May 11, 2022 - Reading time: ~1 minute
WHOIS is a simple, plaintext-based protocol that is used to retrieve information about a given domain. WHOIS servers listen on the TCP port 43. The protocol is defined by RFC 3912, but that RFC doesn’t give useful information regarding how WHOIS works for getting information about domains.
The response from WHOIS servers is made to be human-readable rather than machine-readable but the fields you need to extract information from usually follow a Header name: Header data format. It is a good idea to turn all header names to lowercase when you are searching for a specific one.
WHOIS requests need to be terminated with a carriage return + line feed (\r\n).