| |
WHOIS
Domaining Guide
WHOIS
Home | Up
WHOIS is a
TCP-based query/response protocol which is widely used for querying a
database in order to determine the owner of a
domain name, an
IP address, or an autonomous system number on the Internet. WHOIS
lookups were traditionally made using a command line interface, but a number of simplified web-based tools
now exist for looking up domain ownership details from different
databases. Web-based WHOIS clients still rely on the WHOIS protocol to
connect to a WHOIS server and do lookups, and command-line WHOIS clients
are still quite widely used by system administrators.
The WHOIS system originated as a method that system administrators could use
to look up information to contact other IP address or
domain
name administrators (almost like a "white pages"). The use of the data that
is returned from query responses has evolved from those origins into a variety
of uses, both altruistic (such as a Certificate Authority validating the
registration for ecommerce https) and nefarious (such as bulk unsolicited email
campaigns).
WHOIS has a sister protocol standard called RWhois.
Thin and thick lookups
There are two ways that WHOIS information may be stored: "thick" or "thin".
- Thick: one WHOIS server stores the WHOIS information from all the
registrars for the particular set of data (so that one WHOIS server can
respond with WHOIS information on all .org domains,
for example).
- Thin: one WHOIS server stores the name of the WHOIS server of a
registrar that has the full details on the data being looked up (such as the
.com WHOIS
servers, which refer the WHOIS query to the registrar that the domain was
registered from). The thick model usually ensures consistent data and
slightly faster lookups (since only one WHOIS server needs to be contacted).
If a WHOIS client does not understand the information being returned, the
results of a thin lookup (which include the WHOIS server of the registrar, and
perhaps a few other necessary details) will be displayed to the end user. If the
WHOIS client understood how to deal with this situation, it would display the
full information from the registrar. Unfortunately, there is no standard in the
WHOIS protocol for determining how to distinguish the thin model from the thick
model.
Exact implementation of which records are stored varies between
domain name registries. Some
top-level domains, including
.com and
.net, operate a thin
WHOIS, allowing the various domain registrars the ability to maintain their own
customers' data. Other registries, including .org, operate a
thick model.
Example query
Below is the result of a WHOIS query on wikipedia.org:
Domain ID:D51687756-LROR
Domain Name:WIKIPEDIA.ORG
Created On:13-Jan-2001 00:12:14 UTC
Last Updated On:01-Mar-2006 12:39:33 UTC
Expiration Date:13-Jan-2015 00:12:14 UTC
Sponsoring Registrar:Go Daddy Software, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:GODA-09495921
Registrant Name:Wikimedia Foundation
Registrant Organization:Wikimedia Foundation Inc.
Registrant Street1:204 37th Ave N, #330
Registrant Street2:
Registrant Street3:
Registrant City:St. Petersburg
Registrant State/Province:Florida
Registrant Postal Code:33704
Registrant Country:US
Registrant Phone:+1.7272310101
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:noc@wikimedia.org
Admin ID:GODA-29495921
Admin Name:Jimmy Wales
Admin Organization:Wikimedia Foundation
Admin Street1:204 37th Ave. N. #330
Admin Street2:
Admin Street3:
Admin City:St. Petersburg
Admin State/Province:Florida
Admin Postal Code:33704
Admin Country:US
Admin Phone:+1.7276441636
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:jwales@bomis.com
Tech ID:GODA-19495921
Tech Name:Jason Richey
Tech Organization:Wikimedia Foundation
Tech Street1:19589 Oneida Rd.
Tech Street2:
Tech Street3:
Tech City:Apple Valley
Tech State/Province:California
Tech Postal Code:92307
Tech Country:US
Tech Phone:+1.7604869194
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:jasonr@bomis.com
Name Server:NS0.WIKIMEDIA.ORG
Name Server:NS1.WIKIMEDIA.ORG
Name Server:NS2.WIKIMEDIA.ORG
History
When the Internet was emerging out of the
ARPANET
entity, there was only one organization that handled all domain registrations,
which was DARPA
itself. The process of registration was established in
RFC 920. WHOIS was standardized in the early 1980s to look-up domains,
people and other resources related to domain and number registrations. Because
all registration was done by one organization in that time, one centralized
server was used for WHOIS queries. This made looking-up information very easy.
