WHOIS(1)

💅 WHOIS(1) — the Debian GNU/Linux manual page, bestie edition

okay so you know that whois command? the one from the whois package? yeah. this is its manual page, and i'm about to make it make sense. it's a client for the whois directory service — think of it as the original "let me look up who owns this" tool. 👑

---

✨ NAME ✨

whois — client for the whois directory service. that's it, that's the whole job. it asks servers stuff about domains, IPs, people, whatever. slay.

---

🌸 SYNOPSIS 🌸

the way you call this thing, in all its forms:

whois [ { -h | --host } HOST ] [ { -p | --port } PORT ]
[ -abBcdGHIKlLmMrRx ] [ -g SOURCE:FIRST-LAST ] [ -i ATTR[,ATTR]... ]
[ -s SOURCE[,SOURCE]... ] [ -T TYPE[,TYPE]... ] [ --verbose ]
[ --no-recursion ] OBJECT

whois -q KEYWORD

whois -t TYPE

whois -v TYPE

whois --help

whois --version

that's a LOT of brackets but like, it's giving flexible. you're not gonna use all of these at once, promise. 🫶

---

🦋 DESCRIPTION 🦋

so. whois searches for an object in a RFC 3912 database. that's the vibe.

this version of the whois client? it tries to guess the right server to ask for the object you gave it. it's lowkey psychic like that. but if it can't make a guess, here's the fallback tea:

• it connects to whois.networksolutions.com for NIC handles
• and whois.arin.net for IPv4 addresses and network names

no cap, that's the automatic backup plan. 💖

---

🎀 OPTIONS 🎀

okay bestie, buckle up. here come ALL of them. every single flag. i'm not skipping a single one, periodt.

the main character options ⭐

• -h HOST, --host=HOST — connect to HOST. simple as that.
• -H — do not display the legal disclaimers that some registries like to show you. (those unskippable walls of text? this is your skip button. iconic.)
• -p PORT, --port=PORT — connect to PORT.
• -I — first query whois.iana.org, then follow its referral to the whois server that's actually authoritative for that request. works for IP addresses, AS numbers and domains.

⚠️ BEWARE: this implies that the IANA server will receive your complete query. so like, don't be messy with it. 👀

• --no-recursion — disable recursion from registry to registrar servers. no passing the mic.
• --verbose — be verbose. say more. we love a talkative king.
• --help — display online help.
• --version — display the program version.

the RIPE-coded options 👑

other options are flags understood by whois.ripe.net and some other RIPE-like servers. iykyk.

• -a — also search all the mirrored databases. going everywhere.
• -b — return brief IP address ranges with abuse contact.
• -B — disable objects filtering. (show the e-mail addresses.) 👀📧
• -c — return the smallest IP address range with a reference to an irt object.
• -d — return the reverse DNS delegation object too.
• -g SOURCE:FIRST-LAST — search updates from the SOURCE database between FIRST and LAST update serial number. it's useful to obtain Near Real Time Mirroring stream. fancy!!
• -G — disable grouping of associated objects.
• -i ATTR[,ATTR]... — inverse-search objects having associated attributes. ATTR is the attribute name, while the positional OBJECT argument is the attribute value. (yes, they swap roles, it's giving switch energy ✨)
• -K — return primary key attributes only. but wait, there's exceptions:
  • the members attribute of set objects is always returned
  • another exception: all attributes of the objects organisation, person and role are never returned

messy? yes. but that's the rule. 💅

• -l — return the one level less specific object.
• -L — return all levels of less specific objects.
• -m — return all one level more specific objects.
• -M — return all levels of more specific objects.
• -q KEYWORD — return information about the server. KEYWORD can be:
  • version — for the server version
  • sources — for the list of database sources
  • types — for the list of supported object types
• -r — disable recursive lookups for contact information.
• -R — disable following referrals and force showing the object from the local copy in the server.
• -s SOURCE[,SOURCE]... — request the server to search for objects mirrored from SOURCE. sources are delimited by comma, and the order is significant. use the -q sources parameter to obtain a list of valid sources. 📋
• -t TYPE — return the template for a object of TYPE.
• -T TYPE[,TYPE]... — restrict the search to objects of TYPE. multiple types are separated by a comma.
• -v TYPE — return the verbose template for a object of TYPE.
• -x — search for only exact match on network address prefix.

