Home / ubuntu / Questions / 745267
In Process
Paul
Asked: 2016-03-13 13:59:16 +0800 CST

What is the default whois server for the whois command?

  • 772

What is the default whois server queried when using the whois command?

I use a /etc/whois.conf file to manage servers queried for the whois command. The contents of the file are based on this Super User answer. If I use the server listed in the answer for .com (whois.verisign-grs.com), all queries to domains registered with GoDaddy return an incomplete record.

However, if I comment out the entry in the file for .com, then the full whois record for a GoDaddy registered domain will be returned.

So I want to figure out what server is being queried when whois is using the default lookup settings.

whois

4 Answers

  1. You may use strace which is a debugging tool to find what was really used:

    strace --trace=sendmmsg --verbose=all -s 64 -o whois.strace.log whois google.com

    whois.strace.log

    sendmmsg(3, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\305\300\1\0\0\1\0\0\0\0\0\1\5whois\fverisign-grs\3com\0\0\1\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=51}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=51}, {msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\375\304\1\0\0\1\0\0\0\0\0\1\5whois\fverisign-grs\3com\0\0\34\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=51}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=51}], 2, MSG_NOSIGNAL) = 2
sendmmsg(3, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="8\333\1\0\0\1\0\0\0\0\0\1\5whois\vmarkmonitor\3com\0\0\1\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=50}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=50}, {msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\f\336\1\0\0\1\0\0\0\0\0\1\5whois\vmarkmonitor\3com\0\0\34\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=50}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=50}], 2, MSG_NOSIGNAL) = 2
+++ exited with 0 +++
    • 1

  2. When pulling up the man page on whois it has the follow description:

    DESCRIPTION whois searches for an object in a RFC 3912 database.

    This version of the whois client tries to guess the right server to ask for the specified object. If no guess can be made it will connect to whois.networksolutions.com for NIC handles or whois.arin.net for IPv4 addresses and network names.

    • 0

  3. From man whois:

       This version of the whois client tries to guess the right server to ask
   for the specified object. If no guess can be made it  will  connect  to
   whois.networksolutions.com  for  NIC handles or whois.arin.net for IPv4
   addresses and network names.

    And:

       If the /etc/whois.conf configuration file exists, it will be  consulted
   to  find  a  server  before applying the normal rules. Each line of the
   file should contain a regular expression  to  be  matched  against  the
   query  text and the whois server to use, separated by white space.  IDN
   domains must use the ACE format.

   …

   WHOIS_SERVER
          This  server  will  be queried if the program cannot guess where
          some kind of objects are located. If the variable does not exist
          then whois.arin.net will be queried.

    So, depending on /etc/whois.conf and WHOIS_SERVER:

    • whois.networksolutions.com for NIC handles
    • whois.arin.net for IPv4 addresses and network names.
    • 0

  4. First of all your request your local whois client is contacting the central registry ( IANA ) and asking for the responsible domain registrar. The client is following the hierarchical references down to the registrar which can you provide the desired information. Source: https://whois.icann.org/en/dns-and-whois-how-it-works

    • 0