whois Command in Linux: Look Up Domain Registration Information
Learn how to install and use the Linux whois command to inspect domain registration records, interpret common fields, follow referrals, and understand privacy limitations.
The Linux whois command queries public registration records. You can use it to investigate domain names and, depending on the service, IP addresses or autonomous system numbers (ASNs).
Domain results may include the registrar, registration dates, authoritative nameservers, domain status codes, and registrant-related contact data. The exact response depends on the registry, registrar, top-level domain (TLD), privacy settings, and applicable data-protection rules.
What WHOIS Means
WHOIS is a distributed query service and protocol for retrieving registration information from domain registries, registrars, and network registries. A registry operates the database for a TLD or another address-registration space. A registrar is an accredited company that registers and manages domain names for registrants.
A registrant is the person or organization recorded as the domain registration holder. Public results may hide this information or replace it with a privacy/proxy service.
A top-level domain (TLD) is the final portion of a domain name, such as .com, .org, or a country-code TLD. WHOIS can also be used for some IP address and ASN queries, but the available fields and response format vary by network registry.
Install and Verify whois
The package may not be installed by default. Install it with the package manager used by your distribution.
Debian and Ubuntu
sudo apt update && sudo apt install whoisFedora and RHEL-family systems
sudo dnf install whoisArch Linux
sudo pacman -S whoisVerify that the executable is available:
command -v whois
whois --helpThe first command prints the executable path when whois is in your PATH. The second displays help information. Some implementations support a version option, but help output is more consistently useful for checking availability.
Basic Domain Lookup
The basic syntax is:
whois DOMAINFor a safe documentation example, query example.com:
whois example.comThe response is live data and can change. Do not expect every field, value, or formatting detail to remain constant.
Common WHOIS Fields
WHOIS labels are not universal. A field may appear under a slightly different name, be repeated for different services, or be absent entirely.
Authoritative DNS and nameservers
Authoritative DNS is the DNS data served by the nameservers officially delegated for a domain. If WHOIS lists ns1 and ns2 hosts, those nameservers are the delegation targets for DNS administration. WHOIS does not by itself show every DNS record; use a DNS tool such as dig when you need to inspect records.
Useful whois Options
The -H option does not guarantee a short response. The remote WHOIS service controls the response structure and may still return extensive notices or record data.
Following Referrals and Choosing a Server
A registry response may include a referral to the WHOIS server operated by the sponsoring registrar. Registry-level information generally comes from the TLD registry and may include delegation, status, and registry dates. Registrar-level information may provide additional registration or contact details.
When a response identifies a specific server, query it with -h:
whois -h whois.example-registry.test example.testThe hostname above is a syntax demonstration. Use the actual server named by a live response or documentation from the relevant registry or registrar.
Save and Search Lookup Results
Redirect the response to a text file for later review:
whois example.com > example.com.whois.txtSearch for common labels with grep:
whois example.com | grep -Ei 'registrar|name server|nameserver|creation date|expiry date|expiration date|domain status'This is convenient for interactive work, but it is not a universal parser. TLDs and registrars use different labels, capitalization, layouts, and date formats. Always inspect the raw response when a field is missing or when accuracy matters.
Privacy, Accuracy, and Other Limitations
- Modern WHOIS output often hides personal names, addresses, telephone numbers, and email addresses through redaction or privacy/proxy services.
- A listed privacy provider or registrar may identify the service handling public contact information rather than the actual domain holder.
- WHOIS records are not proof of current ownership, authorization, identity, or malicious activity. Treat them as public registration data, not as a complete investigation.
- Some registries return incomplete records, limit query frequency, or refer queries to another WHOIS server.
- Some registration systems use RDAP, the Registration Data Access Protocol, instead of or alongside WHOIS. RDAP is a newer standardized, web-based way to access registration data.
WHOIS Result Caveats
Troubleshooting
“whois: command not found”
The package is probably not installed, or the executable is not in your PATH. Install the distribution package and run:
command -v whoisContact information is missing
Redaction or a privacy/proxy service is the usual cause. Treat the response as the public record; a normal WHOIS query does not reveal hidden registrant details.
The response contains only a referral
The registry may delegate detailed information to the sponsoring registrar. Follow the displayed referral or use the referred host with -h.
A script cannot find “Expiration Date”
Inspect the raw output and support alternate labels such as Registry Expiry Date. Avoid assuming that one regular expression or field name works for every TLD.
Requests are refused or output becomes incomplete
The service may be rate-limiting requests. Reduce the request frequency, review its usage policy, and consider an approved RDAP endpoint or service for programmatic access.
The domain appears expired but still resolves
An expiration date does not describe the entire domain lifecycle. Renewal grace periods, redemption periods, and existing DNS configuration can affect behavior. Check domain status and registrar information rather than assuming that DNS stops immediately on the listed date.
Practical Interpretation Checklist
- Confirm that you queried the intended domain and understand which TLD registry is involved.
- Identify the registrar and determine whether the response is registry-level, registrar-level, or both.
- Record the creation, updated, and expiry dates, noting the displayed time zone and label.
- Review every domain status code instead of relying on a single status.
- Compare nameservers with the DNS service you expect to be authoritative.
- Interpret contact fields cautiously because they may be redacted or privacy-protected.
- Save the raw response when you need an auditable snapshot, while remembering that it can become outdated.