Domain Check: Availability, WHOIS & Email Security

Domains registered worldwide: 370 million (Verisign) ·
Average domain registration cost: $10–$15/year ·
Percentage of top domains with DMARC: 50% (Valimail) ·
Number of domain extensions: 1,500+ (ICANN)

The pattern: the domain check has split into two jobs — finding a free name and verifying what a name already does. Most tools still only do one.

Eight data points, one pattern: the domain-checking world is moving from a single WHOIS query to a stack of security-aware lookups.

How to check if a domain name is available?

Availability is the question that brings most people here. The good news: it is free, instant, and the official records are public.

Using a domain registrar’s search tool

• Registrar search boxes, like GoDaddy’s domain checker, test a name across dozens of extensions in seconds.
• The search is free and does not require an account for basic results.
• If the name is taken, most tools show results across many TLDs in one search.

The registrar search answers one narrow question — can I register this name today? It does not tell you whether the name was ever owned before, whether it is on a blocklist, or whether mail sent from it will be trusted.

Using a domain availability checker website

• Independent checkers test the same name across multiple TLDs at once.
• Many combine availability with WHOIS and DNS lookups in a single report.
• Free tiers cover basic checks; advanced features usually require an account.

For the authoritative version of the same data, ICANN’s registration-data lookup tool uses RDAP services provided by registrars and registry operators, and its former WHOIS lookup now redirects there (ICANN lookup FAQ). An availability checker is only as good as the registry data behind it.

Using command line WHOIS

• The whois command queries registration records directly from the command line.
• It is still the required protocol for .com, .name, and .post.
• For scripting and bulk checks, RDAP’s structured data is the better fit.

Since January 28, 2025, gTLD registries and registrars are no longer required to provide WHOIS, with the exception of .com, .name, and .post (ICANN (the global domain authority)). RDAP is the standardized successor, and all gTLD registries and registrars must provide it under the gTLD RDAP Profile (ICANN (the global domain authority)).

How to perform a WHOIS lookup?

WHOIS is the classic way to inspect a domain’s record, but the lookup landscape changed underneath it. Here is what a modern lookup actually returns.

Understanding WHOIS data fields

• Registrant and administrative contacts: who owns and manages the domain.
• Registrar and registry: which company sold the name and which operator runs the TLD.
• Creation and expiry dates: when the domain was born and when renewal is due.
• Name servers: where the domain’s DNS points.

Privacy protection has changed how those fields appear. WHOIS and RDAP lookup results may omit personal registration details because of privacy laws and policy requirements, and applicable law and ICANN policy mean not all registration data must be returned in a lookup response (ICANN lookup FAQ). An empty registrant field is often a legal outcome, not a missing record.

Performing a WHOIS lookup online

• ICANN’s lookup tool is the official starting point for gTLD registration data.
• Registrar sites and third-party lookup services mirror the same registry data.
• Free lookup tools typically show domain status, expiry, and name servers.

ICANN’s current registration-data lookup tool uses RDAP services provided by registrars and registry operators, and it may use WHOIS failover when the requested information is unavailable through RDAP (ICANN lookup FAQ).

Using command line WHOIS

• The command line returns raw registration records without a web interface.
• RDAP clients return structured JSON, which is far easier to parse in scripts.
• Output varies by TLD because each registry controls its own data fields.

RDAP supports internationalization, secure access, authoritative-server discovery, and differentiated access to registration data (ICANN (the global domain authority)).

How to check email domain security (SPF, DMARC, BIMI)?

Email security is where a domain check stops being academic. One missing configuration can let attackers send mail that looks like yours.

What is DMARC?

• DMARC specifies handling and reporting policies for messages that fail SPF or DKIM-related checks (Microsoft (email-security documentation)).
• DMARC policies tell receiving servers to quarantine or reject unauthenticated mail.
• DMARC also gives legitimate senders visibility into who is trying to use their domain.