---

🧚 NOTES 🧚

this is the lore section. read it, it's important, fr fr.

when querying the Verisign gTLDs (e.g. .com, .net...) thin registry servers for a domain, the program will automatically prepend the domain keyword to only show domain records. and if you want other kinds of records? you must use the nameserver or registrar keywords. no shortcuts. 🌈

when querying whois.arin.net for IPv4 or IPv6 networks, the CIDR netmask length will be automatically removed from the query string. poof, gone. ✨

when querying whois.nic.ad.jp for AS numbers, the program will automatically convert the request into the appropriate format, inserting a space after the string AS.

when querying whois.denic.de for domain names and no other flags have been specified, the program will automatically add the flag -T dn.

when querying whois.dk-hostmaster.dk for domain names and no other flags have been specified, the program will automatically add the flag --show-handles.

RIPE-specific command line options are ignored when querying non-RIPE servers. this may or may not be the behaviour intended by the user. (it's giving "not my problem" honestly 😭). and when using non-standard query parameters, the command line options which are not to be interpreted by the client must follow the -- separator — that's the thing that marks the beginning of the query string. 🎯

if the /etc/whois.conf configuration file exists, it will be consulted to find a server before applying the normal rules. each line of the file should contain:

• a regular expression to be matched against the query text
• and the whois server to use

...separated by white space. and IDN domains must use the ACE format. noted. 📝

the whois protocol does not specify an encoding for characters which cannot be represented by ASCII, and implementations vary wildly. if the program knows that a specific server uses a certain encoding, if needed it will transcode the server output to the encoding specified by the current system locale. 🌍

command line arguments will always be interpreted accordingly to the current system locale and converted to the IDN ASCII Compatible Encoding.

---

📁 FILES 📁

• /etc/whois.conf

that's the one file. one. singular. she's low maintenance. 💅

---

🌈 ENVIRONMENT 🌈

• LANG — when querying whois.nic.ad.jp and whois.jprs.jp, English text is requested unless the LANG or LC_MESSAGES environment variables specify a Japanese locale.
• WHOIS_OPTIONS — a list of options which will be evaluated before the ones specified on the command line.
• WHOIS_SERVER — this server will be queried if the program cannot guess where some kind of objects are located. if the variable does not exist then whois.arin.net will be queried.

---

👀 SEE ALSO 👀

• whois.conf(5).
• RFC 3912: WHOIS Protocol Specification.
• RIPE Database Query Reference Manual: <https://www.ripe.net/data-tools/support/documentation/ripe-database-query-reference-manual>

---

💀 BUGS 💀

okay so this is the scary part, bestie. hold my hand. 🫶

the program may have buffer overflows in the command line parser. so be sure to not pass untrusted data to it. and — direct quote energy — it should be rewritten to use a dynamic strings library. yeah. it's giving "we know, we know". 😭

---

📜 HISTORY 📜

this program closely tracks the user interface of the whois client developed at RIPE by Ambrose Magee and others, on the base of the original BSD client. respect the elders. 🙌

---

💖 AUTHOR 💖

Whois and this man page were written by Marco d'Itri <md@linux.it> and are licensed under the terms of the GNU General Public License, version 2 or later. king behaviour, honestly. 👑

---

and that's the whole page!! this manual came to you from the Debian GNU/Linux corner of the world, dated 2019-12-30, authored by the one and only Marco d'Itri, and it's filed under WHOIS(1). mwah. 💋✨ go look somebody up, bestie. 🎀🦋💅