whois — Look up domain registration / WHOIS records across all 5 shells
Equivalents in every shell
whois example.comExternal client (often `jwhois` or the Debian `whois` package). Speaks the WHOIS protocol (port 43) and follows referrals — queries `whois.iana.org` first to find the authoritative server, then re-queries. RDAP is the modern JSON replacement: `curl -s https://rdap.org/domain/example.com`.
whois example.comSame external. macOS ships `whois` in the base system. Output format VARIES per registry — `.com` returns a flat key:value text block, `.de` is similar, `.cn` is in Chinese plus English, `.io` is minimal. Scripts parsing whois output must tolerate every variant; RDAP gives consistent JSON.
whois example.comSame external. Fish ships no special completion for `whois`. For programmatic use prefer RDAP via `curl -s https://rdap.org/domain/$arg | jq .` — JSON is dramatically easier to consume from fish than whois free-text output.
Invoke-RestMethod https://rdap.org/domain/example.comPowerShell has NO built-in `whois`. The modern path is RDAP: `Invoke-RestMethod` against `rdap.org` returns parsed JSON objects with `entities`, `nameservers`, `status`, etc. For raw WHOIS, install Sysinternals `whois.exe` (`choco install sysinternals`) and call it directly.
whois.exe example.comNOT a built-in. Sysinternals provides `whois.exe` (download via `choco install sysinternals` or `winget install Microsoft.Sysinternals.Whois`). The first run prompts to accept the EULA. Modern alternative: `curl.exe -s https://rdap.org/domain/example.com` (curl ships natively since Windows 10 1803).
Worked examples
Look up registration info for a domain
whois example.comwhois example.comwhois example.comInvoke-RestMethod https://rdap.org/domain/example.comwhois.exe example.com # SysinternalsFind the registrar and creation date
whois example.com | grep -iE 'registrar|creation date'whois example.com | grep -iE 'registrar|creation date'whois example.com | string match -ir "registrar|creation date"(Invoke-RestMethod https://rdap.org/domain/example.com).entities | Where-Object roles -contains "registrar"Look up an IP address WHOIS (allocation info)
whois 8.8.8.8whois 8.8.8.8whois 8.8.8.8Invoke-RestMethod https://rdap.org/ip/8.8.8.8Gotchas
- WHOIS output FORMAT is registry-specific — `.com` / `.net` (Verisign) returns one layout, `.uk` / `.de` / `.cn` return others, and gTLDs after 2013 frequently REDACT the registrant for GDPR. Scripts parsing whois text must be defensive; RDAP (HTTP + JSON) is the structured, GDPR-aware replacement and should be the default for new work.
- Many registries RATE-LIMIT — abusive querying triggers `Too many requests, slow down` or a temporary IP block. Cache results (a domain's data changes maybe twice a year) and back off on errors. Python's `python3 -m whois` honours rate limits automatically; the raw `whois` client does not.
- Windows has NO built-in `whois`. Sysinternals `whois.exe` is the recommended download but requires accepting an interactive EULA on first run — `whois.exe /accepteula example.com` skips the prompt for automation. Without `/accepteula`, scripted invocations BLOCK waiting for input.
- RDAP returns DIFFERENT field names than legacy WHOIS. `creationDate` becomes the `events[?eventAction=='registration'].eventDate` JSONPath, `registrant` becomes `entities[?roles[?@=='registrant']]`. Most fields are nested — use `jq` (bash / fish) or `Select-Object` paths (pwsh) rather than ad-hoc grep.
- macOS `whois` queries `whois.internic.net` by default for `.com` / `.net` — recent macOS versions may not chase referrals to the registrar. Pass `-h whois.markmonitor.com example.com` (or another known registrar host) for full details. Linux `whois` (Debian / `jwhois`) follows referrals automatically.