DMARC only works alongside the other two building blocks: SPF (Sender Policy Framework) identifies the mail servers authorized to send mail for a domain, and DKIM (DomainKeys Identified Mail) uses cryptographic signing to show that important message elements were not altered in transit (Microsoft (email-security documentation)).

Checking SPF and DKIM records

• SPF and DKIM are published as DNS TXT records on the domain.
• A DNS lookup shows whether the records exist and are formatted correctly.
• SPF, DKIM, and DMARC are intended to work together for effective domain email authentication (Microsoft (email-security documentation)).

A domain with SPF but no DMARC is like a locked front door with an open window: some forged mail is blocked, but messages that fail authentication still have no clear policy telling receivers what to do.

Using free tools like Valimail or Google’s checker

• Valimail’s domain checker tests SPF, DKIM, and DMARC in a single pass.
• Google’s email-domain health check focuses on authentication and deliverability signals.
• Both are free for single-domain lookups.

The scale of the problem shows up in Valimail’s own data: roughly half of the top domains now publish a DMARC policy. The other half are still exposed to spoofed mail wearing their name.

What are the best free domain checker tools?

No single tool covers every domain question. The best choice depends on whether you are hunting for an available name, verifying a registration, or checking how a domain behaves in email.

Valimail Domain Checker

• Purpose-built for DMARC and email authentication.
• Free for single-domain checks.
• Best when deliverability or spoofing is the concern.

Valimail’s checker is the tool to reach for when you are about to send mail from a domain, not merely register it. Its own data shows DMARC adoption at around 50% for top domains, so a quick check often finds a missing policy.

GoDaddy Domain Checker

• Purpose-built for availability: type a name, get instant results.
• Shows results across many TLDs in one search.
• Best for the first five seconds of a domain search.

GoDaddy’s checker is the classic registrar search box: fast, free, and designed to push you toward registration. It is not a security dashboard.

Google Email Domain Checker

• Focuses on email-domain health rather than registration.
• Useful for deliverability and authentication checks.
• Best for teams that send high volumes of email.

A free authentication-focused check gives a quick read on whether major providers will trust mail from your domain. It complements, rather than replaces, the official registration-data lookup.

Zoho WHOIS Lookup

• Shows registration details, expiry dates, and DNS records.
• Free for one-off lookups.
• Best when you need to identify who registered a domain or when it renews.

WHOIS-style tools still have one clear job: answering the ownership and expiry questions. Just remember that privacy rules may hide the personal details behind the record (ICANN lookup FAQ).

Five free options, one pattern: each tool answers exactly one question well, and none covers all four.

The trade-off: a tool that checks everything usually does none of it well. Pick the question first, then the tool — or run two quick checks instead of hunting for one magic dashboard.

How to perform a comprehensive domain health check?

A comprehensive check layers four questions on top of each other: Is the name free? What do the records say? Is the email authenticated? Is the DNS infrastructure sound?

Combining availability, WHOIS, security, and reputation checks

• Availability: can you register the name today?
• Registration data: ownership, status, expiry, and name servers via RDAP or WHOIS.
• Email security: SPF, DKIM, and DMARC policies.
• DNS integrity: DNSSEC and DANE protection.

DNSSEC digitally signs DNS records so resolvers can detect tampering and authenticate responses, and DANE uses that DNSSEC-backed information to help secure SMTP connections (Microsoft (DANE documentation)). For domains that send or receive critical mail, this layer belongs in the check.

Step-by-step process

• Run an availability check with a registrar search or an RDAP lookup.
• Pull the registration record and note the expiry date and status codes.
• Review DNS records for SPF, DKIM, and DMARC.
• Check whether DNSSEC is enabled and whether DANE applies to mail.
• Scan reputation signals, such as spam scores and blocklist status.
• Save the results and set a renewal reminder.

Tools that aggregate all checks

• ICANN’s lookup tool centralizes official registration data (ICANN lookup FAQ).
• Security checkers such as Valimail centralize email-authentication data.
• DNS checkers centralize record-level detail for SPF, DKIM, and DNSSEC.

