The whois service

The registry holds a lot of social information about the domain names holders and about the contacts: names, postal and email addresses, phone numbers, etc. This information can be distributed to the outside.

The social information has a lot of operational uses: to find the contacts when you have a problem with a domain, for instance. Engineers use it when there is a network problem, anti-spam software use it to gather (not always carefully) email addresses to complain to, etc.

whois or whois-like services are also used by Intellectual Property lawyers, for instance to ask a cybersquatter to desist, or to harass domain names holders, pretending there is a trademark infringment.

whois, as a protocol, is specified in RFC 3912 (RFC means Request For Comments. The RFC are available on the IETF server.). The standard does not specify any policy.

The protocol itself is quite simple and anyone can write a whois client or server in one hour (see the RFC for details). But an useful whois server must do more: it musts connects to the datastore of the registry, in order to retrieve the social information. So, the information served by whois is a subset of the information stored in the database^[1]. Here is a possible model, for a whois server whose data store is a relational DBMS:

Figure 1. Model of a whois server

This shows that a whois server is only a relay between the client and the data store.

whois works by accepting a request, expressed as a string^[2], which typically identifies a domain name (such as example.com) or a person or entity (such as SB164-FRNIC which is a handle, an unique identifier automatically assigned to a person or a group).

In exchange, whois sends back a set of information, very often structured as a list of attribute-values pairs. For instance, "name: Bortzmeyer", "phone: 123 456 789", etc.

The actual output of the whois server depends on the server used: there is no standard of presentation and it is one of the big problems with RFC 3912. Here is the output of whois.nic.fr for a role (a group of persons) of handle HN16-FRNIC :

role:        Hostmaster Netaktiv
address:     Netaktiv
address:     223, rue de Charenton
address:     75012 Paris
address:     France
phone:       +33 1 40 02 92 22
fax-no:      +33 1 40 02 01 02
e-mail:      hostmaster@netaktiv.com
nic-hdl:     HN16-FRNIC

and here is the output of whois.nic.de for the domain tageszeitung.de:

domain:      tageszeitung.de
descr:       Koelmel Computer GmbH
descr:       Gutenbergstrasse 1-3
descr:       D-76437 Rastatt
descr:       Germany
nserver:     s15123983.rootmaster.info
nserver:     ns.schlund.de

and here the output of whois.dns.be for the domain ecolo.be:

Domain:      ecolo
Status:      Registered
Registered:  Fri Jan 12 1996

Licensee:
   Name:     Philippe LESNE
   Company:  ECOLO-CEFE 
   Language: F 
   Address:  Rue du Seminaire 8
             5000 Namur
             Belgium
   Phone:    +32 81 22.78.71
   Fax:      +32 81 23.06.03
   Email:    hostmaster@ecolo.be

Each registry maintains its own whois server. There is no easy way to find out the name of the whois server for a given TLD, although whois.nic.TLD is common. The The Internet-Draft "Using DNS SRV records to locate whois servers" suggests way which is deployed in many European ccTLDs. It is implemented, for instance, in our whois client service.

.com and .net use a different system: the registry is a thin registry meaning that the registry does not hold the social information. Instead, the registrars hold it. Each must have its own whois server. In its reply, the whois server of the registry sends the name of the whois server of the registrar, the client is responsible for following it.

Designing a whois service requires the handling of touchy policy issues. Most are not specific to whois: any registry information service would have the same problem.

whois is a very old and obsolete protocol. However, no replacement is coming soon. Many attempts have been done: rwhois (RFC 2167, still used by ARIN and promoted by the RWhois project, which distributes a free software), whois++ (RFC 1835), LDAP (RFC 2798), etc. Most of them were failures (not always technical failures).

An IETF Working Group, CRISP (Cross Registry Information Service Protocol, works on a new and improved protocol. The current proposal, IRIS, is based on XML.