What is WHOIS?
WHOIS is a query and response protocol used to retrieve registration metadata for domain names, IP address blocks, and autonomous system numbers from public directories.
WHOIS is a TCP-based query protocol defined in RFC 3912 (2004) that allows anyone to look up registration details for Internet resources. It originated in the early 1980s (RFC 812, 1982) as a simple directory service for ARPANET users. Today it serves as the primary mechanism for discovering who owns a domain name, when it was registered, which registrar holds it, and what nameservers serve it.
The protocol operates on a request-response model over TCP port 43. A client sends a single text line containing the query string followed by a carriage return and line feed. The server replies with a free-form text block containing the registration record. Because the response format is not standardized beyond basic field conventions, different registries return data in different layouts. Modern WHOIS clients often parse these responses heuristically or rely on RESTful alternatives like RDAP (Registration Data Access Protocol) for structured JSON output.
WHOIS sits between the domain registration system and the public. Registrars collect registration data from customers and submit it to the central registry (e.g., Verisign for .com, Afilias for .info). The registry operates a WHOIS server that exposes this data. Regional Internet Registries (RIRs) such as ARIN, RIPE NCC, and APNIC run separate WHOIS servers for IP address and ASN allocations. The protocol has been criticized for privacy concerns since it exposes personal contact information. This led to GDPR-mandated redaction of registrant data in many TLDs starting in 2018, and to the development of RDAP as a replacement.
Key facts
- Defined in RFC 3912, replacing the earlier RFC 954 specification.
- Operates over TCP port 43 using a plain text query and response model.
- Returns registration data including registrar, creation date, nameservers, and contact info.
- Different TLDs and RIRs operate separate WHOIS servers with nonstandard output formats.
- GDPR and similar privacy laws have forced redaction of personal data in many WHOIS records.
How it works in practice
Related terms
References
More in Domains
Auth Code
A unique, per-domain secret code that the losing (current) registrar must provide so the gaining (new) registrar can authorize a domain transfer.
ccTLD
A ccTLD is a two-letter top-level domain assigned to a country or territory based on the ISO 3166-1 alpha-2 code, such as .us for the United States or .jp for Japan.
Domain Lock
A registrar-level status that prevents unauthorized domain transfers, modifications, or deletions until the registrant explicitly removes the lock.
Domain Privacy
An optional service that replaces the domain registrant's personal contact information in WHOIS records with the registrar's proxy details to shield the owner from spam and unwanted disclosure.
EPP
EPP (Extensible Provisioning Protocol) is an XML-based application protocol used by domain name registries and registrars to provision domain names, manage contacts, and transfer registrations.
Grace Period
The grace period is a window after a domain expires during which the registrant can renew at the standard renewal fee, without incurring additional redemption costs.
IDN
An Internationalized Domain Name (IDN) is a domain name that includes characters outside the ASCII set, encoded as Punycode for compatibility with the DNS.
Punycode
Punycode is a method defined in RFC 3492 for converting Unicode strings into ASCII labels, enabling Internationalized Domain Names (IDNs) to be used in the DNS.
RDAP
RDAP (Registration Data Access Protocol) is a modern RESTful protocol for querying domain name and IP address registration data, replacing the older WHOIS protocol with structured JSON responses and role-based access controls.
Registrant
The registrant is the legal holder of a domain name, listed as the owner in the registry database and responsible for the domain's renewal and administration.