Authoritative WHOIS & Domain Intelligence
Query root TLD registry databases via raw TCP Port 43 sockets and modern ICANN RDAP protocols. Inspect domain lifespan, expiration countdowns, registrar accreditation, authoritative DNS delegation, and EPP security locks in real time.
The Architecture of WHOIS, DNS & Domain Lifecycle Operations
A technical masterclass for systems administrators, network engineers, cybersecurity analysts, and domain portfolio investors on how top-level domains, root registries, registrars, and the DNS hierarchy function across the modern internet.
The 7 Phases of the ICANN Domain Name Lifecycle
From initial availability to expiration, redemption, and drop-catching, every top-level domain (gTLD and ccTLD) operates under strict protocol timers governed by the Internet Corporation for Assigned Names and Numbers (ICANN).
Available to Register
The domain has zero active registry records. Available for public registration on a first-come, first-served basis through accredited registrars.
Active Registration (1–10 Yrs)
Domain is actively delegated to authoritative nameservers with standard security locks (clientTransferProhibited). DNS records resolve globally.
Auto-Renew Grace Period (0–45 Days)
Domain passes its expiration date. Authoritative DNS resolution is paused or parked. Original registrant may renew at standard registrar renewal pricing.
Redemption Grace Period (30 Days)
Registrar cancels sponsorship. Domain enters registry RGP status. Original owner can restore domain but must pay an ICANN redemption surcharge ($80–$250).
Pending Delete Queue (5 Days)
Domain cannot be renewed or recovered by anyone. It sits in registry purge queue for 5 calendar days before dropping.
The Drop & Backordering
Automated drop-catching engines (SnapNames, DropCatch, NameJet) compete to register high-value expired domains the microsecond they are released.
Public Release
Unclaimed domains return to the public registry pool, available for standard registration by any internet user worldwide.
Registrar Transfer Process
Requires disabling clientTransferProhibited, obtaining an EPP Auth-Info Code, and completing 5-day ICANN inter-registrar transfer.
WHOIS Protocol (RFC 3912) vs. Registration Data Access Protocol (RDAP)
Designed in 1985 (RFC 954) and revised in 2004 (RFC 3912), traditional WHOIS relies on bare TCP sockets over port 43. ICANN mandated RDAP (RFC 7480 through RFC 7484) as the modern, secure RESTful JSON alternative.
| Technical Feature | Legacy WHOIS (RFC 3912) | Modern ICANN RDAP (RFC 7480-7484) | Architectural Advantage |
|---|---|---|---|
| Transport Layer | Raw TCP Port 43 Socket | HTTPS (Port 443 / TLS 1.3) | Firewall friendly, zero corporate network port blocks |
| Payload Serialization | Unstructured Free-Text (Unstandardized) | Structured JSON (jCard / RFC 7483) | Machine-readable with zero regex parsing failures |
| Access Control & Auth | Anonymous unauthenticated stream | OAuth 2.0 Role-Based Access | Tiered access for law enforcement & trademark auditors |
| Internationalization | ASCII only (Punycode xn-- format) | Native UTF-8 Internationalized Domains | Seamless support for Arabic, Chinese, Cyrillic IDNs |
| Error Handling | Text string ("No match for...") | Standard HTTP 404, 429, 503 Codes | Deterministic programmatic error detection |
| Rate Limiting | Arbitrary IP socket disconnects | Standard HTTP 429 Retry-After Headers | Predictable backoff algorithms for enterprise monitoring |
Thin WHOIS Registries
In a Thin Registry model (notably VeriSign for .com and .net), the central registry holds minimal technical metadata: the domain name, registrar IANA ID, registration creation/expiration dates, and authoritative nameserver delegations.
- Registry database contains zero registrant contact data.
- Requires a secondary query to the sponsoring registrar's WHOIS server.
- Reduces centralized database liability and privacy exposure.
- Governed by VeriSign Global Registry Services.
