Using the “whois” Command – All you Need to Know

The “whois” command is very well-known in programming circles. The website whois.com is pretty well-known, even though it’s not accredited with ICANN. Using whois, you can find out everything you need to know about a domain – who owns it, when it expires, its status, nameservers, and even the contact information of the owners. In this tutorial, we’ll explore the uses of the whois command, why you would want to use it, and what advantages you have using the whois command vs just going to a website and pulling the information yourself.

Using the Whois Command

The whois command queries databases containing domain data. We’d previously seen how to use dig to specify a DNS server, and in that article, we saw that there are a few “authoritative” nameservers that you can use to directly resolve domain names most authoritatively. But just like most of the time, the dig or “ping” command queries the most convenient nameservers, the whois command also doesn’t query the most authoritative server. Instead, it queries a server that can refer you to the authoritative server.

For example, consider the following whois command:

whois bhagwad.com

This generates the following output:

You can see that we get all the details of the domain. Who the registrar is, when it was created and updated, the nameservers, and the e-mails you need to contact in order to report abuse.

But the data from the whois command is a lot more than just this. I can’t show you everything because of space constraints, but you can see that it queries the VeriSign servers from this screenshot:

The reason the tool queries VeriSign is that the VeriSign registry handles all .com and .net domains. Here’s a breakdown of the other registries that handle other domain types:

whois.verisign-grs.com	.com and .net domains
whois.publicinterestregistry.org	.org domains
whois.nic.io	.io domains
whois.arin.net	IP addresses in North America
whois.ripe.net	IPs in Europe, Middle East, parts of Asia
whois.apnic.net	IPs in Asia Pacific
whois.lacnic.net	IPs in Latin America
whois.afrinic.net	IPs in Africa
whois.iana.org	Metadata about TLDs and IP blocks

So, each domain type goes to a different whois server.

Registry vs Registrar

These servers can then refer you to another server that provides the whois information. For example, in the above example, you can see the following line:

Registrar WHOIS Server: whois.cloudflare.com

In this, VeriSign is sending the whois tool to Cloudflare for further information. Buy why? If Verisign already knows everything, why is it redirecting us to Cloudflare? The reason is that VeriSign is the registry, and Cloudflare is the registrar. This means that VeriSign knows where the information is found, but doesn’t carry that information itself. It’s simply saying, “Yes, this domain exists, the registrar is Cloudflare, and here is the Cloudflare whois server”. The whois command sees this line and then queries the Cloudflare server directly for accurate information.

This architecture is mandated by ICANN. It ensures that a single entity doesn’t fully control all the data. It keeps information scalably distributed across the globe.

Why Not Use Websites Instead of “Whois”?

You might be aware of websites like whois.com, or even the ICANN-affiliated https://lookup.icann.org/en, which can give you all the information you need. So why would you bother with using a separate tool like the whois command when you can just go to a browser and get the information yourself, like this?

For regular usage, the ICANN website lookup is indeed the best option. You don’t need to know anything about the command line, and you can just load the address in your browser, type in the domain name, and you’re good to go. The question then becomes – why would you choose to use the command line instead?

Here are some benefits to using the command line “whois” command, instead of checking it from a website.

Faster Repeated Lookups

While looking up whois data on websites is great for the occasional one-off retrieval, it becomes a lot more complicated if you have a lot of domain names for which you need information. Many websites have restrictions on the number of requests you can make in a given time, not to mention the annoyance of seeing unrelated content like ads, etc.

And because the website needs to load the entire HTML, etc, the process is slow. It’s fine for the single odd domain, but as soon as you need more, it’s impractical. Many websites even require you to pass a CAPTCHA, and depending on the complexity, this will add a delay for every additional lookup. For such situations, the whois command is perfect.

Simply typing:

whois bhagwad.com

It will give me all the information I need about my website without any additional barriers. I can even use bash scripting to parse the output of several domains at the same time. For example, let’s say I have a file called “domains.txt” with a list of domains like this:

example.com
bhagwad.com
somefakedomain12345.com

Now let’s say I want to see which of these domains is available for purchase. That means it shouldn’t be in a “renewed” status, or something similar. I can use the following bash script:

#!/bin/bash

while read domain; do
    status=$(whois "$domain" 2>/dev/null | grep -iE 'Domain Status|Status' | awk -F: '{print $2}' | sed 's/^[ \t]*//;s/[ \t]*$//' | paste -sd ', ')
    
    if [[ -z "$status" ]]; then
        echo "$domain : [NO STATUS FOUND or AVAILABLE]"
    else
        echo "$domain : $status"
    fi
done < domains.txt

Paste the above code into a file called “domainscheck.sh”, for example, and follow the instructions in my earlier tutorial on how to run sh files in Linux. Now, executing this file gives the following output:

As you can see, I’ve created the script file and given it execution permissions. Now, when I run it, I get a neat list of the status of each of the domains. In the above screenshot, only the last one is available for purchase – hardly surprising, since it’s a made-up domain that no one would use!

You can see how convenient the above script would be if you had a text file with hundreds of domains whose expiry you needed to check!

Unfiltered Data

When you look up the domain data through a website, they don’t give you the raw, unfiltered output that the whois command will. Instead, they format it according to what they think you will find most useful. Because of this, you might not get everything you’re looking for, particularly if you want to dig more deeply into the domain. Some websites, like the one run by ICANN, also give you the unfiltered output in the form of a JSON data structure, but you need to know how to read it, and it’s located at the very bottom.

Still, if it’s just the odd domain that you want to look up, it’s easier than using the whois command.

Conclusion

The whois command is a very useful tool for getting detailed information about a domain. Without it, you would have to go to a 3rd party website for the information, which could take a lot of time, particularly if you have many domains to look up. With the whois command, you get the raw, unfiltered output, and you can use scripting to get it in exactly the format you want.