Early WHOIS servers were highly permissive and would allow wild-card
searches. You could do a WHOIS lookup on a person's last name and get all the
individual people who had a registered handle. You could do a query on a keyword
and see all registered domains containing that keyword. You could even query a
given administrative contact and see all domains they were associated with. Due
to the advent of the commercialized Internet,
multiple registrars and unethical spammers, such permissive searching is no
longer available.
Initially, while ARPANET faded away in the late 1980s, responsibility of
domain registration remained with DARPA. UUNet began offering domain
registration service, however they simply handled the paperwork for you and
still had to deal with DARPA's Network Information Center (NIC). Then the
National Science Foundation directed that management of Internet domain
registration would be handled by commercial, 3rd party entities. InterNIC was
formed in 1993 under contract with the NSF, consisting of Network Solutions,
Inc., General Atomics, and AT&T. General
Atomics' contract was cancelled after several years due to performance issues.
On
December 1, 1999, management of the
top-level domains (TLDs) .com, .net, and .org was turned over to ICANN. At the
time these popular TLDs were switched to a thin WHOIS model. Existing WHOIS
clients stopped working at that time. A month later it had self-detecting CGI
support so that the same program could operate a web-based WHOIS lookup, and an
external TLD table to support multiple whois servers based on the TLD of the
request. This eventually became the model of the modern whois client.
By 2005, there were many more generic top-level domains than there had been
in the early 1980s. There are also many, many more country-code top-level
domains. This has led to a complex network of
domain name registrars and registrar associations, especially as the
management of Internet infrastructure has become more internationalized. As
such, performing a WHOIS query on a domain requires knowing the correct,
authoritative WHOIS server to use. Tools to do WHOIS proxy searches have become
common. Also, there is a command-line whois client called jwhois which
uses a configuration file to map domain names and network blocks to their
appropriate registrars.
In 2004, an IETF committee was formed to standardize a whole new way to
look-up information on domain names and network numbers. The current working
name for this proposed new standard is Cross Registry Information Service
Protocol (CRISP).
Querying WHOIS servers
Command-line clients
Originally the only method by which a WHOIS server could be contacted was to
use a command line interface text client. In most cases this was on a Unix or
Unix-like platform. The WHOIS client software was (and still is) distributed as
open source. Various commercial Unix implementations may use their own
implementations (for example, Sun Solaris 7 has a WHOIS client authored by Sun).
A WHOIS command line client typically has options to choose which host to
connect to for whois queries, with a default whois server being compiled in.
Additional options may allow control of what port to connect on, displaying
additional debugging data, or changing recursion/referral behavior.
Like most TCP/IP client/server applications, a WHOIS client takes the user
input and then opens an IP socket to its destination server. The WHOIS protocol
is used to establish a connection on the appropriate port and send the query.
The client waits for a response from the server, which it then either returns to
the end-user or uses to make additional queries. Much more detailed information
on the WHOIS protocol can be found in the
RFCs.
Graphical clients
The term "graphical client" may be a bit of a misnomer for a WHOIS client,
since all the data to be derived from a WHOIS server is plain text, and the
protocol is a relatively static one. There is not much interaction to do with a
WHOIS server. In this context, the term "graphical client" is taken to mean a
WHOIS client that runs as an application on a GUI OS and uses the OS's standard
GUI for user interaction.
Web-based clients
With the advent of the World Wide Web and especially the loosening up of the
Network Solutions monopoly, looking up WHOIS information via the web has
become quite common. Most early web-based WHOIS clients were merely front-ends
to a command-line client, where the resulting output just got displayed on a
webpage with little, if any, clean-up or formatting.
Nowadays, web based WHOIS clients usually perform the WHOIS queries directly
and then format the results for display. Many such clients are proprietary,
authored by domain name registrars such as Go Daddy or
Network Solutions.
The need for web-based clients came from the fact that command-line WHOIS
clients largely existed only in the Unix and large computing worlds.
