(pronounced as the phrase "who is") is a query and response protocol
that is widely used for querying databases
that store the registered users or assignees of an Internet
resource, such as a domain name
, an IP address
block or an autonomous system
, but is also used for a wider range of other information. The protocol stores and delivers database content in a human-readable format.
The current iteration of the WHOIS protocol was drafted by the Internet Society
, and is documented in RFC 3912
Whois is also the name of the command-line utility on most UNIX
systems used to make WHOIS protocol queries.
In addition WHOIS has a sister protocol called Referral Whois
and her team (who had created the Resource Directory for ARPANET) were responsible for creating the first WHOIS directory in the early 1970s.
Feinler set up a server in Stanford's
Network Information Center (NIC) which acted as a directory that could retrieve relevant information about people or entities.
She and the team created domains
, with Feinler's suggestion that domains be divided into categories based on the physical address of the computer.
The process of registration was established in RFC 920. WHOIS was standardized in the early 1980s to look up domains, people, and other resources related to domain and number registrations. As all registration was done by one organization at that time, one centralized server was used for WHOIS queries. This made looking up such information very easy.
At the time of the emergence of the internet from the ARPANET, the only organization that handled all domain registrations was the Defense Advanced Research Projects Agency (DARPA)
of the United States government (created during 1958.
). Responsibility of domain registration remained with DARPA as the ARPANET became the Internet during the 1980s. UUNET
began offering domain registration service; however, they simply handled the paperwork which they forwarded to the DARPA Network Information Center (NIC). Then the National Science Foundation
directed that management of Internet domain registration would be handled by commercial, third-party entities. InterNIC
was formed in 1993 under contract with the NSF, consisting of Network Solutions, Inc.
, General Atomics
. The General Atomics contract was canceled after several years due to performance issues.
20th century WHOIS servers were highly permissive and would allow wild-card searches. A WHOIS query of a person's last name would yield all individuals with that name. A query with a given keyword returned all registered domains containing that keyword. A query for a given administrative contact returned all domains the administrator was associated with. Since the advent of the commercialized Internet, multiple registrars
and unethical spammers, such permissive searching is no longer available.
On December 1, 1999, management of the top-level domains
(TLDs) com, net, and org was assigned to ICANN
. At the time, these TLDs were converted to a thin WHOIS model. Existing WHOIS clients stopped working at that time. A month later, it had self-detecting Common Gateway Interface
support so that the same program could operate a web-based WHOIS lookup, and an external TLD table to support multiple WHOIS servers based on the TLD of the request. This eventually became the model of the modern WHOIS client.
By 2005, there were many more generic top-level domains than there had been in the early 1980s. There are also many more country-code top-level domains. This has led to a complex network of domain name registrars
and registrar associations, especially as the management of Internet infrastructure has become more internationalized. As such, performing a WHOIS query on a domain requires knowing the correct, authoritative WHOIS server to use. Tools to do WHOIS domain searches have become common.
CRISP and IRIS
- 3981 - Newton, A.; Sanz, M. (January 2005). IRIS: The Internet Registry Information Service (IRIS) Core Protocol. IETF. doi:10.17487/RFC3981. STD 8. RFC 3981. Retrieved June 1, 2015.
- 3982 - Newton, A.; Sanz, M. (January 2005). IRIS: A Domain Registry (dreg) Type for the Internet Registry Information Service (IRIS). IETF. doi:10.17487/RFC3982. RFC 3982. Retrieved June 1, 2015.
- 3983 - Newton, A.; Sanz, M. (January 2005). Using the Internet Registry Information Service (IRIS) over the Blocks Extensible Exchange Protocol (BEEP). IETF. doi:10.17487/RFC3983. RFC 3983. Retrieved June 1, 2015.
- 4992 - Newton, A. (August 2007). XML Pipelining with Chunks for the Internet Registry Information Service. IETF. doi:10.17487/RFC4992. RFC 4992. Retrieved June 1, 2015.
: The IETF CRISP working group is not to be confused with the Number Resource Organization
's (NRO) Team of the same name "Consolidated RIR IANA Stewardship Proposal Team" (CRISP Team).
WEIRDS and RDAP
In 2013, the IETF acknowledged that IRIS had not been a successful replacement for WHOIS. The primary technical reason for that appeared to be the complexity of IRIS. Further, non-technical reasons were deemed to lie in areas upon which the IETF does not pass judgment. Meanwhile, ARIN
and RIPE NCC
managed to serve WHOIS data via RESTful web services
. The charter (drafted in February 2012) provided for separate specifications, for number registries first and for name registries to follow.
The working group produced five proposed standard documents:
- 7480 - Newton, Andrew; Ellacott, Byron; Kong, Ning (March 2015). HTTP Usage in the Registration Data Access Protocol (RDAP). IETF. doi:10.17487/RFC7480. RFC 7480. Retrieved July 8, 2015.
- 7481 - Hollenbeck, Scott; Kong, Ning (March 2015). Security Services for the Registration Data Access Protocol (RDAP). IETF. doi:10.17487/RFC7481. RFC 7481. Retrieved July 8, 2015.
- 7482 - Newton, Andrew; Hollenbeck, Scott (March 2015). Registration Data Access Protocol (RDAP) Query Format. IETF. doi:10.17487/RFC7482. RFC 7482. Retrieved July 8, 2015.
- 7483 - Newton, Andrew; Hollenbeck, Scott (March 2015). JSON Responses for the Registration Data Access Protocol (RDAP). IETF. doi:10.17487/RFC7483. RFC 7483. Retrieved July 8, 2015.
- 7484 - Blanchet, Marc (March 2015). Finding the Authoritative Registration Data (RDAP) Service. IETF. doi:10.17487/RFC7484. RFC 7484. Retrieved July 8, 2015.
and an informational document:
The WHOIS protocol had its origin in the ARPANET NICNAME protocol
and was based on the NAME/FINGER Protocol
, described in RFC 742 (1977). The NICNAME/WHOIS protocol was first described in RFC 812 in 1982 by Ken Harrenstien and Vic White of the Network Information Center at SRI International
WHOIS was originally implemented on the Network Control Program
(NCP) but found its major use when the TCP/IP
suite was standardized across the ARPANET and later the Internet.
The protocol specification is the following (original quote):
Connect to the service host
TCP: service port 43 decimal
NCP: ICP to socket 43 decimal, establishing two 8-bit connections
Send a single "command line", ending with <CRLF>.
Receive information in response to the command line. The
server closes its connections as soon as the output is
The command line
server query is normally a single name specification. i.e. the name of a resource. However, servers accept a query, consisting of only the question mark (?) to return a description of acceptable command line formats. Substitution or wild-card
formats also exist, e.g., appending a full-stop
(period) to the query name returns all entries beginning with the query name.
On the modern Internet, WHOIS services are typically communicated using the Transmission Control Protocol
(TCP). Servers listen to requests on the well-known port number
43. Clients are simple applications that establish a communications channel to the server, transmit a text record with the name of the resource to be queried and await the response in form of a sequence of text records found in the database. This simplicity of the protocol also permits an application, and a command line interface user, to query a WHOIS server using the Telnet
In 2014, June ICANN published the recommendation for status codes, the "Extensible Provisioning Protocol (EPP) domain status codes"
WHOIS lookups were traditionally performed with a command line interface
application, but now many alternative web-based tools exist.
A WHOIS database consists of a set of text records for each resource. These text records consists of various items of information about the resource itself, and any associated information of assignees, registrants, administrative information, such as creation and expiration dates.
Two data models exist for storing resource information in a WHOIS database, the thick and the thin model.
Thin and thick lookups
WHOIS information can be stored and looked up according to either a thick or a thin data model:
A Thick WHOIS server stores the complete WHOIS information from all the registrars for the particular set of data (so that one WHOIS server can respond with WHOIS information on all .org
domains, for example).Thin
A Thin WHOIS server stores only the name of the WHOIS server of the registrar of a domain, which in turn has the full details on the data being looked up (such as the .com
WHOIS servers, which refer the WHOIS query to the registrar where the domain was registered).