No single free tool wraps every check into one report, so the practical workflow is a two-minute sequence across two or three tools.

Why this matters: a domain can pass the availability test and fail the email-security test at the same time. The health check is only as good as the widest net you cast.

Pros and cons of running a domain check

The tools are free, but they are also narrow. Weigh what a check gives you against what it can’t.

The trade-off: the same privacy rules that protect registrants also make verification harder. The check still works — it just answers fewer questions about who is behind a domain.

A five-minute domain maintenance routine

Set a recurring date — every six months, or before a big email campaign — and run these steps in order.

1. Check availability and expiry. Confirm the name is still yours, and renew before it lapses.
2. Pull the registration record. Look at status codes, name servers, and the last transfer date; unexpected changes are an early warning.
3. Review email authentication. Verify SPF, DKIM, and DMARC are published, and that DMARC has an actual policy rather than no policy.
4. Check DNS integrity. Confirm DNSSEC is enabled, especially if the domain handles email or payments.
5. Scan reputation signals. Run a spam-score check and look for blocklist entries.
6. Document the results. Keep a one-page record with the expiry date, the authentication status, and any actions due.

The implication: a check you run on a schedule beats a check you run in a panic. Expiry dates and authentication gaps do not fix themselves.

What’s confirmed and what’s still unclear

Here is where the evidence stands — the definitive facts first, then the open questions.

Confirmed facts

• RDAP is the standardized successor to WHOIS, and all gTLD registries and registrars must provide it (ICANN (the global domain authority)).
• Since January 28, 2025, WHOIS is required only for .com, .name, and .post (ICANN (the global domain authority)).
• SPF identifies authorized mail servers, DKIM signs message elements, and DMARC sets handling policy (Microsoft (email-security documentation)).
• DNSSEC digitally signs DNS records so resolvers can detect tampering (Microsoft (DANE documentation)).

What’s unclear

• How much registration data will stay public as privacy laws and ICANN policy evolve (ICANN lookup FAQ).
• WHOIS accuracy, which varies and is not guaranteed (ICANN lookup FAQ).
• The exact share of domains with spoofing protection, which differs by source and methodology.
• How quickly BIMI adoption spreads across major email clients.
• Whether the WHOIS exception for .com, .name, and .post will hold long-term.

The pattern: what is confirmed is the infrastructure shift — RDAP, DNSSEC, and the authentication stack. What stays unclear is how much of that infrastructure will remain publicly visible as privacy rules tighten.

What the records show

Three voices frame the modern domain check: the industry count, the regulator, and the security documentation.

“There were 370 million domain name registrations across all top-level domains as of the second quarter of 2024.”

— Verisign Domain Industry Report, Q2 2024

“ICANN requires domain registrars to publish registration data, but accuracy can vary.”

— ICANN, the global domain authority

“SPF, DKIM, and DMARC are intended to work together for effective domain email authentication.”

— Microsoft, email-security documentation

What this means: the scale of the domain system is enormous, the data is imperfect, and the security layers exist precisely because records alone cannot guarantee trust.

What this means for your next domain decision

The domain check has quietly changed jobs. It used to answer one question — is the name free? — and the modern version answers four: is it free, who held it, can it send trusted email, and is its DNS infrastructure sound. The tools for all four answers are free and take minutes to run. For a small business owner or solo founder about to commit to a name, the choice is clear: run the full check — availability, RDAP or WHOIS, SPF/DKIM/DMARC, and DNSSEC — before you register, or take a lottery ticket on a domain whose history, security, and reputation you will discover only after it starts costing you.

Frequently asked questions

Related reading

Two evergreen guides that take the same verification-first approach:

• Photo Frames: How to Choose Sizes, Materials, and Styles — a comparison-style guide to making the right pick under constraints.
• Roseberry Topping Walk: Route, Parking, Height & FAQs — a checklist-driven guide with practical FAQs.

Both follow the same principle: a little verification up front beats a costly surprise later.