Whois — Registration, Ownership and Nameserver Records
Whois returns the registration record behind a domain: which registrar holds it, when it was created and when it expires, which nameservers are delegated at the registry level, and the status codes that describe what may currently be done to it. Contact details are largely redacted now, but the operational fields are intact and they are the ones that matter for diagnosis.
Why run it
The status codes are the underused part. They tell you whether a domain is locked against transfer, whether it is in a redemption period after a missed renewal, or whether it is pending deletion — states that explain a great many otherwise baffling situations. The delegated nameservers matter too, because they are the authoritative answer to a question the zone itself cannot settle: if the registry delegates to different nameservers than the ones you are editing, your changes are going nowhere and everything will look correct on your end.
Why automate it
A registration record should be boring, and the value of watching it is entirely in the exceptions. A registrar changing, a transfer lock being lifted, a status code moving to pending deletion, nameservers being redelegated — each is either a change you made or a serious problem, and the ones you did not make are the point. Domain hijacking begins with exactly these fields changing, usually quietly, and a scheduled check that alerts on any difference is the cheapest detection available.
What it gives you
The registry's own view of your domain, which is the authoritative one when it disagrees with yours. Watched continuously, it is an early warning for both administrative mistakes and deliberate attacks on ownership.