WHOIS (port 43)

~ the goodbye ~

On 1 March 1982 Ken Harrenstien and Vic White at the Network Information Center, SRI International, published a short document titled NICNAME/WHOIS. It described a service running on a single machine called SRI-NIC that would take the name of an ARPANET user and hand back their full name and their telephone number. The network was small enough that a directory of everybody on it could live on one host, and the point of the thing was to put a human being behind a login.

The network outgrew that in about three years, and the protocol did not change at all. RFC 954 restated it in 1985. RFC 3912 restated it again in September 2004, written by Leslie Daigle, whose employer line on the document reads VeriSign, Inc. By then the things being looked up were no longer users but domains, and they numbered in the tens of millions. The mechanism underneath had not moved an inch. A server listened on TCP port 43 and a client sent it one line of text. What came back was prose, with no agreed shape to it at all.

For most of its working life the answer was a person. A query returned the registrant's name and their postal address, with a telephone number underneath, all of it readable by anybody who could open a socket. That was reasonable when the registry was one government contractor with a few thousand customers on its books. It was something else entirely once there were two hundred million domains and the easiest way to build a spam list was to walk the zone file.

~ seven thousand seven hundred bytes ~

RFC 3912 is 227 lines long. The entire specification of the protocol that answered for every domain name on the internet fits in 7,770 bytes, and most of that is boilerplate and page headers. Section 5 is two sentences, the first of which says that the protocol has no provisions for strong security, and the second of which advises that it therefore be used only for information meant to be seen by everybody.

The document also contains a note pointing at an IETF working group called CRISP that was addressing the shortcomings separately. That was 2004. The replacement that eventually came out of that lineage, RDAP, was published as a standard in 2015 and required of ICANN registrars from 2019, so the gap between the spec admitting the problem and the fix becoming mandatory ran to fifteen years.

~ the answers went blank before the protocol did ~

The General Data Protection Regulation took effect across the European Union on 25 May 2018. Publishing the home address and phone number of every domain registrant on a public port, with no access control of any kind, turned out to be difficult to defend under it. ICANN issued a temporary specification the same month and registrars started redacting, so a query that had once produced a person produced a form at a web gateway instead.

I have typed whois into a terminal more times than I can remember, nearly always to settle one question: whether a domain I wanted was really in use or just being sat on by somebody waiting for an offer. That used to come back with a name and an address on it. For most of the last decade it has come back as a block of the word REDACTED, and I stopped expecting anything else from it long before anybody announced a sunset.

That left a protocol still running everywhere and answering almost nothing. The useful part had moved behind web gateways and tiered access, neither of which port 43 was built to express. ICANN's global amendment to the registry and registrar agreements set a date: as of 28 January 2025, RDAP would be the definitive source for gTLD registration data, and nobody would be obliged to keep a WHOIS server up. The announcement went out on 27 January, one day ahead.

~ the chronicle ~

~ what answers today ~

I ran the queries on 14 October 2026 rather than trusting the announcement. Verisign still answers for .com on port 43 with a complete record, because the legacy agreements covering .com were never part of the amendment. Google Registry went the other way and deleted the hostnames outright: whois.nic.dev and whois.nic.app now return NXDOMAIN, so there is no server left to refuse you. Public Interest Registry left whois.nic.org resolving to an address that accepts nothing at all on port 43.

RFC 3912 sits in the IETF datatracker today as a Draft Standard with nothing superseding it, and the maturity level it holds was itself abandoned by the IETF back in 2011. No standards body ever retired this protocol. It was dropped from a contract.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »