1. What is the WHOIS protocol?
WHOIS is a query/response protocol used to retrieve registration and ownership information for Internet resources such as domain names, IP address blocks, and autonomous system numbers. It operates as a simple text-based service, typically over TCP port 43.
2. On which port does the WHOIS protocol run by default?
Port 43 (TCP). This is the standard IANA-assigned port for WHOIS services.
3. What does a typical WHOIS query look like?
A simple text command sent to a WHOIS server, e.g.:
whois example.comor directly via telnet/netcat:
echo "example.com" | nc whois.iana.org 434. What are the main RFCs that define the WHOIS protocol?
- RFC 3912 (2004) – WHOIS Protocol Specification (current standard).
- Earlier documents include RFC 954 (1985) and RFC 812.
5. What information does a domain WHOIS record typically contain?
Registrar, registration dates (creation, update, expiration), name servers, registrant contact data (name, organization, address, email, phone), and sometimes technical/administrative contacts.
6. What is the difference between “Thick” and “Thin” WHOIS?
- Thick WHOIS: The registry holds the full record (including registrant contact data).
- Thin WHOIS: The registry only holds basic info (registrar, name servers, dates); full contact data is held by the registrar.
7. How does WHOIS differ from RDAP?
RDAP (Registration Data Access Protocol) is the modern successor to WHOIS. It uses HTTPS, supports structured JSON data, authentication, internationalization, and better access control, whereas WHOIS is an older, plain-text protocol.
8. Who operates WHOIS servers?
Domain registries (e.g., Verisign for .com, PIR for .org), registrars, and regional internet registries (RIRs) such as ARIN, RIPE NCC, APNIC, etc., for IP addresses and ASNs.
9. What is the IANA WHOIS server used for?
whois.iana.org serves as a root server that redirects queries to the appropriate TLD-specific or RIR-specific WHOIS server.
10. How has GDPR affected WHOIS data?
Since 2018, GDPR has led to significant redaction of personal data (name, address, phone, email) in public WHOIS records for European registrants, replacing it with anonymized or privacy-protected contact information.
11. What command-line tools are commonly used for WHOIS queries?
whois(standard Unix/Linux tool)dig(for some DNS-related info)- Third-party clients such as
whois-client,JWhois, or online services like whois.com, icann.org lookup.
12. What is a WHOIS referral?
When a WHOIS server does not have the authoritative data, it returns a referral to another server that does (e.g., from IANA to a specific registrar server).
13. Can you query IP address blocks with WHOIS?
Yes. Regional Internet Registries (RIRs) maintain WHOIS databases for IPv4/IPv6 allocations. Example: querying ARIN for an IP range returns organization, net range, and abuse contact information.
14. What are common limitations of the WHOIS protocol?
- Lack of standardized output format
- Rate limiting and abuse prevention
- No built-in security or encryption
- Inconsistent data quality across registries
- Poor support for internationalized domain names (IDNs) in older implementations
15. How do you query a specific WHOIS server?
Use the -h flag with most whois clients:
whois -h whois.verisign-grs.com example.com16. What is the “registrar WHOIS” vs “registry WHOIS”?
- Registry WHOIS: Operated by the TLD registry (e.g., Verisign for .com).
- Registrar WHOIS: Operated by the accredited registrar that sold the domain to the end user.
17. Is WHOIS data real-time?
No. There is often propagation delay (minutes to hours) between changes in the registry database and when they appear in public WHOIS responses.
18. What organizations oversee WHOIS policy?
ICANN (Internet Corporation for Assigned Names and Numbers) sets policy for gTLD WHOIS/RDAP requirements through contracts with registries and registrars.
19. Give an example of a basic WHOIS response structure.
Typical fields include:
Domain Name: EXAMPLE.COM
Registrar: Example Registrar, Inc.
Creation Date: 1995-08-13T00:00:00Z
Registry Expiry Date: 2026-08-12T23:59:59Z
Name Server: NS1.EXAMPLE.COM
...20. What is the future of the WHOIS protocol?
ICANN and the industry are transitioning toward RDAP as the primary protocol. WHOIS is considered legacy and will likely be phased out or kept only for backward compatibility due to its security and privacy limitations.