Find Whois Server for Domain

Objective: Find the whois server for a particular domain or TLD (top-level domain).

There is currently no standard for determining the responsible whois server for a DNS domain. Some whois clients are hard coded with the whois servers to be used. Other whois clients perform DNS queries to determine a whois server for a domain. In this article, we will go through the most common ways of determining the whois server for a domain.

Find Whois Server Using IANA Root Zone Database

IANA (Internet Assigned Numbers Authority) has a list of zones and the corresponding whois servers for those zones. The list can be found here.

So, if you want to find out the whois server for ‘.sg‘ domains, the list will give you whois.sgnic.sg as the whois server.

Find Whois Server Using IANA Whois Server

IANA also has a whois service to retrive the whois server info. The IANA’s whois server is whois.iana.org. So, to determine the whois server for ‘.sg‘ domains, you can run the whois query like this.

To make a whois query for let’s say the site hdb.gov.sg, we can now directly query the whois server for ‘.sg‘ domains.

Find Whois Server Using DNS With whois-servers.net

You can make a DNS CNAME query to whois-servers.net to determine the whois server. To determine the whois server for .sg domains, make a DNS CNAME lookup to sg.whois-servers.net. Similarly, to determine the whois server for .io domains, make a DNS CNAME query for io.whois-servers.net.

I am not sure who maintain these records, or if this is official. But, it seems to be pretty accurate.

Find Whois Server Using DNS SRV Records

This is another DNS query based on SRV records to locate whois servers. There are two ways to perform this search: top-down model or bottom-up model. The default is the bottom-up model and we will use this model to locate whois servers.

DNS SRV records are in the form of “_Service._Proto.Name“. For whois, the first two fields map to the following:

“_nicname” is the symbolic name for whois in the /etc/services file. “_tcp” indicates the protocol used by whois – TCP.

Now, let’s look at at example using the bottom-up approach. For amazon.co.uk, we can do the following DNS queries for SRV records.

To retrieve the whois servers, we can use dig to do DNS SRV lookups.

For the bottom-up approach, if the answer is not positive we strip the leftmost element from the name and the query process is repeated; so it walks the DNS tree upwards. This process is repeated until a SRV record is found or the TLD is reached. So for the above example, we can actually stop at the second (_nicname._tcp.co.uk) DNS query since it returns a valid SRV record with the whois server.

This method does not always work, well, at least it is not working for .sg domains.