Whois Lookup API (WhoisJSON) Review – WHOIS, DNS & SSL Data

What Whois Lookup does and who it is for

WhoisJSON wraps the messy world of domain registration data — raw WHOIS text, registry RDAP endpoints, DNS zone files, and SSL certificate chains — into a single, normalized API. Instead of spinning up your own WHOIS client, managing proxy rotation to dodge per-IP rate limits, and writing per-registrar parsers, you call one endpoint and get a clean JSON (or XML) response with well-defined fields.

The primary audience is developers building anything that needs to know who owns a domain, whether it is active, or how it is configured: security tooling, fraud prevention pipelines, brand-protection monitors, domain brokers, and CRM enrichment workflows. With nearly 3,800 marketplace subscribers and a popularity score of 9.9 out of 10, it has clearly found product-market fit in that space.

Key capabilities and endpoint walkthrough

WhoisJSON exposes four endpoints, each focused on a distinct data type.

GET / — WHOIS / RDAP registration data

This is the core endpoint. For any queried domain, WhoisJSON first consults the IANA RDAP bootstrap registry to locate the authoritative RDAP server for that TLD, fetches structured registration data directly, and only falls back to legacy WHOIS parsing if RDAP is unavailable or returns incomplete data. The normalized response always has the same field schema regardless of registrar quirks — dates, status codes, registrant entities, nameservers — eliminating the bespoke parsing logic that raw WHOIS queries require.

The API uses a large pool of SOCKS proxies to avoid the per-IP query rate limits that WHOIS servers impose on direct callers. Results are pulled from origin servers in real time with optional caching, and you can bypass the cache when freshness matters.

GET /nslookup — DNS records

The NSLookup endpoint retrieves DNS records associated with a domain: A, AAAA, MX, NS, TXT, CNAME, SOA, and CAA records are all returned in a single normalized response. This is useful when you need to confirm mail server configuration, verify domain ownership TXT records, or check nameserver delegation without shelling out to dig.

GET /ssl-cert-check — SSL certificate details

This endpoint fetches and validates the SSL certificate for a domain, returning issuer information, validity dates, Subject Alternative Names, chain status, and expiry signals. For teams monitoring a large certificate inventory, having this data programmatically accessible alongside WHOIS expiry dates means you can consolidate domain-health alerting in one pipeline.

GET /reverseWhois — reverse WHOIS from IP

This endpoint flips the query: given an IP address, it returns domain information associated with that IP. Reverse WHOIS lookups are standard in threat-intelligence workflows where you start from a known malicious IP and want to enumerate related domains.

Pricing breakdown

All four endpoints are available on every plan. The differences are request volume, rate limits, and a "Registered Random Whois" allocation whose quantity scales with plan tier.

A few things worth noting before you pick a tier:

• BASIC is genuinely limited. Five requests per minute and 500 per month is adequate for manual testing or a personal side project, but most production use cases will exhaust it quickly.
• The jump from BASIC to PRO is significant in throughput. The rate limit goes from 5 per minute to 10 per second — a 120× increase. If you are running batch lookups, PRO or higher is the realistic entry point.
• MEGA resets daily, not monthly. The 100,000-request allowance on the MEGA plan is per day, not per month, which makes it suitable for high-volume pipelines. Its overage rate ($0.001 per request) is also one-tenth the PRO/ULTRA overage rate, making burst costs more predictable at scale.
• Overage is opt-in by behavior. If you exceed the monthly quota on PRO or ULTRA, you are billed $0.01 per additional request. Size your plan against your expected volume to avoid surprise charges.

For requirements beyond MEGA — dedicated SLAs, custom rate limits, or higher than 600 RPM — the provider offers enterprise Atlas plans through their website at whoisjson.com/pricing.

Practical use cases

Fraud and phishing detection. Newly registered domains (creation date under 30 days) are a strong signal in phishing campaigns. Calling the main WHOIS endpoint on inbound email sender domains and checking the creation date field is a lightweight enrichment step that can catch a meaningful share of first-contact fraud.

Domain portfolio monitoring. Teams managing hundreds of domains need expiry-date alerting. Combining the WHOIS endpoint (for expiry dates and registrar changes) with the SSL endpoint (for certificate expiry) gives a unified health dashboard with a single integration.

Brand protection. Typosquatting detection requires checking variations of your brand name against live registration data. WhoisJSON's availability field and registration metadata let you identify newly registered lookalike domains before they are weaponized.

Threat intelligence enrichment. The reverse WHOIS endpoint is a natural fit for IOC enrichment pipelines. Starting from a suspicious IP and pivoting to associated domains, then pulling registration age and registrar metadata, adds context that raw IP reputation feeds lack.

SSL certificate monitoring. The ssl-cert-check endpoint surfaces expiry dates and Subject Alternative Names, useful for any team that manages externally-facing services and wants automated alerts before certificates lapse.

Limitations and things to check before integrating

Latency. The measured average latency is 1,027 ms. For real-time user-facing workflows (e.g., blocking a login based on domain age), this may require asynchronous handling or pre-fetching. For batch enrichment jobs, it is entirely acceptable.

WHOIS privacy redaction. GDPR-compliant privacy services (WhoisGuard, Domains By Proxy, etc.) cause registrant fields to return "redacted for privacy" or a proxy address. This is expected behavior from the registries, not an API defect, but it does limit how much registrant identity data you can extract for privacy-shielded domains.

ccTLD restrictions. Country-code registries like .de and .nl enforce restrictive WHOIS policies at the registry level. Queries against these TLDs may return only availability status rather than full registration records. If your use case is heavy on European ccTLDs, test your target domains before committing to a paid tier.

Rate limit headers. The API returns an X-RateLimit-Requests-Remaining header on every response. Build your client to read this header and implement retry logic with at least a one-second backoff on 429 responses — this is especially relevant if you are running concurrent batch jobs on the PRO or ULTRA tiers.

Compound TLDs. The API correctly handles multi-level TLDs such as .co.uk, .com.br, and .com.au, routing them to the appropriate RDAP or WHOIS server automatically. No special handling is required in your client.

Getting started

The API is available via RapidAPI. Sign up for the BASIC plan (no credit card required) to explore the response schema across all four endpoints. The X-RateLimit-Requests-Remaining header will tell you exactly how much of your 500-request monthly budget remains.

Once you have validated the data shapes against your use case, the PRO plan at $10/month is the sensible next step for any production workload. If your query volume exceeds 30,000/month or you need the Registered Random Whois feature at meaningful scale, ULTRA at $30/month offers the best requests-per-dollar ratio among the standard tiers. Full documentation is available at whoisjson.com/documentation.