What is the default whois server for the whois command?
What is the default whois server queried when using the whois command?
I use a /etc/whois.conf file to manage servers queried for the whois command. The contents of the file are based on this Super User answer. If I use the server listed in the answer for .com (whois.verisign-grs.com), all queries to domains registered with GoDaddy return an incomplete record.
However, if I comment out the entry in the file for .com, then the full whois record for a GoDaddy registered domain will be returned.
So I want to figure out what server is being queried when whois is using the default lookup settings.
4 Answers
You may use strace which is a debugging tool to find what was really used:
strace --trace=sendmmsg --verbose=all -s 64 -o whois.strace.log whois google.comwhois.strace.log
sendmmsg(3, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\305\300\1\0\0\1\0\0\0\0\0\1\5whois\fverisign-grs\3com\0\0\1\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=51}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=51}, {msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\375\304\1\0\0\1\0\0\0\0\0\1\5whois\fverisign-grs\3com\0\0\34\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=51}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=51}], 2, MSG_NOSIGNAL) = 2
sendmmsg(3, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="8\333\1\0\0\1\0\0\0\0\0\1\5whois\vmarkmonitor\3com\0\0\1\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=50}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=50}, {msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\f\336\1\0\0\1\0\0\0\0\0\1\5whois\vmarkmonitor\3com\0\0\34\0\1\0\0)\4\260\0\0\0\0\0\0", iov_len=50}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=50}], 2, MSG_NOSIGNAL) = 2
+++ exited with 0 +++When pulling up the man page on whois it has the follow description:
2DESCRIPTION whois searches for an object in a RFC 3912 database.
This version of the whois client tries to guess the right server to ask for the specified object. If no guess can be made it will connect to whois.networksolutions.com for NIC handles or whois.arin.net for IPv4 addresses and network names.
From man whois:
This version of the whois client tries to guess the right server to ask for the specified object. If no guess can be made it will connect to whois.networksolutions.com for NIC handles or whois.arin.net for IPv4 addresses and network names.And:
If the /etc/whois.conf configuration file exists, it will be consulted to find a server before applying the normal rules. Each line of the file should contain a regular expression to be matched against the query text and the whois server to use, separated by white space. IDN domains must use the ACE format. … WHOIS_SERVER This server will be queried if the program cannot guess where some kind of objects are located. If the variable does not exist then whois.arin.net will be queried.So, depending on /etc/whois.conf and WHOIS_SERVER:
- whois.networksolutions.com for NIC handles
- whois.arin.net for IPv4 addresses and network names.
First of all your request your local whois client is contacting the central registry ( IANA ) and asking for the responsible domain registrar. The client is following the hierarchical references down to the registrar which can you provide the desired information. Source:
3
