WHOIS Protocol: History, Limits, and Its Successor

By Manny Fernandez

November 11, 2026

WHOIS Protocol: History, Limitations, and What Replaced It

No fluff. Just the config that works.

Executive Summary

Objective: Explain where the WHOIS protocol came from, why it no longer fits the modern internet, and what took its place, so you know which lookups still work and why.

Target audience: Network and security engineers, SOC analysts, OSINT practitioners, and anyone who still types whois from muscle memory.

If you have ever run whois against a phishing domain at 2 AM, you have used one of the oldest protocols still running on the internet. The WHOIS protocol predates DNS, predates TCP/IP on the ARPANET, and was never designed for the job we kept asking it to do. This post covers its history, its limitations, and its successor at a high level. RDAP gets its own deep dive in a separate post.

Prerequisites and Architecture

Assumed knowledge: basic DNS (TLDs, registrars, nameservers), TCP ports, and comfort at a shell prompt.

Lab requirements: any Linux or macOS host with outbound TCP 43 and 443, plus the whois, nc (netcat), curl, and jq packages. On Ubuntu: sudo apt install whois netcat-openbsd curl jq.

Component	Role in a lookup
Registry	Runs a TLD (Verisign for .com, Nominet for .uk). Holds the authoritative domain record.
Registrar	Sells the domain and, for thin registries like .com, holds the contact data.
Registrant	The person or organization that registered the domain.
RIR	Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC). Holds IP and ASN records.
IANA	Root of the referral chain. Tells clients which server is authoritative for a TLD or IP block.
WHOIS server	Listens on TCP port 43 and returns free-form text.

A Short History of the WHOIS Protocol

Figure 1: WHOIS milestones, 1970s to 2027

Timeline of the WHOIS protocol from the 1970s ARPANET NIC to the 2025 gTLD sunset and RDAP

1970s: A phone book for the ARPANET

WHOIS started as a people directory, not a domain database. Elizabeth “Jake” Feinler ran the Network Information Center (NIC) at SRI for the ARPANET, and her team built the first online directory of network users so researchers could find each other. ICANN credits her as the woman behind WHOIS, and she was later inducted into the Internet Hall of Fame (biography).

1982 and 1985: RFC 812 and RFC 954

In March 1982, Ken Harrenstien and Vic White of Feinler’s group published RFC 812, NICNAME/WHOIS, describing a server that offered online lookups equivalent to the printed ARPANET Directory. The spec said outright that responses were meant to be read by a human, not parsed by a machine (port 43 reference). RFC 954 updated it in October 1985 with Feinler as co-author (IETF Datatracker). The user program was officially NICNAME; nearly everyone called it WHOIS.

1990s: Commercial internet, many servers

When registration moved from one NIC to many competing registries and registrars, WHOIS went from one server to thousands. Each operator chose its own output layout, its own query flags, and its own rate limits. Clients coped by shipping hard-coded tables mapping TLDs to hostnames and by following referral lines from one server to the next.

2004: RFC 3912 documents the protocol as it is

In September 2004, Leslie Daigle of VeriSign published RFC 3912, which obsoleted RFC 812 and RFC 954. It did not fix anything. It stripped out stale material and wrote down the wire protocol as deployed, including its known flaws, and noted that a replacement was being worked on elsewhere in the IETF. RFC 3912 remains the current WHOIS specification.

2018: GDPR empties the record

The EU General Data Protection Regulation took effect on 25 May 2018. To keep registries and registrars legal, ICANN adopted the Temporary Specification for gTLD Registration Data effective the same day. Registrars kept collecting full contact data but had to redact registrant, admin, and tech names, phone numbers, and street addresses from public output (DomainTools summary). This is where REDACTED FOR PRIVACY came from, and many registrars applied it worldwide, not just to EU registrants.