Microsoft Windows and Macintosh computers had no WHOIS clients, so
registrars had to find a way to provide access to WHOIS data for potential
customers. Many end-users still rely on such clients, even though command line
and graphical clients exist now for most home PC platforms.
Perl modules
CPAN has several Perl modules
available that work with WHOIS servers. Many of them are not current and do not
fully function with the current (2005) WHOIS server infrastructure. However,
there is still much useful functionality to derive including looking up AS
numbers and registrant contacts.
Problems
-
Privacy: Registrant's contact details, such as address and telephone number, are made easily accessible to anyone over the internet
for most
top-level domains. Although some registrars offer private registrations
(where the contact information of the registrar is shown), under ICANN rules
the registrar or "private registration" company is then legal owner (lessor)
of the domain.
- False registrations: The privacy services mentioned above are often
abused by people involved in illegal activity, who use them in the knowledge
that it makes it extremely difficult for entities (even law-enforcement
officers) outside of their registrar's legal jurisdiction to obtain their
contact details. The fact that some registrars are uncooperative when
notified of illegal activity makes this situation somewhat worse.
- Inaccuracy of information: Some registrars are not sufficiently careful
to ensure the accuracy of contact details listed in the WHOIS.
- Obsolescence: most of the information stored in a WHOIS server, is
subject to change later in time. For instance, the owner may change his
(geographical) address. Since the email address used to administrate the
domain often remains valid, the owner may not bother to update his address
with the registar.
- History: when a domain record is updated (moved, sold), the previous
information is not archived but overridden. A few WHOIS web servers,
however, do automatically monitor and cache the records for domains
which were queried through their interface, making the WHOIS history
partially available.
-
Spam: Spammers often harvest plain-text email addresses from WHOIS requests.
This means that both WHOIS servers and websites offering WHOIS lookups have
resorted to special systems (such as Captcha,
where users have to type in letters or numbers from a picture) and
rate-limiting systems.
-
Internationalization: The WHOIS protocol was not written with an
international audience in mind. A WHOIS server cannot tell which text
encoding it is using for either the requests or replies, and the servers
were originally all simply using US-ASCII, although this cannot be assumed anymore with international servers. This
obviously will impact the usability of the WHOIS protocol in countries
outside the USA, especially as
internationalized domain names are falling into wider use. A user can
(and possibly will have to due to this limitation) use
punycode,
but this leads to conversion problems as the punycode system is not easy for
a regular user to grasp.
- Lack of WHOIS server lists: There is no central list of WHOIS servers.
Therefore, people writing WHOIS tools need to find their own list of WHOIS
servers, and different WHOIS tools may contact different WHOIS servers.
- Different registrars' WHOIS servers return results in different formats,
making automation of parsing WHOIS data difficult. While such automation has
many legitimate uses (primarily for ISPs), it also lends itself to use by
spammers and other people acting unethically.
Law and policy
WHOIS has generated policy issues in the United States federal government. As
noted above, WHOIS creates a privacy issue which is also tied to free speech and
anonymous speech. However, WHOIS is an important tool for law enforcement
officers investigating violations like spam and phishing to track down the
owners of domain names. Law enforcement officers become frustrated when WHOIS
records are filled with rubbish. As a result, law enforcement agencies have
sought to make WHOIS records both open and verified.[1] The Federal Trade
Commission has testified about how inaccurate WHOIS records thwart their
investigations.[2] There have been congressional hearings that have touched on
the importance of WHOIS in 2006, 2002, and 2001.[3] The Fraudulent Online
Identity Sanctions Act "make it a violation of trademark
and copyright law if a person knowingly provided, or caused to be provided,
materially false contact information in making, maintaining, or renewing the
registration of a domain name used in connection with the violation."[4]
See also
Request for Comments
Reference
External links
Home | Up | Domain name | Hostname | Fully qualified domain name | Internationalized domain name | Subdomain | Domain name registry | WHOIS
Domaining Guide, made by MultiMedia | Websites for sale
This guide is licensed under the GNU
Free Documentation License. It uses material from the Wikipedia.
|
|
3.137.170.76
User Stats:
Today: 0
Yesterday: 0
This Month: 0
This Year: 0
Total Users: 117
New Members:
3.137.xxx.xx
Server Time: