Micah LeeDec 30, 2022
Is the authoritative source of WHOIS data stored with the registrar that a domain name is registered with, or some other organization?
Show thread~n
@micahflee It's almost like DNS, just with fewer layers/intermediaries. IANA delegates whois authority to the operators of each TLD. Your whois client either has that list or recurses from whois,iana,org
I'm not entirely sure if this exists but for some TLDs the registry in charge can refer to the whois service of providers that sell domains under that TLD.
Dec 30, 2022 at 12:39amWeb
Show threadClipperChip Dec 30, 2022
@nblr @micahflee That's a better reply :)
Show thread~nDec 30, 2022
@clipperchip @micahflee
Sometimes I'm really glad to be given the opportunity to whip out some of my niche-knowledge from the Internet's machine room. The stuff that's entirely useless for daily life. :-)
Show threadClipperChip Dec 30, 2022
@nblr @micahflee My time at c't sure helped with that, too. I suspected this is how it works since I know that DeNIC is the authoritative source for .de domains. I just wasn't sure enough about other TLDs.
Show thread~nDec 30, 2022

@clipperchip @micahflee
Most whois clients have a list, so usually IANA is not queried, but there is this delegation mechanism to discover/recurse. Basically what whois does is returning a key/value printout of all properties of a domain (in this sense "org" is a domain too)

The "whois:" field points towards the responsible whois server while other fields contain the usual whois stuff like "name:" "organization:" etc.

Show thread~nDec 30, 2022
@micahflee For IP-addresses it's a bit more tricky. Your client has a set of which block was assigned to which RIR (Regional Internet Registry, i.e. RIPE NCC, ARIN, LACNIC, Afrinic, etc.) and the RIR can refer to the receiving RIR for transferred blocks. But still IANA will answer with the information which RIR is responsible for which /8:
Show thread~nDec 30, 2022
@micahflee Last but not least: The whois protocol is old. Very old. How old? Its assigned port is 43. It is the most minimal implementation of a thing that returns information after receiving a query. It is even more basic than HTTP/1.0 as HTTP knows verbs like GET which whois doesn't. You connect to the whois server at TCP/43, you state the domain, you get a reply: