Lecture
WHOIS (pronounced as the phrase «who is») — is a query and response protocol that is used to query databases that store the registered users or right holders of an internet resource. These resources include domain names, blocks of IP addresses, and autonomous systems, but it is also used for a wider range of other information. The protocol stores and delivers the contents of the database in a human-readable format. The current version of the WHOIS protocol was developed by the Internet Society and documented in RFC 3912.
Whois is also the name of a command-line utility on most UNIX systems, used to perform WHOIS protocol queries. In addition, WHOIS has a related protocol called Referral Whois (RWhois).
Elizabeth Feinler and her team (who created the Resource Directory for ARPANET) were responsible for creating the first WHOIS directory in the early 1970s. Feinler set up a server at the Stanford Network Information Center (NIC), which acted as a directory that could retrieve relevant information about people or organizations. She and her team created domains, at Feinler's suggestion, so that domains would be divided into categories based on the physical address of the computer.
The registration process was established in RFC 920. WHOIS was standardized in the early 1980s for looking up domains, people, and other resources related to domain and IP address registration. Since at the time all registration was carried out by a single organization, a single centralized server was used for WHOIS queries. This greatly simplified the search for such information.
At the time the Internet emerged from ARPANET, the only organization that handled all domain registrations was the US Department of Defense's Advanced Research Projects Agency (DARPA) (founded in 1958. ). Responsibility for domain registration remained with DARPA as ARPANET became the Internet in the 1980s. UUNET began offering domain registration services; however, they simply handled the paperwork, which they forwarded to the DARPA Network Information Center (NIC). The National Science Foundation then ruled that commercial third-party organizations would handle the management of domain registration on the Internet. InterNIC was formed in 1993 under a contract with the NSF, consisting of Network Solutions, Inc., General Atomics, and AT&T. The contract with General Atomics was terminated a few years later due to performance issues.
20th-century WHOIS servers were quite permissive and allowed wildcard searches. A WHOIS query for a person's last name would return all people with that name. A query with a given keyword would return all registered domains containing that keyword. A query for a given administrative contact would return all domains with which that administrator was associated. With the emergence of the commercialized Internet, multiple registrars, and unethical spammers, such permissive searching is no longer available.
On December 1, 1999, management of the top-level domains (TLD) com, net, and org was assigned to ICANN. At that time these TLDs were converted to a thin WHOIS model. Existing WHOIS clients at the time stopped working. A month later it had support for a self-determining Common Gateway Interface, so that the same program could perform WHOIS web searches, and an external TLD table to support multiple WHOIS servers based on the TLD of the query. This eventually became the model for the modern WHOIS client.
By 2005, there were far more generic top-level domains than in the early 1980s. There were also far more country-code top-level domains. This led to a complex network of domain name registrars and registrar associations, especially as management of Internet infrastructure became more internationalized. Thus, performing a WHOIS query for a domain requires knowing the correct, authoritative WHOIS server to use. Tools for looking up WHOIS domains have become commonplace and are offered by vendors such as IONOS and Namecheap.
In 2003, an IETF committee was formed to create a new standard for looking up information about domain names and network IP addresses: the Cross Registry Information Service Protocol (CRISP). From January 2005 to July 2006, the working name of this proposed new standard was the Internet Registry Information Service (IRIS)
The status of the RFCs this group worked on can be found on the IETF Tools website.
As of March 2009, the IETF CRISP working group reached a conclusion after the final RFC 5144 was published by the group Newton, Andrew; Sanz, Marcos (February 2008). Domain Availability Check (DCHK) Registry Type for the Internet Registry Information Service (IRIS) . IETF . doi : 10.17487/RFC5144 . RFC 5144 . Retrieved June 1, 2015 . .
