Whois Command on Linux: 5 Easy Examples, Avoid Mistakes

The whois command asks a public WHOIS server for the registration data of a domain name, an IP address block or an autonomous system. The old version of this post showed the install commands and four example queries without any output. This rewrite runs whois 5.6.3 from the Debian 13 package, with real queries to the public servers, and covers a failure that many minimal systems and containers hit on the very first call.

Scope: the queries went out from a container on 2026-11-01, so dates and servers in the output belong to that day. Registrant details are not shown, because most domains now hide them. The dnf install line of the old post was not tested.

Install the whois command and fix the first error

On Debian and Ubuntu the package is whois (apt-get install whois; it installed version 5.6.3 and also gave mkpasswd). On a minimal container image the first query failed at once: getaddrinfo(whois.verisign-grs.com): Servname not supported for ai_socktype. The program looks up the service name nicname, and the file /etc/services did not exist in the image. Installing the package netbase created the file, which contains the line whois 43/tcp nicname, and the same query worked. On a normal server the file is already there, so you will see this error mostly in containers.

Whois command syntax for a domain

whois example.com
whois huuphan.com

The answer for example.com came from the registry of the .com zone and listed Domain Name: EXAMPLE.COM, Creation Date: 1995-08-14T04:00:00Z, Registry Expiry Date: 2027-08-13T04:00:00Z, the registrar and several lines of Domain Status and Name Server. For huuphan.com the registry data gave creation date 2016-11-11, expiry 2027-11-11, registrar NameCheap, Inc., status clientTransferProhibited, and the two Cloudflare name servers. The output has two parts: the registry (Verisign for .com) first, then the record of the registrar, which starts with Domain name: huuphan.com. The program follows the referral from the registry to the registrar by itself. Option --no-recursion turns that off and --verbose explains what happens.

Whois command for an IP address and an ASN

The IP address of the old post, whois 172.67.137.70, was answered by the ARIN database: NetRange: 172.64.0.0 - 172.71.255.255, CIDR: 172.64.0.0/13, NetName: CLOUDFLARENET, OrgName: Cloudflare, Inc. and Country: US. This tells you who owns the network, not who runs the site behind it. An autonomous system works the same way: whois AS13335 returned ASName: CLOUDFLARENET. When you look up an address that you found in a mail log, compare the result with the reverse DNS checks in the reverse DNS lookup post.

Useful whois command options

• -H hides the legal disclaimers: the output of whois example.com shrank from 67 lines to 41.
• -h HOST chooses the server, for example whois -h whois.verisign-grs.com "domain example.com", which returned the registry record directly.
• -I asks whois.iana.org and follows its referral; -p PORT sets another port.
• The RIPE-style flags (-r, -B, -x and others, listed by whois --help) only work on servers that support them.

Errors and different formats

A name that is not registered is reported by the registry: No match for domain "THIS-DOMAIN-DOES-NOT-EXIST-HUUPHAN-LAB-123.COM". A string that is not a domain or an address gives No whois server is known for this kind of object. Other registries use their own layout. For bbc.co.uk the answer came from the UK registry and the fields are on separate lines: Domain name: then the name on the next line, Registered on: before Aug-1996, Expiry date: 13-Dec-2034. A script that parses whois output with grep "Registry Expiry Date" will therefore work for .com and fail for .uk. Whois is defined in RFC 3912 as a plain text protocol on port 43 with no fixed record format.

Use the whois command in a script: days until a domain expires

A small script shows both the use and the format problem. It asks for the expiry line, prints the date and counts the days left:

#!/bin/sh
d=$(whois -H "$1" | awk -F': ' '/Registry Expiry Date/ {print $2; exit}')
[ -n "$d" ] || { echo "no Registry Expiry Date for $1" >&2; exit 1; }
echo "$1 expires $d, days left: $(( ( $(date -d "$d" +%s) - $(date +%s) ) / 86400 ))"

For huuphan.com it printed huuphan.com expires 2027-11-11T03:11:19Z, days left: 374 and exit code 0. For bbc.co.uk it printed no Registry Expiry Date for bbc.co.uk and exit code 1, because the UK registry calls the field Expiry date: (value 13-Dec-2034), with another name and date format. The script fails loudly instead of printing a wrong number, which is the behaviour you want from a whois command check in cron. Add one pattern per registry that you care about, and test each of them once.

A short checklist for the whois command

1. Check that /etc/services exists if you run whois in a container.
2. Start with a plain query, then add -H to cut the disclaimers once you know the layout.
3. For an address or an AS number, read the network name and the organisation, and remember that they describe the owner of the block.
4. For a domain, compare the registry part with the registrar part: dates and name servers should agree.
5. In scripts, test the exit code and an empty result, and write one parser per registry.

These five points cover every problem found while testing the whois command above, and they take a minute to apply.

Common mistakes with the whois command

• Expecting personal data: the registrant lines of huuphan.com are privacy-protected.
• Parsing the text with one pattern for every registry.
• Running many queries in a loop; public servers can limit you, but the limits were not tested here.

FAQ

How do I install the whois command on CentOS or RHEL? The old post used sudo dnf install whois; this was not tested here.

Does the whois command need root? No. All queries above ran as a normal user inside the container, and the only requirement is outgoing access to port 43.