WHOIS

WHOIS is a query/response protocol over TCP/43 for retrieving registration data about domain names, IP allocations and ASNs. A client connects to a registry or registrar WHOIS server, sends a single line containing the query, and receives an unstructured plain-text response with registrant, administrative and technical contacts, registration and expiry dates, name servers, and (for IP/ASN queries) allocation details from the relevant RIR.

Because WHOIS predates structured data formats, every server returns its output in a slightly different free-form layout, which makes reliable parsing difficult. It is also a thin-domain registry vs registrar split: the registry returns sparse data and points to the registrar, which holds the detailed contact records. Since GDPR and equivalent privacy regimes took effect, most public WHOIS responses for domains owned by individuals are redacted, with personal data replaced by registrar proxy contacts or omitted entirely. New tooling generally targets RDAP instead, which provides the same registration data in a structured, machine-readable form.

The WHOIS data model distinguishes between registrant, administrative, technical and abuse contacts, and between "thick" registries that return every field themselves and "thin" registries (classic .com) that delegate the detailed records to the sponsoring registrar. The protocol itself is an unauthenticated plain-text stream with no transport security, no standard response schema and no consistent rate-limiting across servers, which makes large-scale use fragile. Operationally WHOIS is still used daily for abuse handling (finding the right contact for an attacking IP or a phishing domain), trademark enforcement, due diligence during domain transfers, and automated expiry monitoring — often alongside RDAP where the response has to be parsed reliably.