The thick model usually ensures consistent data and slightly faster queries, since only one WHOIS server needs to be contacted. If a registrar goes out of business, a thick registry contains all important information (if the registrant entered correct data, and privacy features were not used to obscure the data) and registration information can be retained. But with a thin registry, the contact information might not be available, and it could be difficult for the rightful registrant to retain control of the domain.
If a WHOIS client did not understand how to deal with this situation, it would display the full information from the registrar. Unfortunately, the WHOIS protocol has no standard for determining how to distinguish the thin model from the thick model.
Specific details of which records are stored vary among domain name registries
. Some top-level domains
, including com
, operate a thin WHOIS, requiring domain registrars to maintain their own customers' data. The other global top-level registries, including org
, operate a thick model.
Each country-code top-level registry has its own national rules.
The first applications written for the WHOIS information system were command-line interface
tools for Unix
operating systems (i.e. Solaris, Linux etc.). WHOIS client and server software is distributed as free open-source software
and binary distributions are included with all Unix-like
systems. Various commercial Unix implementations may use a proprietary implementation (for example, Solaris
A WHOIS command line client passes a phrase given as an argument directly to the WHOIS server. Various free open source examples can still be found on sites such as sourceforge.net. However, most modern WHOIS tools implement command line flags or options, such as the -h option to access a specific server host, but default servers are preconfigured. Additional options may allow control of the port number
to connect on, displaying additional debugging data, or changing recursion/referral behavior.
Like most TCP/IP client–server
applications, a WHOIS client takes the user input and then opens an Internet socket
to its destination server. The WHOIS protocol manages the transmission of the query and reception of results.
With the advent of the World Wide Web
and especially the loosening up of the Network Solutions
monopoly, looking up WHOIS information via the web has become quite common. At present, popular web-based WHOIS-queries may be conducted from ARIN
Most early web-based WHOIS clients were merely front-ends to a command-line client, where the resulting output just gets displayed on a web page with little, if any, clean-up or formatting.
Currently, web based WHOIS clients usually perform the WHOIS queries directly and then format the results for display. Many such clients are proprietary, authored by domain name registrars.
The need for web-based clients came from the fact that command-line WHOIS clients largely existed only in the Unix and large computing worlds. Microsoft Windows
and Macintosh computers had no WHOIS clients installed by default, so registrars had to find a way to provide access to WHOIS data for potential customers. Many end-users still rely on such clients, even though command line and graphical clients exist now for most home PC platforms. Microsoft provides the Sysinternals Suite
that includes a whois client at no cost.
has several Perl
modules available that work with WHOIS servers. Many of them are not current and do not fully function with the current (2005) WHOIS server infrastructure. However, there is still much useful functionality to derive including looking up AS numbers
and registrant contacts.
Regional Internet registries
Regional Internet registries
The records of each of these registries are cross-referenced, so that a query to ARIN
for a record which belongs to RIPE
will return a placeholder pointing to the RIPE WHOIS server. This lets the WHOIS user making the query know that the detailed information resides on the RIPE server. In addition to the RIRs servers, commercial services exist, such as the Routing Assets Database
used by some large networks (e.g., large Internet providers that acquired other ISPs in several RIR areas).
There is currently no standard for determining the responsible WHOIS server for a DNS domain, though a number of methods are in common use for top-level domains
(TLDs). Some WHOIS lookups require searching the procuring domain registrar to display domain owner details.
Normally the contact information of the resources assignee is returned. However, some registrars offer private registration, in which case the contact information of the registrar is shown instead.
Some registry operators are wholesalers, meaning that they typically provide domain name services to a large number of retail registrars, who in turn offer them to consumers. For private registration, only the identity of the wholesale registrar may be returned. In this case, the identity of the individual as well as the retail registrar may be hidden.
Below is an example of WHOIS data returned for an individual resource holder. This is the result of a WHOIS query of example.com
[Redirected to whois.iana.org]
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object
organisation: Internet Assigned Numbers Authority
) is an extension of the original Whois protocol and service. RWhois extends the concepts of Whois in a scalable
, hierarchical fashion, potentially creating a system with a tree-like architecture. Queries are deterministically routed to servers based on hierarchical labels, reducing a query to the primary repository of information.
