WHOIS
WHOIS is the original protocol for looking up domain registration data, dating to 1982. It runs over TCP port 43 and returns unstructured text. ICANN sunset WHOIS for gTLDs on January 28, 2025 in favour of RDAP, though most registrars still provide it for backward compatibility. Country-code TLDs largely retain WHOIS as their primary lookup.
In depth
WHOIS predates the modern web. It was first specified in RFC 812 (1982) for ARPANET, then RFC 954 (1985), then RFC 3912 (2004) — each version a minor update of essentially the same protocol: connect to TCP port 43, send a query, receive a free-text response.
Because the response format was never standardised, every registry and registrar formats their WHOIS output differently. This makes parsing painful: domain monitoring tools have to maintain per-registrar parsers and constantly update them. RDAP solved this by mandating a JSON schema, which is one major reason ICANN deprecated WHOIS.
For ccTLDs, WHOIS remains the primary lookup mechanism in many cases. .de, .uk, .fr, and most other major ccTLDs operate WHOIS port-43 services with their own response formats. RDAP support among ccTLDs is uneven — some have full implementations, others have nothing.
Privacy-wise, GDPR forced major changes in 2018. EU-based registrants have nearly all PII redacted from WHOIS responses. Many registrars apply the same redaction globally for consistency.
Examples
- Classic WHOIS query: connect to whois.verisign-grs.com:43, send "example.com\r\n", read the response.
- Most operating systems include a whois command-line tool: "whois example.com" works on Linux, macOS, and (with installation) Windows.
- "whoiser" is the most-used Node.js WHOIS client; it handles the per-registrar parsing complexity.
Frequently asked questions
Is WHOIS dead?
For gTLDs, officially yes (ICANN sunset January 2025). In practice, most registrars still provide WHOIS port-43 service for backward compatibility. For ccTLDs, WHOIS remains essential.
Why is WHOIS data so inconsistent?
The protocol never standardised the response format. Every registry and registrar invented their own. This is what RDAP fixed.
What does redacted WHOIS look like?
Post-GDPR, registrant fields typically read "REDACTED FOR PRIVACY" or contain a generic email like "[email protected]". Technical information (nameservers, dates, registrar) remains visible.
How do I run a WHOIS query manually?
On Linux/macOS: "whois example.com". On Windows: install Sysinternals' whois.exe. Or use any web-based WHOIS tool — they all wrap the same port-43 protocol.
Can I trust WHOIS data?
For technical information (status, dates, nameservers, registrar), yes. For registrant contact information, less so — registrants can submit inaccurate details, and ICANN's verification process is light.
Related terms
References
Watch a domain you want to buy — snooze.domains tracks the lifecycle and emails you when it changes status. Free, up to 100 domains. Start watching — free