2025: The gTLD sunset

ICANN’s 2023 Global Amendment took effect on 7 August 2023 and set 28 January 2025 as the WHOIS Services Sunset Date (ICANN amendment page). On that date, RDAP became the definitive source for gTLD registration data (ICANN announcement).

How the WHOIS Protocol Works on the Wire

It is almost too simple. Per RFC 3912, the client opens TCP port 43, sends one line of text ending in CRLF, the server sends back text, and the server closes the connection. No handshake, no headers, no status codes. You can do it with netcat:

printf 'example.com\r\n' | nc whois.verisign-grs.com 43

That query hits the .com registry. Because .com is a thin registry, Verisign returns only domain-level data (registrar, dates, status, nameservers) plus a Registrar WHOIS Server line. The whois client then follows that referral to the registrar’s server for contact data. Your client is quietly chaining two or three plain-text TCP sessions together every time you run a lookup.

IANA sits at the top of that chain. Ask it about a TLD and it tells you who to ask next:

whois -h whois.iana.org com

domain:       COM
organisation: VeriSign Global Registry Services
...
whois:        whois.verisign-grs.com
status:       ACTIVE

Limitations of WHOIS

RFC 3912 is unusually honest about its own protocol: it says WHOIS has no provisions for strong security and would not normally be acceptable to the IETF if it were proposed today (RFC 3912, Security Considerations). The practical problems:

No security at all. No authentication, no integrity, no confidentiality. Queries and answers cross the wire in cleartext and can be spoofed or altered in transit.
No schema. Every server picks its own field names and layout. Parsing WHOIS at scale means maintaining a pile of per-registry regexes that break whenever someone changes a label.
No internationalization. The protocol has no way to state the character set in use, so internationalized domain names and non-ASCII contact data come back garbled or not at all.
No server discovery. Nothing in the protocol tells a client which server to ask. Clients ship hard-coded server lists that go stale when a registry turns its server off.
No standard query syntax. Flags for exact match, handle lookup, or record type differ by server, so a query that works at RIPE fails at ARIN.
All-or-nothing access. There is no way to authenticate a law-enforcement or abuse analyst and show them more than an anonymous user. After GDPR, everyone gets the redacted view.
Rate limiting by blunt instrument. Servers throttle or blacklist by source IP with no standard error, so a script just sees empty replies or dropped connections.

The Successor: RDAP

The IETF answer is the Registration Data Access Protocol (RDAP): a RESTful service that returns structured JSON over HTTPS. The first RDAP RFCs shipped in 2015, gTLD registries and registrars have offered it since 2019, and ICANN lists its advantages as internationalization, secure access, authoritative service discovery, and differentiated access to registration data (ICANN announcement).

	WHOIS	RDAP
Transport	Cleartext TCP 43	HTTPS
Response	Free-form text	JSON with defined fields
Finding the server	Hard-coded client lists	IANA bootstrap files
Character sets	Undefined	UTF-8
Tiered access	Not possible	Supported via HTTP authentication

That is all the RDAP you get here. The query paths, the bootstrap process, the JSON structure, and the CLI clients are coming in the dedicated RDAP post. For a browser lookup today, use ICANN Lookup. For nonpublic gTLD data with a legitimate need, ICANN points to the Registration Data Request Service.

Is WHOIS Dead? Where It Stands in 2026

Not exactly. What expired on 28 January 2025 was the contractual obligation for gTLD registries to run WHOIS, not the protocol itself (TrustMyIP analysis). ICANN’s own page says gTLD registries and registrars must run RDAP but no longer have to run WHOIS, with .com, .name, and .post still required (ICANN RDAP overview).

What you look up	Does port 43 still answer?
.com, .name, .post	Yes. WHOIS is still a contractual requirement.
Other gTLDs	Registry by registry. 74 gTLD registries shut theirs down within a month of the sunset.
Most ccTLDs	Usually yes. ccTLDs are not bound by ICANN contracts; about 60 percent had deployed RDAP by early 2026.
.uk	Until 9 February 2027, when Nominet retires port 43.
IPs and ASNs (ARIN)	Yes. Retirement is deferred until RDAP adoption milestones are met.

Traffic tells the same story. gTLD WHOIS queries fell from roughly 122 billion a month in January 2025 to about 49 billion by August 2025, and RDAP passed WHOIS in June 2025 (IETF blog, APNIC blog). The 74-registry shutdown figure comes from ICANN reachability scans cited in the APNIC post. Nominet’s .uk date is on its RDAP transition page.

On the numbers side, ARIN proposed retiring port 43 on or after 1 January 2029 (ARIN consultation). After community pushback, its October 2026 results put port 43 retirement on hold until RDAP adoption hits the milestones the community asked for, and it will consult again before setting a date (ARIN results).

Verification and Validation

Run these to see each point above for yourself. Output is abridged; your results will differ in the details.

1. Follow the referral chain

whois -h whois.iana.org com | grep -i '^whois'

whois:        whois.verisign-grs.com

Success: IANA names the registry’s WHOIS server. Repeat for a newer gTLD; an empty whois: line means that registry no longer advertises port 43.

2. Talk to port 43 by hand

printf 'example.com\r\n' | nc whois.verisign-grs.com 43 | head -8

   Domain Name: EXAMPLE.COM
   Registry Domain ID: 2336799_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.iana.org
   Updated Date: ...
   Creation Date: 1995-08-14T04:00:00Z

Success: plain text comes back and the connection closes on its own. That is the whole protocol.

3. Look up an IP block at an RIR

whois 8.8.8.8 | grep -E '^(NetRange|CIDR|OrgName)'

NetRange:       8.8.8.0 - 8.8.8.255
CIDR:           8.8.8.0/24
OrgName:        Google LLC

Success: ARIN answers on port 43 with the netblock owner.

4. Compare with RDAP

curl -s https://rdap.org/domain/example.com | jq -r '.ldhName, .events[0].eventAction'

EXAMPLE.COM
registration

Success: the same record comes back as JSON over HTTPS with named fields instead of free text.

Troubleshooting and Gotchas

Gotcha 1: Lookups for a newer gTLD suddenly return nothing

Symptom: whois hangs, returns No whois server is known, or prints only a registry banner. Cause: the registry turned off port 43 after the sunset and your client’s hard-coded server list is stale. The Debian and Ubuntu whois package, for example, removed the .info, .mobi, and .travel servers in early 2026 (TrustMyIP).

whois -h whois.iana.org info | grep -iE '^(whois|refer)'
curl -s https://rdap.org/domain/example.info | jq -r '.ldhName'

Fix: if IANA lists no WHOIS server, use RDAP. Update any script that parses WHOIS for gTLDs to query RDAP instead.

Gotcha 2: Everything says REDACTED FOR PRIVACY

Symptom: registrant fields are blank or redacted on a domain you are investigating. Cause: this is policy since May 2018, not a sign the domain is hiding something. Fix: pivot on what is still public (registrar, creation date, nameservers, status codes, abuse contact). For a legitimate need for the real contact data, file through RDRS or the registrar’s disclosure process.

whois example.com | grep -iE 'registrar abuse|creation date|name server|status'

Gotcha 3: Your script gets empty replies after a few hundred queries

Symptom: a bulk enrichment job works, then starts returning empty output or connection resets. Cause: silent per-IP rate limiting; WHOIS has no status codes to tell you why. Fix: throttle, cache results, and move bulk jobs to RDAP, which returns proper HTTP status codes such as 429 when you are rate limited.

for d in $(cat domains.txt); do whois "$d" > "out/$d.txt"; sleep 3; done

Bottom Line

WHOIS earned its 40-plus years. It was a phone book for a few hundred researchers that got stretched into the identity layer of a global commercial internet, with no security, no schema, and no way to tell users apart. Keep the whois command for quick checks on .com and most ccTLDs, but build anything new on RDAP. The RDAP deep dive is next.