Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In short: is there any way to get the full whois-details for domains like, using the command line on Max OS X?

Running whois on the command line for, for example, is like searching for all domains that include that phrase. So, thanks to whois-spam, this gets one the following on a Mac or on FreeBSD:

$ whois

Whois Server Version 2.0

To single out one record, look it up with "xxx", where xxx is one of the
of the records displayed above. If the records are the same, look them up
with "=xxx" to receive a full display for each record.

To get some extra info for all these domains, I can run the command for, like:

$ whois

Whois Server Version 2.0
   IP Address:
   Registrar: TUCOWS INC.
   Whois Server:
   Referral URL:
   Domain Name: APPLE.COM
   Registrar: MARKMONITOR INC.
   Whois Server:
   Referral URL:
   Updated Date: 21-jan-2009
   Creation Date: 19-feb-1987
   Expiration Date: 20-feb-2011

Still, this does not give me the full record, like the one including the contact information:

$ whois -h
    Administrative Contact:
        Apple Inc.
        Apple Inc.
        1 Infinite Loop
         Cupertino CA 95014

(On Redhat Linux, jwhois shows only but without the contact information; on Debian whois version 4.7.20 yields summaries of all domains like above, and additional detailed info for the exact matched domain, apparently by doing an additional query at for that exact match.)

I even tried to telnet directly, but cannot come up with anything I cannot do using the whois-command, so I guess that is useless:

$ telnet 43
Connected to
Escape character is '^]'.

So: is there any easier way to get the full details for such domain (for only the exact matched domain), using the command line?

(Thinking that command line whois would soon be banned in favour of captcha-enabled web interfaces, this never bothered me a lot. But still, I'm curious...)

share|improve this question
When I use my own, domain, e.g., 'whois', it returns what looks like a complete set of registration details. This got me thinking, "Interesting; what's so special about" – Danny Whitt Sep 8 '09 at 20:07
The query string "" also matches all the domains that have been registered for spam (just to show up when people run whois), and as there are multiple matches one won't get all details. (A command line whois will also show you how some feel about that company...) – Arjan Sep 8 '09 at 20:16
Welcome, all of you! Don't read just this question; browse this site, and the Stack Exchange family, to learn more... Enjoy! – Arjan Oct 4 '11 at 20:04

2 Answers 2

up vote 12 down vote accepted

The whois command looks for the string "Whois Server:" in the output and, if found, will issue the same query again to that server. This is what you want, except it only works for the first match. You can use a command like whois "domain" to get just one match from the default server, but markmonitor (used by does not accept that syntax. It would work if you could send "domain" to the default server, and then to the second server, like this:

function mywhois {
  whois -h `whois "domain $@" | sed '/^.*Whois Server:/!d;s///'` "$@"

However this is specific to these whois servers so will not necessarily work for domains on other whois servers. A robust implementation would probably need to have knowledge of specific query and output formats used by a variety of whois server implementations.

share|improve this answer
Aha, "domain"! Why didn't I think of getting the syntax for whois server queries, by querying the server for the syntax? Running whois ? shows some help, and running whois help even some more. (This help is from the default, and is very different from man whois. Other whois servers indeed may use a different syntax.) It seems that whois -h invokes "GeekTools Whois Proxy", which gives full details for all TLDs...? – Arjan Sep 8 '09 at 21:19

It seems that (at least in September 2009) the following uses GeekTools Whois Proxy, which is quite smart in figuring out which whois-server to use. This also works for other TLDs than com, net and org:

whois -h

Or, according to a very old hint at

whois -h

I found this by accident: wondering how @mark4o knew about the domain command for the answer above, I eventually found that running whois help gives me the output of some whois-server. As I did not specify any TLD, I then wondered which one replied. I tried telnet 43, so basically using the bare domain as mentioned in the manual pages:

-h host

     Use the specified host instead of the default variant.  Either a host
     name or an IP address may be specified.

     By default whois constructs the name of a whois server to use from the
     top-level domain (TLD) of the supplied (single) argument, and appending
     "".  This effectively allows a suitable whois server
     to be selected automatically for a large number of TLDs.

And here GeekTools Whois Proxy announced itself:

$ telnet 43
Connected to
Escape character is '^]'.
GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 82.95.xx.xx... ok.

Checking server []

Checking server []

(In fact, is currently, so is a different IP than

share|improve this answer doesn't seem to work anymore, however, does. – Hay Jul 31 at 10:42

protected by BinaryMisfit Oct 4 '11 at 19:34

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.