登录
whois Command in Linux: Query Domain Registration Info
When you need to know who owns a domain, when it expires, which registrar handles it, or which organization holds a particular IP block, the whois command is the fastest route. It queries the registry databases that record this information and returns a plain-text response you can scan in a terminal. The output format varies by registry, but the questions you can answer are consistent: registrar, name servers, registration and expiry dates, and contact info (where privacy rules allow).
This guide explains how to use whois in Linux to look up domains, IP addresses, and AS numbers, how to target a specific server, and how to parse the output for the fields you actually care about.
whois Syntax
The general form is:
whois [OPTIONS] OBJECTOBJECT is the domain, IP address, or AS number you want information about. With no options, whois picks the right registry automatically based on the type of query.
Install whois
whois is not always installed by default. On Ubuntu, Debian, and Derivatives:
sudo apt update
sudo apt install whoisOn Fedora, RHEL, and Derivatives:
sudo dnf install whoisConfirm it is in place:
whois --versionVersion 5.6.6.The Debian-family whois is an actively maintained client with built-in routing logic that knows which registry to ask for each TLD.
Look Up a Domain
The most common use is checking a domain:
whois example.com Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2026-01-16T18:26:50Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2026-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority
Registrar IANA ID: 376
Name Server: ELLIOTT.NS.CLOUDFLARE.COM
Name Server: HERA.NS.CLOUDFLARE.COM
DNSSEC: signedDelegation
...The fields that matter most for everyday questions are:
-
Registrar, the company managing the registration. -
Creation DateandRegistry Expiry Date, which tell you how old the domain is and when it needs renewing. -
Name Server, which lists the DNS servers authoritative for the domain. -
DNSSEC, which shows whether the domain is cryptographically signed.
For ccTLDs (.de, .uk, .jp), the format differs because each country runs its own registry. The information is similar; the field names and order change.
Look Up an IP Address
whois on an IP returns the network allocation, not the domain:
whois 93.184.216.34inetnum: 93.184.216.0 - 93.184.216.255
netname: EDGECAST-NETBLK-03
descr: NETBLK-03-EU-93-184-216-0-24
country: EU
admin-c: DS7892-RIPE
tech-c: DS7892-RIPE
status: ASSIGNED PA
...This kind of query is the right tool for “who owns this IP that has been hitting my server” investigations. The output names the network block, maintainer, and abuse contact details when the registry publishes them.
Look Up an AS Number
Pass an autonomous system number with the AS prefix:
whois AS15169ASNumber: 15169
ASName: GOOGLE
ASHandle: AS15169
RegDate: 2000-03-30
Updated: 2012-02-24
Ref: https://rdap.arin.net/registry/autnum/15169AS lookups are useful when you trace a route with mtr or traceroute and want to know which network each hop belongs to.
Pick a Specific WHOIS Server
The default routing finds the right server for most TLDs, but you can force a query against a specific server with -h:
whois -h whois.arin.net 8.8.8.8The flag is the right tool for two situations: when the default routing picks the wrong upstream (rare but happens for some legacy TLDs), and when you want to compare answers between regional registries (ARIN, RIPE, APNIC, AFRINIC, LACNIC).
Limit the Recursion
Most modern whois clients follow a referral chain: query IANA, follow the pointer to the TLD registry, follow the pointer to the registrar, and return the most specific answer. To stop registry-to-registrar recursion, pass --no-recursion:
whois --no-recursion example.comThe flag is most useful when you specifically want the registry data and not the registrar’s slightly different format.
The -H option has a different purpose. It hides legal disclaimers from the output, which can make short lookups easier to read:
whois -H example.comFilter the Output
Real whois responses are dozens of lines long with legal disclaimers and template text. To extract one field, pipe through grep:
whois example.com | grep -E "Registrar:|Expiry Date:" Registry Expiry Date: 2026-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers AuthorityFor a name-server list:
whois example.com | awk '/Name Server:/ {print $NF}'ELLIOTT.NS.CLOUDFLARE.COM
HERA.NS.CLOUDFLARE.COMThese short patterns work for monitoring scripts that watch for domain expirations or DNSSEC status changes.
Check Domain Availability
If the domain is not registered, the response says so explicitly. The exact wording depends on the registry:
whois never-existed-domain-xyzzy.comNo match for domain "NEVER-EXISTED-DOMAIN-XYZZY.COM".Some registries (notably .io, .co, and several ccTLDs) return an empty or near-empty response for unregistered domains. Two heuristics that work in scripts:
- For
.com/.net/.org, grep forNo match fororDomain Name:in the output. - For ccTLDs, grep for
Domain not foundor check whether the registration fields exist.
Rate Limits and Etiquette
Registries rate-limit whois queries. Hammering them with a script is the fastest way to get blocked. If you query many domains, add a sleep between calls and cache the result locally. For bulk lookups, use the registry’s RDAP service directly or pay for a commercial WHOIS API.
A simple polite pattern:
while IFS= read -r domain; do
whois "$domain"
sleep 2
done < domains.txtTwo seconds between queries is a sane starting point; raise it if you see throttling responses.
Privacy and Redacted Output
Since GDPR took effect, most TLDs redact personal contact information for individual registrants. The response usually contains placeholders like REDACTED FOR PRIVACY or Data Protected, Not Disclosed. For organizations and legal entities, the contact information often stays visible.
This is not a defect in whois; the underlying registry data is simply less detailed than it used to be. For account-takeover prevention and abuse handling, focus on the registrar field and the abuse contact email, which remain published.
Quick Reference
| Task | Command |
|---|---|
| Look up a domain | whois example.com |
| Look up an IP address | whois 93.184.216.34 |
| Look up an AS number | whois AS15169 |
| Query a specific server | whois -h whois.arin.net 8.8.8.8 |
| Stop registry-to-registrar recursion | whois --no-recursion example.com |
| Hide legal disclaimers | whois -H example.com |
| Extract registrar and expiry fields | whois example.com | grep -E “Registrar:|Expiry Date:" |
| List name servers | whois example.com | awk ‘/Name Server:/ {print $NF}’ |
Troubleshooting
whois: command not found
Install the package: sudo apt install whois on Ubuntu, Debian, and Derivatives, or sudo dnf install whois on Fedora, RHEL, and Derivatives. The package is small and adds no significant dependencies.
Output says “fgets: Connection reset by peer”
The registry rate-limited or blocked your IP. Wait a few minutes and retry, slow your script down, or query through a different network.
Response is in a different language or alphabet
Some ccTLD registries return data in the local language. Look for the English section (usually further down), or pipe through iconv if the encoding makes the response unreadable in your terminal.
FAQ
What is the difference between WHOIS and RDAP?
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It returns structured JSON instead of free-text and supports authentication and access controls. Most registries now serve both, and RDAP is usually the better choice for scripts that need predictable fields.
Why does the data for the same domain look different between two whois runs?
Different clients and servers can follow the referral chain differently. One response may come from the registry, while another may include data from the registrar’s WHOIS server. Use --no-recursion when you want to stop at the registry answer.
Can I run my own WHOIS server?
Yes, but only registrars and registries have authoritative data. Self-hosted WHOIS servers are useful for internal directories (IP allocation in a large network), not for public domain lookups.
Conclusion
whois is the answer to “who owns this”, whether the “this” is a domain, an IP, or an AS number. The output is plain text, the flags are short, and a handful of grep/awk patterns turn it into a script-friendly data source. For bulk work, slow the queries down and respect the rate limits the registries publish.
For related reading, see our guides on the dig command and the nslookup command .