Note: The IETF CRISP working group should not be confused with the similarly named group of the Number Resource Organization (NRO), the «Consolidated RIR IANA Stewardship Proposal Team» (CRISP team). [14]
In 2013, the IETF recognized that IRIS had not become a successful replacement for WHOIS. The main technical reason for this appears to have been the complexity of IRIS. In addition, non-technical reasons were considered to lie in areas on which the IETF does not pass judgment. Meanwhile, ARIN and RIPE NCC managed to serve WHOIS data via RESTful web services. The charter (drawn up in February 2012) called for separate specifications, first for IP address registries, and then for name registries.
The WHOIS protocol has its origins in the ARPANET NICNAME protocol and was based on the NAME/FINGER protocol, described in RFC 742 (1977). The NICNAME/WHOIS protocol was first described in RFC 812 in 1982 by Ken Harrenstien and Vic White of the SRI International Network Information Center.
WHOIS was originally implemented on the basis of the Network Control Protocol (NCP), but found its main use once the TCP/IP protocol suite was standardized on ARPANET, and later on the Internet.
The protocol specification is as follows (original quote):
Connect to the service host TCP: service port 43 decimal NCP: ICP to socket 43 decimal, establishing two 8-bit connections Send a single "command line" ending with <CRLF>. Receive information in response to the command line. the server closes its connections as soon as the output is finished.
A command-line query to a server is usually a specification of a single name, i.e. the name of a resource. However, servers accept a query consisting solely of a question mark (?) to return a description of the acceptable command-line formats. There are also substitution or wildcard formats, for example, appending a dot to the query name returns all records that start with the query name.
On the modern Internet, WHOIS services generally communicate using the Transmission Control Protocol (TCP). Servers listen for requests on the well-known port number 43. Clients are simple applications that establish a communication channel with the server, transmit a text record with the name of the requested resource, and wait for a response in the form of a sequence of text records found in the database. This simplicity of the protocol also allows a command-line interface application and user to query a WHOIS server using the Telnet protocol.
In June 2014, ICANN published a status code recommendation, «Extensible Provisioning Protocol (EPP) Domain Status Codes»
| Status code | Description | |
|---|---|---|
| addPeriod | add period | This grace period is granted after the initial registration of a domain name. If the registrar deletes the domain name during this period, the registry may credit the registrar for the cost of registration. |
| autoRenewPeriod | auto renew period | This grace period is granted after a domain name's registration period expires and is automatically renewed by the registry. If the registrar deletes the domain name during this period, the registry credits the registrar for the cost of renewal. |
| inactive | inactive | This status code indicates that delegation information (name servers) has not been associated with the domain. The domain is not activated in the DNS and will not resolve. |
| ok | ok | This is the default domain status, meaning it has no pending operations or prohibitions. |
| pendingCreate | pending create | This status code indicates that a request to create the domain has been received and is being processed. |
| pendingDelete | pending delete | This status code can be combined with redemptionPeriod or pendingRestore. In that case, depending on the status set on the domain name, otherwise (not combined with another status), the pendingDelete status code indicates that the domain was in redemptionPeriod status for 30 days and was not restored. The domain will remain in this status for several days, after which the domain will be deleted from the registry database.