Thick WHOIS Registries
In a Thick Registry model (such as Public Interest Registry for .org, Afilias for .info, and most modern new gTLDs), the central registry maintains the complete administrative, technical, billing, and registrant dataset.
- One authoritative query provides the complete operational record.
- Uniform data format across all participating registrars.
- Enhanced disaster recovery and registrar failover resiliency.
- Direct enforcement of ICANN privacy redaction policies.
Comprehensive ICANN EPP Status Codes Reference
Extensible Provisioning Protocol (EPP) status codes (also termed domain lock states) inform sysadmins whether a domain is locked, delegating traffic, pending transfer, or queued for deletion.
Client lock preventing unauthorized domain transfers between registrars. The gold standard for preventing domain hijacking.
Prevents accidental or unauthorized deletion of the domain from the registry database.
Disallows changes to authoritative nameservers, contact details, or authorization passphrases.
Stops manual out-of-band renewal requests to avoid duplicate billing charges on automated systems.
The registrar suspended DNS resolution. The domain will not resolve to IP addresses in the global DNS.
Direct registry suspension due to legal dispute, abuse complaint, non-payment, or ICANN sanction.
Registry-level transfer restriction. Cannot be overridden by registrar APIs without registry intervention.
Grace period (0-45 days) immediately following domain expiration. Renewal remains available to owner.
30-day registry hold. The domain can be redeemed only by the original registrant upon paying penalty fees.
DNSSEC: Securing the Root Delegation Chain of Trust
Domain Name System Security Extensions (DNSSEC) adds cryptographic digital signatures to DNS records using public key cryptography. By publishing a Delegation Signer (DS) record at the parent TLD registry, resolvers verify that incoming DNS responses have not been intercepted, forged, or poisoned via man-in-the-middle (MitM) cache attacks.
Hash of public Key Signing Key stored in root registry zone.
Zone-signing and key-signing public keys held in authoritative zone.
Digital signatures validating each A, AAAA, MX, and TXT record set.
Tech100 WHOIS parses the authoritative DNSSEC: attribute to verify whether DS delegation is signed at root level or unsigned.
Authoritative Root Registry Servers & Ports
Tech100 connects directly to official top-level domain registries across North America, Europe, and Asia over TCP Port 43.
| Top-Level Domain (TLD) | Registry Operator | Authoritative WHOIS Server | Model | Port |
|---|---|---|---|---|
| .com, .net, .edu | VeriSign Global Registry | whois.verisign-grs.com | Thin | TCP 43 |
| .org | Public Interest Registry (PIR) | whois.pir.org | Thick | TCP 43 |
| .top | Jiangsu Bangning Tech | whois.nic.top | Thick | TCP 43 |
| .io | Identity Digital / NIC.IO | whois.nic.io | Thick | TCP 43 |
| .ai | Offshore Information Services (Anguilla) | whois.nic.ai | Thick | TCP 43 |
| .uk, .co.uk | Nominet UK | whois.nominet.uk | Thick | TCP 43 |
| .de | DENIC eG (Germany) | whois.denic.de | Thick | TCP 43 |
Frequently Asked Questions: WHOIS, DNS & Domain Management
Answers to common architectural and administrative questions regarding WHOIS lookups, registrar transfers, DNS propagation, and privacy protections.
To initiate an inter-registrar transfer under ICANN policy, follow these steps:
- Unlock the domain: Log in to your current registrar and disable the Transfer Lock (
clientTransferProhibited). - Generate Auth-Info Code: Request your EPP Authorization Code (transfer secret) from the registrar dashboard.
- Verify contact email: Ensure the administrative contact email is reachable to approve the Transfer Authorization email.
- Submit transfer request: Purchase the transfer at your new registrar (this extends your domain registration by +1 year).
- Authorize transfer: ICANN permits 5 calendar days for the losing registrar to release the domain, after which transfer completes automatically.