on viewing reports. Each report is generated on demand and cached for 24 hours, and the Refresh button can fetch fresh data up to 3 times a day. For programmatic access, the API's free tier covers 1,000 requests a month on RapidAPI, and paid plans start at $9.99/mo.
What data does the lookup return?
Five categories. WHOIS/RDAP: registrar, registration and expiry dates, nameservers and status codes, through a 4-tier fallback chain that ends in port-43 WHOIS. DNS: A, AAAA, MX, TXT, NS, CAA and SOA records, resolved live. SSL: a live TLS handshake with issuer, subject, validity dates, SANs and days until expiry. Subdomains: live hosts with their IPs, plus historical names from certificate transparency logs and passive DNS. Email security: SPF and DMARC records, and DKIM keys found on 29 common selectors.
What DNS records does the lookup return?
Seven record types in one request: A (IPv4), AAAA (IPv6), MX (mail servers), TXT (verification and policy records such as SPF), NS (nameservers), CAA (which certificate authorities may issue certificates) and SOA (start of authority). Records are resolved live and cached for up to 5 minutes.
How does the SSL certificate check work?
The tool makes a live TLS handshake with the domain on port 443, with no third-party scanner in between. It reads the certificate the server presents and returns the issuer, subject, validity window, Subject Alternative Names, serial number, signature algorithm and days until expiry. Results are cached for up to 6 hours.
How does subdomain enumeration work?
Several sources run in parallel: certificate transparency logs (crt.sh, certspotter), passive DNS (hackertarget, rapiddns, VirusTotal) and DNS brute-force with a curated list of about 770 names across 8 public resolvers. A background pass adds 25+ more passive sources through subfinder. Every name found is resolved again, so live hosts (with their IP or CNAME target) are listed apart from historical names. Wildcard DNS is detected so it can't produce false results. Up to 2,000 names are returned per request. No tool finds every subdomain: internal-only hosts leave no public trace.
Does it check email security (SPF, DMARC, DKIM)?
Yes. It reads the SPF record from the domain's TXT records and the DMARC record at _dmarc.<domain>. DKIM keys are found by probing 29 common selectors used by major mail providers, including Google Workspace, Microsoft 365, Mailchimp, SendGrid, Postmark, Mandrill, Klaviyo and Mailgun. Custom or hash-based selectors (for example some Amazon SES setups) can't be discovered this way.
Why is some WHOIS data redacted?
Privacy rules. Since 2018 (GDPR), most gTLDs such as .com, .net and .org hide personal registrant data in public WHOIS. Registrar, dates and nameservers stay public. Some ccTLDs, notably .uk and .nl, hide even more by registry policy. The tool shows what the registry publishes and never guesses redacted fields.
How is this different from whois.com or WhoisXMLAPI?
There are no ads and no signup wall. You get five categories of data in one report instead of separate tools. And the engine is open source: it's MIT-licensed on GitHub, so you can read the code or run it yourself.
Can I look up any domain?
Yes, any syntactically valid domain: registered or not, gTLD or ccTLD, including punycode (xn--) names. An unregistered domain shows no WHOIS data and usually no DNS records. Registry redactions (.uk, .nl) leave some fields blank.
Can I use this to investigate phishing or suspicious domains?
Yes, it's one of the most common uses. Useful signals are registration age (new domains are higher risk), the certificate issuer, nameserver patterns, and whether SPF and DMARC are set up. Compare a suspicious domain with the real brand's report to spot infrastructure that doesn't match.
Can I check whether an IP address belongs to a specific domain?
Yes. The DNS section lists the domain's live A (IPv4) and AAAA (IPv6) records, so you can check whether an IP is among them. Many services sit behind CDNs such as Cloudflare, Fastly or CloudFront and resolve to many IPs, so an IP missing from the list doesn't prove it's unrelated.
Do you offer an API for programmatic access?
Yes. The same engine powers a JSON REST API on RapidAPI. The free tier covers 1,000 requests a month with no credit card, and paid plans start at $9.99/mo for 50,000 requests. The API returns the same data as the lookup tool.
Need this in code?
The same data comes back as JSON from one API call. 1,000 requests a month free, no card.