After deletion, the domain becomes available for re-registration in accordance with registry policy. |
| pendingRenew | pending renew | This status code indicates that a request to renew the domain has been received and is being processed. |
| pendingRestore | pending restore | This status code indicates that your registrar has requested the registry to restore a domain that was in redemptionPeriod status. Your registry will hold the domain in this status while waiting for your registrar to supply the required restoration documentation. If your registrar does not supply the registry operator with the documentation within the set period of time to confirm the restore request, the domain will return to redemptionPeriod status. |
| pendingTransfer | pending transfer | This status code means that a request to transfer the domain to a new registrar has been received and is being processed. |
| pendingUpdate | pending update | This status code indicates that a request to update the domain has been received and is being processed. |
| redemptionPeriod | redemption period | This status code indicates that your registrar has requested the registry to delete the domain. The domain will remain in this status for 30 days. Five calendar days after the end of redemptionPeriod, the domain will be deleted from the registry database and become available for registration. |
| renewPeriod | renewPeriod | This grace period is granted after a domain name's registration period is explicitly renewed (extended) by the registrar. If the registrar deletes the domain name during this period, the registry credits the registrar for the cost of the renewal. |
| serverDeleteProhibited | server delete prohibited | This status code prevents the domain from being deleted. This is an unusual status that is usually applied during legal disputes, at your request, or when redemptionPeriod status is in effect. |
| serverHold | serverHold | This status code is set by the domain's registry operator. The domain is not activated in the DNS. |
| serverRenewProhibited | server Renew Prohibited | This status code indicates that the domain's registry operator will not allow your registrar to renew the domain. This is an unusual status that is usually applied during legal disputes or when the domain is subject to deletion. |
| serverTransferProhibited | server Transfer Prohibited | This status code prevents the domain from being transferred from your current registrar to another one. This is an unusual status that is usually applied during legal or other disputes, at your request, or when redemptionPeriod status is in effect. |
| serverUpdateProhibited | server Update Prohibited | This status code locks the domain, preventing it from being updated. This is an unusual status that is usually applied during legal disputes, at your request, or when redemptionPeriod status is in effect. |
| transferPeriod | transfer period | This grace period is granted after a domain name is successfully transferred from one registrar to another. If the new registrar deletes the domain name during this period, the registry credits the registrar for the cost of the transfer. |
Traditionally, WHOIS lookups were performed using a command-line interface application, but now there are many alternative web tools.
The WHOIS database consists of a set of text records for each resource. These text records consist of various pieces of information about the resource itself and any related information about assignees, registrars, and administrative information such as creation and expiration dates.
There are two data models for storing information about resources in the WHOIS database: thick and thin.
WHOIS information can be stored and viewed according to a «thick» or «thin» data model:
Thick
A «Thick WHOIS» server stores complete WHOIS information from all registrars for a particular data set (for example, so that a single WHOIS server can provide WHOIS information for all .org domains).
Thin
A thin WHOIS server stores only the name of the WHOIS server of the domain's registrar, which in turn holds the complete information about the data being looked up (for example, .com WHOIS servers, which redirect the WHOIS query to the registrar where the domain was registered).
The thick model generally ensures data consistency and slightly faster queries, since only one WHOIS server needs to be contacted. If a registrar goes out of business, the thick registry contains all the important information (provided the registrant entered correct data, and privacy features were not used to hide the data), and the registration information can be preserved. But in a thin registry, contact information may be unavailable, and a legitimate registrant may find it difficult to retain control of the domain. [18]
If a WHOIS client does not understand how to handle this situation, it will display the complete information from the registrar. The WHOIS protocol has no standard for determining how to distinguish the thin model from the thick one.
The specific details of which records are stored vary across different domain name registries. Some top-level domains, including com and net, use thin WHOIS, requiring domain registrars to maintain their own customer data. Other global top-level registries, including org, use the thick model. [19] Each country-code top-level registry has its own national rules.
The first applications written for the WHOIS information system were command-line interface tools for Unix and Unix-like operating systems (i.e. Solaris, Linux, etc.). WHOIS client and server software is distributed as free open-source software, and binary distributions are included in all Unix-like systems. Various commercial Unix implementations may use a proprietary implementation (for example, Solaris 7).
The WHOIS command-line client passes the phrase given as an argument directly to the WHOIS server. Various free open-source examples can still be found on sites such as sourceforge.net. However, most modern WHOIS tools implement command-line flags or options, such as the -h option for accessing a specific server host, but servers are pre-configured by default. Additional options may allow control of the port number for the connection, display additional debugging data, or change recursion/referral behavior.
Like most TCP/IP client-server applications, a WHOIS client accepts user input and then opens an internet socket to its target server. The WHOIS protocol manages the transmission of the query and the receipt of the results.
With the emergence of the World Wide Web, and especially the weakening of Network Solutions' monopoly, looking up WHOIS information over the Internet became quite common. Today, popular web WHOIS queries can be performed from ARIN, [21] RIPE [22] and APNIC. [23] Most early web WHOIS clients were simply interfaces to the command-line client, where the resulting output was simply displayed on a web page with little, if any, cleanup or formatting.