RWhois is intended to replace Whois, providing an organized hierarchy of referral services where one could connect to any RWhois server, request a look-up and be automatically re-directed to the correct server(s). However, while the technical functionality is in place, adoption of the RWhois standard has been weak.
Rwhois was first specified in RFC 1714 in 1994 by Network Solutions
but the specification was superseded in 1997 by RFC 2167.
The referral features of RWhois are different than the feature of a Whois server to refer responses to another server, which RWhois also implements.
One criticism of WHOIS is the lack of full access to the data.
Few parties have realtime access to the complete databases.
Others cite the competing goal of domain privacy
as a criticism, although this problem is strongly mitigated by domain privacy services. Currently, the Internet Corporation for Assigned Names and Numbers
) broadly requires that the mailing address
, phone number
and e-mail address
of those owning or administering a domain name to be made publicly available through the "WHOIS" directories. The registrant's (domain owner's) contact details, such as address and telephone number, are easily accessible to anyone who queries a WHOIS server. However, that policy enables spammers, direct marketers, identity thieves or other attackers to loot the directory for personal information about these people. Although ICANN has been exploring changing WHOIS to enable greater privacy, there is a lack of consensus among major stakeholders as to what type of change should be made.
Some domain registrars offer private registrations (also known as domain privacy), by which the contact information of the registrar is shown instead of the customer's. With the offer of private registration from many registrars, some of the risk has been mitigated.
Studies have shown that spammers can and do harvest plain-text email addresses from WHOIS servers.
For this reason, some WHOIS servers and websites offering WHOIS queries have implemented rate-limiting systems, such as web-based CAPTCHA
and limited amounts of search queries per user IP address
The WHOIS requirements conflict with the General Data Protection Regulation
(GDPR), effective in the European Union 25 May 2018, which places strict regulations on the processing and publication of personally identifiable information. ICANN stated in November 2017 that it would not reprimand "noncompliance with contractual obligations related to the handling of registration data" if registrars provide alternative solutions for compliance with its rules, until the WHOIS requirements are updated to take GDPR into account.
The WHOIS protocol was not written with an international audience in mind. A WHOIS server and/or client cannot determine the text encoding in effect for the query or the database content. Many servers were originally using US-ASCII
and Internationalization concerns were not taken into consideration until much later.
This might impact the usability or usefulness of the WHOIS protocol in countries outside the USA.
In the case of internationalized domain names
it is the responsibility of the client application to perform the translation of the domain name between its native language script and the DNS name in punycode
Accuracy of information
In cases where the registrant's (Domain Owner) identity is public, anyone can easily confirm the status of a domain via WHOIS.
In the case of private registrations, ascertaining registration information may be more difficult. If a registrant, who acquired a domain name, wants to verify the registrar has completed the registration process, three steps may be required:
- Perform a WHOIS and confirm that the resource is at least registered with ICANN,
- Determine the name of the wholesale registrar, and
- Contact the wholesaler and obtain the name of the retail registrar.
This provides some confidence that the retailer actually registered the name. But if the registrar goes out of business, as with the failure of RegisterFly
in 2007, the rightful domain holder with privacy-protected registrations may have difficulty regaining the administration of their domain name.
Registrants using "private registration" can attempt to protect themselves by using a registrar that places customer data in escrow with a third party.
ICANN requires that every registrant of a domain name be given the opportunity to correct any inaccurate contact data associated with their domain. For this reason, registrars are required to periodically send the holder the contact information on record for verification, but they do not provide any guarantee about the accuracy of information if the registrant provided inaccurate information.
Law and policy
WHOIS has generated policy issues in the United States federal government. As noted above, WHOIS creates a privacy
issue which is also tied to free speech
. However, WHOIS is an important tool for law enforcement officers investigating violations like spam
to track down the holders of domain names. As a result, law enforcement agencies have sought to make WHOIS records both open and verified:
- The Federal Trade Commission has testified about how inaccurate WHOIS records thwart their investigations.
- Congressional hearings have been conducted about the importance of WHOIS in 2001, 2002 and 2006.
- The Fraudulent Online Identity Sanctions Act "make it a violation of trademark and copyright law if a person knowingly provided, or caused to be provided, materially false contact information in making, maintaining, or renewing the registration of a domain name used in connection with the violation," where the latter "violation" refers to a prior violation of trademark or copyright law. The act does not make the submission of false WHOIS data illegal in itself, only if used to shield oneself from prosecution for crimes committed using that domain name.
