How WHOIS Databases Work
The registry and registrar system behind every domain lookup, and how a query actually gets answered.
Core Concept
WHOIS is a query protocol that returns registration information for a domain — who registered it, through which registrar, and under what status.
It predates the modern web, originally designed as a simple directory service for early ARPANET resources before being adapted for domain registration records.
The Registry and Registrar Structure
Domain registration data flows through a layered system of authorities.
- Registry — manages the TLD itself (e.g. Verisign for .com)
- Registrar — sells domains to end users on the registry's behalf
- Registrant — the actual domain owner
Thin vs Thick WHOIS
Thin registries store only referral data and point to the registrar's WHOIS server; thick registries hold the full record centrally.
What a WHOIS Record Typically Contains
A standard WHOIS response includes several categories of information, though the exact fields vary by TLD and privacy settings.
- Registration and expiration dates
- Registrar name and contact details
- Nameserver assignments
- Domain status codes
Querying WHOIS in Practice
Tools querying WHOIS need to know which server holds authoritative data for a given TLD before they can retrieve a record.
For thin registries, this means an extra hop: first querying the registry for a referral, then querying the registrar's own WHOIS server for the full record.
No Unified Schema
WHOIS output format varies by registrar and TLD, which is why parsing WHOIS reliably at scale is harder than it initially appears.
Domain Status Codes
Status codes describe a domain's current state within the registration lifecycle.
- clientTransferProhibited — transfer locked by the registrar
- pendingDelete — domain nearing expiration cleanup
- serverHold — registry-level restriction, often abuse-related
Real-World Implementation
WHOIS data underpins a range of practical workflows.
- Domain availability and expiration monitoring
- Trademark and brand protection research
- Security investigations tracing registrant patterns
As privacy regulations tighten what's publicly available, RDAP is gradually replacing WHOIS as the standardized, structured alternative.
Common Mistakes to Avoid
A few common mistakes come up when relying on WHOIS lookups.
- Assuming WHOIS is a single unified database rather than a distributed protocol.
- Overlooking the referral hop required for thin registries before reaching the full record.
- Treating WHOIS output format as consistent across every registrar and TLD.
- Ignoring domain status codes that reveal important context beyond basic registration data.
- Failing to account for privacy protection when interpreting an incomplete-looking record.
- Overlooking rate limits when building automated WHOIS query tooling.
- Assuming every registrar's WHOIS server is equally reliable and responsive.
- Failing to handle WHOIS server timeouts gracefully in automated systems.
- Overlooking that some newer gTLDs launched with thick WHOIS from inception.
- Assuming WHOIS port 43 access is universally unrestricted for automated tools.
- Failing to check registrar-specific rate limits before scaling any WHOIS integration.
- Overlooking that some WHOIS servers require a specific query format for accurate results.
Best Practices Checklist
These practices lead to more reliable use of WHOIS data.
- Understand whether a TLD uses thin or thick WHOIS before interpreting query results.
- Check domain status codes alongside basic registration data for fuller context.
- Account for privacy protection rather than assuming missing data means something suspicious.
- Use RDAP where available for more consistent, structured results.
- Query the correct authoritative WHOIS server rather than relying on cached or third-party mirrors alone.
- Build automated WHOIS tooling with rate limiting and retry logic from the start.
- Handle registrar-specific reliability differences gracefully in query pipelines.
- Implement graceful timeout handling for unresponsive WHOIS servers.
- Note that many newer gTLDs use thick WHOIS by default, differing from legacy TLD patterns.
- Verify port 43 access policies before building automated WHOIS tooling around them.
- Check registrar-specific rate limits proactively before scaling any integration.
- Verify the exact query format expected by a specific WHOIS server before automating against it.
Frequently Asked Questions
Frequently asked questions about how WHOIS databases work.
Is WHOIS one single global database?
No — it's a query protocol, with each registry and registrar operating its own server independently rather than a unified database.
What's the difference between thin and thick WHOIS?
Thin registries store only referral data pointing to the registrar's WHOIS server, while thick registries hold the full record centrally.
Why does WHOIS output look different depending on the domain?
Because format varies by registrar and TLD, there's no single standardized schema the way there is with the newer RDAP protocol.
What do domain status codes actually tell me?
They describe the domain's current state in its registration lifecycle, such as whether it's locked against transfer or nearing expiration.
Is WHOIS being replaced by something else?
Gradually, yes — RDAP is emerging as a more structured, standardized alternative, though WHOIS remains widely available in parallel.
Are all registrar WHOIS servers equally reliable?
No — reliability and response times vary meaningfully between registrars, which automated tooling should account for.
What happens if a WHOIS query times out?
This depends on the querying tool's error handling — well-built systems retry gracefully rather than treating a timeout as a definitive failure.
Should WHOIS automation include built-in rate limiting?
Yes — building it in from the start avoids running into registry-imposed limits and potential temporary blocks.
Do newer gTLDs use thick or thin WHOIS?
Many newer gTLDs launched with thick WHOIS by default, differing from the thin model still common among legacy TLDs like .com.
Is WHOIS port 43 access always unrestricted?
Not necessarily — some registries apply rate limiting or access restrictions on port 43 that automated tooling needs to account for.
Do all WHOIS servers accept queries in the same format?
Not always — some require a specific format, making it worth verifying before building automated querying around a particular server.