Whois Protocol: Streamlined Domain Data Access

History of WHOIS

In the late 1960s, the MIT AI Lab developed the Incompatible Timesharing System (ITS). This system became a hub for thriving computing advancements. One utility, 'who,' displayed a list of active usernames and terminal names.

In 1971, they added 'finger,' broadening the utility by including user information. In 1977, they introduced the term 'WHOIS' to describe this function. Over time, it became the prevailing term, marking the evolution from humble beginnings on the ITS system.

WHOIS, born in 1982 as a directory service for ARPANET users, has come a long way. The protocol changed based on consensus policies like RFC 920. It expanded to help domain name registrants, law enforcement, and individual users.

In 1998, ICANN inherited the protocol. In 2016, they further enhanced it with gTLD Registration Directory Service obligation. Amid discussions about privacy and data accuracy, ICANN is working to improve the service. They are aiming to find the right balance in the ever-changing digital landscape.

ICANN itself does not keep domain registration details. Instead, all data resides in individual registrar or registry databases.

In 2007, ICANN introduced the Registrar Data Escrow (RDE) program. This program aims to increase the security of registrant information in case of registrar failure. As part of this initiative, registrars must regularly deposit backup copies of their registration data. They do this with designated escrow agents, such as Iron Mountain.

The Whois escrow service at Iron Mountain follows strict technical procedures. Registrars submit encrypted and compressed data files. This ensures the security and integrity of the information.

This escrow serves as a retrievable database in case of catastrophic failure or registrar disputes. Since there's no single Domain WHOIS database, records may vary based on retrieval methods or sources.

Domain WHOIS Record

The domain registration record has different sections. Each section serve a specific purpose and refer to various parties or components linked to the domain name. These sections provide information about different aspects of the domain.

Registrar

The registrar field is vital in gTLD registration records. But, it can be tricky to identify the registrar's actual name. Some registrars have multiple names or use different names for their operations (DBA), leading to confusion. Additionally, some registrars use their website URL as the name, which might not match their official corporate name.

Registrant, Administrative, Technical, and Billing Contact

In the Registrant section, only the name and postal address are necessary. But, WHOIS domain data may include extra details like email and phone numbers. This extra detail might not be accurate.

In Administrative and Other Contact Blocks, most fields are usually necessary. This ensures the accurate provision of contact information. ICANN requires making contact information for domain owners and managers publicly available. This includes mailing addresses, phone numbers, and email addresses, which raises privacy concerns.

Some domain registrars offer WHOIS privacy services. In these cases, they display their contact information instead of the registrant's. Yet, there is no absolute guarantee of this privacy. Legal requirements may need the release of private information.

Types of WHOIS lookup data models

WHOIS lookup data models are primarily of two types:

• Thick WHOIS Model
  In the Thick model, the domain name registry holds and stores all the domain registration data. This includes contact information, name servers, and other related details. When you perform a WHOIS lookup, the information comes directly from the registry's WHOIS database. This process provides comprehensive domain details in a single query.

• Thin WHOIS Model
  In the Thin model, the domain name registry stores minimal data for a domain. This includes the domain name server (DNS) and the registrar's contact information.
  The domain registrar stores the actual contact details of the domain owner separately. This includes information for registrant, administrative, technical, and billing contacts. To get full domain details, you need to make extra WHOIS queries to the registrar's WHOIS server.

These two data models determine how registries and registrars handle WHOIS data. Their format can vary based on the policies and practices of individual domain registries and registrars.

WHOIS in Cyber-Security

WHOIS provides insights into online threats and strengthens the digital defenses.

Threat Intelligence

Domain registration data acts as a foundational element for threat intelligence. Cyber-security specialists unveil details about domain ownership, registration, and historical data. This helps them to analyze and understand the origins of online threats.

Identifying Malicious Domains

Cyber-security experts leverage WHOIS to identify and flag potentially malicious domains. They examine registration details, patterns, and anomalies. This helps them identify domains linked to cyber threats.

Incident Response and Forensics

Domain registration data allows for a quick incident response after any cyber-attack. Forensics team use this information to trace the source of the attack. They identify responsible entities and gather evidence for legal proceedings.

Tracking Cyber Threat Actors

WHOIS aids in tracking and attributing cyber threat actors. Cyber-security experts uncover ownership details of domains involved in malicious activities. This helps them create profiles of threat actors and enhance attribution efforts in cyber-security.

Domain Reputation and Trustworthiness

Cyber-security specialists assess the reputation and trustworthiness of domains using WHOIS data. Understanding a domain's history helps assess its credibility and potential risks. This aids in making informed decisions about allowing or blocking access.

DNS and WHOIS

A Domain Name lookup, often called WHOIS, retrieves detailed domain registration data. This includes essential information about the domain owner. Distinguishing between a Domain Name lookup and a Domain Name Server (DNS) lookup is essential. WHOIS gives domain registration information, while a DNS lookup finds the IP address linked to a specific Domain Name.

WHOIS Alternatives

For more than 35 years, the WHOIS service has been the primary means to access domain name registration data. But, the internet community has recognized certain limitations which are as follows:

• The absence of a standardized format.
• Limited support for multiple languages.
• Lack of authorization capability for users.
• Restricted to lookup-only functions without search support.
• No standardized way to redirect or reference.
• No standardized method for determining which server to query.
• Lack of ability to authenticate the server or encrypt data transmission between the server and client.

Registration Data Access Protocol (RDAP) represents a groundbreaking creation. The Internet Engineering Task Force (IETF) developed this protocol.

RDAP aims to replace the WHOIS protocol and offers various benefits to users. It provides access to real-time registration data. Its design aims to address the limitations of WHOIS. The goal of this is to provide a more efficient and responsive experience for accessing domain data.

All gTLD registries and registrars have implemented the RDAP service as per ICANN's directives. Additionally, some ccTLDs in Europe have integrated this service into their systems.

Ready to perform WHOIS lookup?