VMware ESXi and vSphere Cluster Management

Using the whois Command in Linux

Learn how to install and use Linux whois to inspect domain registration records, registrars, dates, status, nameservers, IP allocations, referrals, privacy limits, and RDAP alternatives.

What WHOIS tells you

WHOIS is a protocol and query service for retrieving registration information associated with Internet resources. It is commonly used for domain names, IP address blocks, and autonomous system numbers (ASNs).

For a domain, WHOIS may show the registrar, registration dates, domain status codes, delegated nameservers, and published contact fields. The information available depends on the top-level domain, registry and registrar policies, privacy settings, and applicable legal rules.

WHOIS compared with other tools

WHOIS output is not definitive identity verification. Records can be incomplete, stale, redacted, proxied, or limited by registry policy.

Installing the whois utility

First check whether the command is already available:

whois --version

If the shell reports that the command is not found, install the package for your operating system. Package names and repository availability can vary between distributions.

Debian and Ubuntu

sudo apt update && sudo apt install whois

Fedora and RHEL-family systems

sudo dnf install whois

Some older systems may use a different package manager or repository configuration.

Arch Linux

sudo pacman -S whois

macOS

macOS versions and package sources differ. If the command is not included on your system, install a maintained WHOIS package through your preferred package manager, then verify it with command -v whois and whois --version.

After installation, these checks confirm that the executable can be found:

command -v whois
whois --version

Basic domain lookup syntax

The basic form is:

whois fully-qualified-domain-name

For example, example.com is a neutral documentation domain:

whois example.com

The client contacts an appropriate WHOIS server and prints the registration record returned by that service. Use the domain name itself, not a complete URL or web path:

whois example.com
whois https://example.com/page

The second form is incorrect because WHOIS queries are not HTTP requests and do not accept URL schemes or page paths.

Reading a domain WHOIS response

Labels differ across registries and registrars, so treat the following names as common patterns rather than a universal schema.

Registry, registrar, and registrant

A domain registry operates the authoritative registration database for a top-level domain. A domain registrar is an authorized company that registers and manages domains for customers through the registry. The registrant is the person or organization listed as the domain holder, when that information is published.

These roles are separate. A registrar may manage a domain while another provider supplies DNS, hosting, email, or content-delivery services.

Domain status codes

Status codes describe lifecycle state or restrictions. For example, a transfer-prohibition status can prevent a registrar transfer, while an update-prohibition status can restrict record changes. A delete-prohibition status can help prevent deletion. Exact codes, combinations, and effects depend on the registry and registrar.

Do not interpret one status value without reading the surrounding record or the relevant registry documentation. A status may restrict an action without meaning that the domain is offline.

Useful whois options

WHOIS clients differ. Read the local manual before relying on an option in a script:

man whois

For a shorter human-readable result, try:

whois -H example.com

WHOIS servers and referrals

A WHOIS referral is a response directing the client to another server that holds more specific information. In a simplified model, a query first reaches a registry service. The registry may identify the registrar's WHOIS server, and the client may then query that server.

A thin registry stores limited registration details and relies more heavily on a registrar for domain-specific information. A thicker registry may return more of the record directly. This distinction helps explain why an initial response can be short or appear incomplete.

Manually specifying a server can help investigate an unexpected response:

whois -h whois.iana.org example.com

Compare the result with the normal lookup. Use -r or -I when the installed client supports those behaviors and you need to examine referral handling. WHOIS services increasingly coexist with, or are being replaced for many uses by, RDAP (Registration Data Access Protocol), a structured HTTP-based registration-data service.

Querying IP addresses, ASNs, and network allocations

WHOIS is not limited to domains. It can query IP addresses, network allocations, and ASNs. An ASN, or Autonomous System Number, identifies a network or routing domain participating in Internet routing.

whois 192.0.2.1

192.0.2.1 is from a documentation range. The result concerns the organization responsible for an address allocation or registration record, not necessarily the current end user, server owner, or physical location.

IP address resources are served through Regional Internet Registries (RIRs). RIRs manage allocation and registration information for geographic service regions. Different address ranges can therefore be handled by different registries, and a generic WHOIS client may need to follow a referral to the appropriate service.

Filtering output and writing scripts

For an interactive search, pipe the output through grep:

whois example.com | grep -Ei '^(registrar|name server|creation date|updated date|registr.*expir|expiry date|domain status):'

This can locate common fields such as Registrar, Name Server, Creation Date, Expiry Date, and Domain Status. The expression is case-insensitive and permits some variation in expiration labels.

WHOIS labels, capitalization, ordering, separators, and date formats are not standardized globally. Some responses contain multiple nameservers or contacts; others omit them. A referral can also change the format between the first and second response.

A brittle script that assumes one exact label or fixed line position will eventually fail. For automation, match multiple possible labels, handle missing values and repeated fields, and prefer RDAP or an official registrar/registry API when structured data is available.

Comparing WHOIS nameservers with DNS

A WHOIS record's nameserver entries describe registration delegation. To inspect current DNS delegation, query DNS separately:

dig NS example.com +short

The two results can differ because of DNS propagation, a mismatch between parent-zone delegation and the domain zone's own NS records, cached resolver data, or configuration errors. WHOIS does not show the current A or AAAA answer for a website, and dig does not normally show the registrar or registration dates.

Privacy, accuracy, and responsible use

Registrant privacy is a service or policy that masks or substitutes personal contact details in public registration output. A response may show a proxy company, a generic email address, or no personal contact fields at all.

• Do not treat a displayed name, address, email address, or phone number as definitive identity verification.
• Expect records to be stale, incomplete, redacted, or intentionally limited.
• Use published abuse or administrative channels for legitimate contact rather than attempting to bypass privacy controls.
• Respect rate limits, query terms, automated-access restrictions, and registry or registrar acceptable-use policies.
• Use WHOIS for legitimate administrative, troubleshooting, research, and contact purposes.

Repeated automated queries may be refused or may violate service terms. RDAP or an authorized API is generally more appropriate for approved, structured workflows.

WHOIS limitations and modern alternatives

WHOIS is a plain-text legacy protocol with inconsistent output formats and uneven support for privacy and internationalization. Some registries provide limited responses, require special access, or primarily direct users toward RDAP.

RDAP is a structured, HTTP-based registration-data service. It is usually preferable when software must reliably consume fields, follow links between entities, interpret standardized responses, or handle modern registration data consistently.

Troubleshooting common problems

whois is not found

The package may not be installed, or the executable may not be in PATH. Install the distribution package and verify it:

command -v whois
whois --version

No useful record or “no match” response

Check the spelling and top-level domain. The name may be unregistered, the server may not manage that top-level domain, or the registry may use restricted or unusual behavior. Try a normal lookup that permits referrals, or specify an appropriate registry or registrar server when known.

Contact fields are missing or replaced

Privacy or proxy service, registry redaction rules, and registrar disclosure policies commonly cause this. Treat the result as expected privacy behavior and use an official published contact channel.

The response is mostly legal text

WHOIS servers often include terms, notices, and rate-limit warnings. Try -H if the client supports it, or filter carefully while retaining information required for compliance:

whois -H example.com

A script cannot find expected labels

Output is not globally standardized. Different registries and registrars use different labels, capitalization, ordering, and date formats. Avoid fixed positional parsing, support multiple labels, handle absent values, and prefer RDAP for programmatic use.

WHOIS and DNS show different nameservers

Possible causes include propagation, a parent-zone and child-zone mismatch, cached resolver data, or inconsistent configuration. Use dig to inspect current DNS behavior and, where appropriate, check authoritative delegation and the domain's registrar or DNS-provider settings.

The server times out or refuses queries

Rate limiting, automated-query restrictions, firewall rules, connectivity problems, or temporary service unavailability can cause this. Reduce query frequency, follow the service's terms, test connectivity, retry later, or use an official RDAP service.

Practical workflow

1. Confirm that whois is installed with command -v whois or whois --version.
2. Query only the domain name, such as whois example.com.
3. Identify the registrar, creation date, updated date, expiration date, status values, and nameservers.
4. Check whether contact fields are published, privacy-protected, or absent.
5. If the response includes a referral, inspect the named server with -h when appropriate.
6. Compare registered nameservers with live DNS using dig NS example.com +short.
7. For repeatable automation, use RDAP or an official API instead of depending on one WHOIS text format.