ICANN proposal to abolish WHOIS
The Expert Working Group (EWG) of the Internet Corporation for Assigned Names and Numbers (ICANN
) recommended on 24 June 2013 that WHOIS should be scrapped. It recommends that WHOIS be replaced with a system that keeps information secret from most Internet users, and only discloses information for "permissible purposes".
ICANN's list of permissible purposes includes domain-name research, domain-name sale and purchase, regulatory enforcement, personal data protection, legal actions, and abuse mitigation.
Although WHOIS has been a key tool of journalists in determining who was disseminating certain information on the Internet,
the use of WHOIS by the free press is not included in ICANN's proposed list of permissible purposes.
The EWG collected public input on the initial report until 13 September 2013. Its final report was issued on 6 June 2014, without meaningful changes to the recommendations.
As of March 2015, ICANN is in the "process of re-inventing WHOIS," working on "ICANN WHOIS Beta."
- RFC 812 – NICNAME/WHOIS (1982, obsolete)
- RFC 954 – NICNAME/WHOIS (1985, obsolete)
- RFC 3912 – WHOIS protocol specification (2004, current)
- ^ a b RFC 3912, WHOIS Protocol Specification, L. Daigle (September 2004)
- ^https://www.darpa.mil/attachments/DARPA_Innovation_2016.pdf accessed and retrieved April 19th, 2019
- ^ Murphy, Cathy (2 October 2003). "CRISP (Cross-Registry Information Service Protocol) Working Group Meeting Minutes". Internet Engineering Task Force. Minneapolis, Minnesota USA: IETF. Archived from the original on 1 June 2015. Retrieved 1 June 2015. The CRISP (Cross-Registry Information Service Protocol) WG will define a standard mechanism that can be used for finding authoritative information associated with a label, a protocol to transport queries and responses for accessing that information, and a first profile (schema & queries) to support commonly-required queries for domain registration information.
- ^ Newton, Andrew (July 2006). "Replacing the Whois Protocol: IRIS and the IETF's CRISP Working Group". IEEE Internet Computing. 10 (4): 79–84. doi:10.1109/MIC.2006.86. S2CID 8514005. Retrieved 1 June 2015. The Nicname/Whois protocol has served well, but it remains unchanged since it was first published in the early 1980s, despite great change in the infrastructure and administration of the Internet. There is now more diversity with domain names and IP networks and associated contacts, as well as among the users submitting queries via Whois. The protocol is now so fragmented in terms of information flow and output that queries yield inconsistent results under current conditions. To address the needs of today's Internet, the IETF Cross Registry Internet Service Protocol (CRISP) working group is developing a new protocol, the Internet Registry Information Service (IRIS), to replace Whois.
- ^ Sanz, Marcos; Newton, Andrew; Daigle, Leslie (12 January 2005). "The Internet Registry Information Service (IRIS) Protocol" (PDF). gnso.icann.org. Internet Corporation for Assigned Names and Numbers (ICANN). Archived from the original (PDF) on 1 June 2015. Retrieved 1 June 2015. CRISP - Cross-Registry Internet Service Protocol: The CRISP Working Group was tasked with finding a solution to the problems that currently infest the Nicname/Whois protocol. The CRISP Working Group created a list of functional requirements. Proposals meeting these requirements were evaluated. IRIS was selected as the protocol to publish as a standard. Now an IETF Proposed Standard: RFCs: 3981, 3982, 3983
- ^ "Crisp Status Pages". IETF Tools: CRISP WG Status Pages. IETF. Archived from the original on 1 June 2015. Retrieved 2 June 2015.
- ^ IESG Secretary (26 March 2009). "WG Action: Conclusion of Cross Registry Information Service Protocol (crisp)". IETF CRISP WG: Mail Archive. Archived from the original on 2 June 2015. Retrieved 2 June 2015. The Cross Registry Information Service Protocol (crisp) working group in the Applications Area has concluded.
- ^ Mevzek, Patrick (21 January 2009). "[CRISP] RFC 5144 up and running". IETF CRISP WG: Mail Archive. Archived from the original on 2 June 2015. Retrieved 2 June 2015.
- ^ Nimpuno, Nurani. "Consolidated RIR IANA Stewardship Proposal Team (CRISP Team)". nro.net. Number Resource Organization (NRO). Retrieved 1 June 2015.
- ^ "Web Extensible Internet Registration Data Service (weirds) Working Group". IETF-88 Proceedings. IETF. Retrieved 8 July 2015.
- ^ RFC 812: NICNAME/WHOIS, K.Harrenstien, V.White (1982)
- ^ "EPP Status Codes - What Do They Mean, and Why Should I Know? - ICANN". www.icann.org. Retrieved 14 March 2018.
- ^ a b ".COM and .NET: Thick Or Thin?".
- ^ Sarah Stoll (30 May 2009). "Thick vs. Thin Whois for New gTLDs" (PDF). memorandum. ICANN. Retrieved 17 September 2011. Current gTLD registry agreements vary between thin and thick Whois outputs: com, net and jobs are thin; all other gTLD agreements – aero, asia, biz, cat, coop, info, mobi, museum, name, org, pro, tel, travel – are thick.
- ^ "Whois-RWS". whois.arin.net.
- ^ "Webupdates". RIPE Network Coordination Centre.
- ^ "Whois search – Page 2 – APNIC". www.apnic.net.
- ^ https://whois.icann.org/en/dns-and-whois-how-it-works
- ^ a b RFC 1714, Referral Whois Protocol (RWhois), S. Williamson, M. Kosters (November 1994)
- ^ RFC 2167, Referral Whois (RWhois) V1.5, S. Williamson, M. Kosters, D. Blacka, J. Singh, K. Zeilstra (June 1997)
- ^ "Battle Begins Over IP Address Whois Data". Internet Governance Project. Retrieved 4 April 2015.
- ^ "WHOIS Privacy Plan Draws Fire". KerbsonSecurity. Retrieved 4 April 2015.
- ^ "The Privacy Conundrum in Domain Registration". Act Now Domains. Retrieved 26 March 2013.
- ^ a b c "WHATIS Going to Happen With WHOIS?". Motherboard. 2018-02-02. Retrieved 2018-04-28.
- ^ "SAC 023: Is the WHOIS Service a Source for email Addresses for Spammers?", ICANN Security and Stability Advisory Committee, October 2007
- ^ Vaughan-Nichols, Steven J. "ICANN makes last minute WHOIS changes to address GDPR requirements". ZDNet. Retrieved 2018-05-29.
- ^ "WHOIS Internalization Issues", November 2012
- ^ "FTC Calls for Openness, Accessibility in Whois Database System - Federal Trade Commission". www.ftc.gov.
- ^ "Accuracy of "WHOIS" Internet Database Essential to Law Enforcement, FTC Tells Congress - Federal Trade Commission". www.ftc.gov.
- ^ Bowman, Lisa (11 July 2001). "Whois at heart of congressional hearings". CNET. Archived from the original on 27 August 2005.
- ^ "THOMAS".
- ^ "Fraudulent Online Identity Sanctions Act".
- ^ "Initial Report from the Expert Working Group on gTLD Directory Services: A Next Generation Registration Directory Service" (PDF). whois.icann.org. ICANN. 24 June 2013. Retrieved 24 March 2015.
- ^ "Archived copy". Archived from the original on 2014-01-14. Retrieved 2014-01-13.
- ^ "SJMC: COMMON SENSE JOURNALISM". jour.sc.edu. Archived from the original on 2005-01-12.
- ^ "Final Report from the Expert Working Group on gTLD Directory Services: A Next-Generation Registration Directory Service (RDS)" (PDF). whois.icann.org. ICANN. 6 June 2014. Retrieved 24 March 2015.
- ^ "About WHOIS". whois.icann.org/. ICANN. Retrieved 24 March 2015.
- ^ "What's on the Horizon?". whois.icann.org. ICANN. Retrieved 24 March 2015.
Last edited on 16 June 2021, at 15:57
Content is available under CC BY-SA 3.0
unless otherwise noted.