Today, web WHOIS clients typically perform WHOIS queries directly and then format the results for display. Many such clients are proprietary, built by domain name registrars.
The need for web clients arose because WHOIS command-line clients existed mainly only in Unix and large computing worlds. Microsoft Windows and Macintosh computers did not have WHOIS clients installed by default, so registrars had to find a way to give prospective customers access to WHOIS data. Many end users still rely on such clients, although command-line and graphical clients now exist for most home PC platforms. Microsoft provides the Sysinternals Suite, which includes a whois client for free.
CPAN has several Perl modules that work with WHOIS servers. Many of them are not up to date and do not fully function with the current (2005) WHOIS server infrastructure. Nevertheless, there is still much useful functionality that can be extracted, including looking up AS numbers and registrar contacts. [ citation needed ]
WHOIS services are mostly served by registrars and registries; for example, the Public Interest Registry (PIR) maintains the .ORG registry and the associated WHOIS service. [24]
Regional Internet Registries
The WHOIS servers operated by the Regional Internet Registries (RIRs) can be queried directly to determine the internet service provider responsible for a particular resource.
The records of each of these registries are cross-referenced, so that a query to ARIN for a record that belongs to RIPE will return a placeholder pointing to the RIPE WHOIS server. This lets the WHOIS user making the query know that the detailed information is located on the RIPE server. In addition to the RIR servers, there are commercial services such as the Routing Assets Database, used by some large networks (for example, large internet providers that have acquired other internet providers across several RIR zones).
Currently there is no widely adopted way of determining the responsible WHOIS server for a DNS domain, although a number of methods are widely used for top-level domains (TLDs). Some registries use DNS SRV records (defined in RFC 2782 ]) to let clients discover the address of the WHOIS server. [26] Some WHOIS lookups require finding the domain registrar handling the domain in order to display the domain owner's details.
Contact information for the resource's holder is usually returned. However, some registrars offer private registration, in which case the registrar's contact information is displayed instead.
Some registry operators are wholesalers, meaning they generally provide domain name services to a large number of retail registrars, who in turn offer them to consumers. For private registration, only the identity of the wholesale registrar may be returned. In this case, the identity of the individual as well as the identity of the retail registrar may be hidden.
Below is an example of WHOIS data returned for an individual resource holder. This is the result of a WHOIS query for example.com:
> whois example.com
[Querying whois.verisign-grs.com]
[Redirected to whois.iana.org]
[Querying whois.iana.org]
[whois.iana.org]
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1
domain: EXAMPLE.COM
organisation: Internet Assigned Numbers Authority
created: 1992-01-01
source: IANA
Referral Whois (RWhois) — is an extension of the original WHOIS protocol and service. RWhois extends WHOIS concepts in a scalable, hierarchical style, potentially creating a system with a tree-like architecture. Queries are deterministically routed to servers based on hierarchical labels, which reduces the load on the primary information repository. [27]
Lookups for distributed IP addresses are often restricted to larger classless inter-domain routing (CIDR) blocks (e.g. /24, /22, /16), since usually only regional internet registries (RIRs) and domain registrars use RWhois or WHOIS servers, although RWhois is designed to be used even by smaller local internet registries to provide more detailed information about IP address assignment.
RWhois is intended to replace WHOIS by providing an organized hierarchy of referral services, where one can connect to any RWhois server, request a lookup, and be automatically redirected to the appropriate server(s). However, although the technical functionality already exists, adoption of the RWhois standard has been weak.
RWhois services generally communicate using the Transmission Control Protocol (TCP). Servers listen for requests on the well-known port number 4321.
Rwhois was first defined in RFC 1714 in 1994 by Network Solutions [27], but the specification was superseded in 1997 by RFC 2167 .
RWhois's referral functions differ from the WHOIS server feature of redirecting responses to another server, which RWhois also implements.
One of the shortcomings of WHOIS is the lack of full access to the data. Only a few parties have real-time access to all the databases.
Others cite the competing goal of domain privacy as a criticism, although this issue is largely mitigated by domain privacy services. Currently, the Internet Corporation for Assigned Names and Numbers (ICANN) generally requires that the postal address, phone number, and email address of those who own or administer a domain name be made publicly available through «WHOIS» directories. The contact details of the registrant (domain owner), such as address and phone number, are readily available to anyone who queries a WHOIS server. However, this policy allows spammers, direct marketers, identity thieves, or other malicious actors to trawl the directory for personal information about these people. Although ICANN is studying the possibility of changing WHOIS to provide more privacy, there is a lack of consensus among key stakeholders on what type of changes should be made. Some domain registrars offer private registration (also known as domain privacy), in which the registrar's contact information is displayed instead of the customer's contact information. Thanks to many registrars offering private registration, some of the risk has been reduced.
Studies have shown that spammers can and do collect email addresses in plain text from WHOIS servers. [33] For this reason, some WHOIS servers and websites offering WHOIS queries have implemented rate-limiting systems, such as web CAPTCHAs and a limited number of lookups per user IP address.
WHOIS requirements conflict with the General Data Protection Regulation (GDPR), which took effect in the European Union on May 25, 2018, and which establishes strict rules for the processing and publication of personally identifiable information. In November 2017, ICANN stated that it would not penalize «non-compliance with contractual obligations related to the handling of registration data» if registrars provided alternative solutions for complying with its rules until WHOIS requirements were updated to account for the GDPR.
The WHOIS protocol was not written with an international audience in mind. A WHOIS server and/or client cannot determine the text encoding used for the query or the database contents. Many servers originally used US-ASCII, and internationalization issues were not taken into account until much later. This can affect the usability or usefulness of the WHOIS protocol in countries outside the US. In the case of internationalized domain names, the client application is responsible for performing the translation of the domain name between its native language and the DNS name in punycode.
In cases where the identity of the registrant (domain owner) is public, anyone can easily confirm the status of the domain via WHOIS.
In the case of private registrations, establishing the registration information can be more complicated. If a registrant who has purchased a domain name wants to verify that the registrar has completed the registration process, three steps may be required:
This provides some assurance that the retailer has actually registered the name. But if the registrar goes out of business, as was the case with the RegisterFly collapse in 2007, the legitimate owner of a domain with protected registrations may face difficulty restoring administration of their domain name. [18] Registrants using «private registration» may try to protect themselves by using a registrar that places customer data in escrow with a third party.
ICANN requires that every domain name registrar have the ability to correct any inaccurate contact information associated with its domain. For this reason, registrars are required to periodically send the owner the contact information listed on record for verification, but they provide no guarantees regarding the accuracy of the information if the registrant provided inaccurate information.
WHOIS has given rise to policy issues within the United States federal government. As noted above, WHOIS creates a privacy issue, which is also linked to freedom of speech and anonymity. Nevertheless, WHOIS is an important tool for law enforcement officers investigating violations such as spam and phishing, for tracking down domain name owners. As a result, law enforcement agencies have sought to make WHOIS records both open and verified: [36]
The Expert Working Group (EWG) of the Internet Corporation for Assigned Names and Numbers (ICANN), on June 24, 2013, recommended retiring WHOIS. It recommends replacing WHOIS with a system that keeps information hidden from most Internet users and discloses information only for «permissible purposes». [41] ICANN's list of permissible purposes includes domain name research, domain name sale and purchase, regulatory enforcement, personal data protection, legal action, and abuse prevention. [42] Although WHOIS is a key tool for journalists in determining who is distributing certain information on the Internet, [43] use of WHOIS by the free press is not included in ICANN's proposed list of permissible purposes.
The EWG collected public comments on the initial report until September 13, 2013. Its final report was published on June 6, 2014, with no substantial changes to the recommendations. [44] As of March 2015, ICANN is in the «process of rethinking WHOIS», working on «ICANN WHOIS Beta». [45] [46]
On January 19, 2023, ICANN opened voting on a global amendment to all its registry and registrar agreements. In it, they defined a 180-day RDAP ramp-up period, starting from when the amendment takes effect. 360 days after that period is defined as the date WHOIS services are retired, after which registries and registrars are no longer required to offer the WHOIS service, and instead only the RDAP service is required. All voting thresholds were met within the 60-day voting period, and the amendment was approved by the ICANN Board. The WHOIS sunset date for gTLDs was set as January 28, 2025.
The Registration Data Access Protocol (RDAP) — is a computer network communication protocol, standardized by the Internet Engineering Task Force working group in 2015 after experimental development and thorough discussions. It is the successor to the WHOIS protocol, used to look up relevant registration data for internet resources such as domain names, IP addresses, and autonomous system numbers.
Whereas WHOIS essentially returns free text, RDAP delivers data in a standard machine-readable JSON format. To achieve this, the output of all operating WHOIS servers was analyzed, conducting a census of the labels they used. The developers of RDAP, many of whom are members of IP address or name registries, sought to make the protocol as simple as possible, since complexity was considered one of the reasons why previous attempts, such as CRISP, failed. RDAP is based on RESTful web services, so error codes, user identification, authentication, and access control can be delivered over HTTP.
The biggest delay in implementing RDAP turned out to be bootstrapping — figuring out where the server for each top-level domain, IP address range, or ASN range is located. IANA agreed to host the bootstrap information in appropriate registries and publish it at well-known location URLs in JSON format. These registries were initially empty and would be gradually populated as domain and address-space registries provided RDAP server information to IANA. For number registries, ARIN created a public RDAP service, which also has a bootstrap URL similar to the one they use for WHOIS. For name registries, ICANN has required RDAP compliance since 2013. [
RDAP databases for assigned IP numbers are maintained by the five Regional Internet Registries. ARIN maintains the bootstrap database. Thanks to the standard document format, tasks such as, for example, obtaining the address of the abuse-handling team for a given IP number, can be performed fully automatically.
RDAP databases for registered names are maintained following an ICANN agreement. Name resources are much slower, since the number of registries under ICANN is enormous. In addition, since the GDPR became mandatory in May 2018, the issue of disclosing personal data through WHOIS or RDAP has further slowed adoption. To resolve the conflict between GDPR and ICANN policies, ICANN published a temporary specification, according to which all contact data must be redacted for privacy reasons if it falls under the GDPR, unless the contact explicitly permits publication. This includes email addresses; however, the registrar must offer an anonymized email address or a web form to allow information to be forwarded to contacts. The RDAP/WHOIS registry's response must contain a notice that these means of contacting the contacts are available only in the registrar's RDAP/WHOIS.
To maintain the accuracy of RDAP information, registrars must send an annual Whois Data Reminder Policy (WDRP) notice to the registrant's contact. This is usually done by email, containing all the RDAP information the registrar has, and asking the registrant to promptly update it if it is incorrect, while at the same time reminding the registrant that incorrect RDAP information may lead to deletion of the domain name. In addition, every registrar must offer an abuse contact and, upon receiving information about incorrect RDAP information, must ensure that it is quickly corrected or suspend the domain.
On January 19, 2023, ICANN opened voting on a global amendment to all its registry and registrar agreements. In it, they defined a 180-day RDAP ramp-up period, starting from when the amendment takes effect. 360 days after that period is defined as the date WHOIS services are retired, after which registries and registrars are no longer required to offer the WHOIS service, and instead only the RDAP service is required. All voting thresholds were met within the 60-day voting period, and the amendment would be submitted to the ICANN Board for approval and implementation. [14]
The RDAP protocol allows for extensions, and IANA maintains a list of known RDAP extensions. Some of these extensions are RFCs, for example sorting and pagination, others are intended only for specific TLDs. [15]
Comments