[dns-operations] Glue IP addresses in whois output in .com (and may be others)

Phil Pennock dnsop+phil at spodhuis.org
Tue Oct 10 00:52:52 UTC 2017

On 2017-10-09 at 17:22 +0200, Stephane Bortzmeyer wrote:
> OK, so the problem was with my whois client, it seems, it no longer
> queries the right place.

There was a recent change in output format from the main whois servers,
resulting in breaking a bunch of substring and regexp-based clients
trying to parse the results to find the next whois server to query.

So for instance, I patched my local FreeBSD system with a one-line
change in the #define for the substring which the code searches for, to
find the whois server and chase along to the "real" server.

"Whois Server: " vs "Registrar WHOIS Server: "

Reality is messy,

--- usr.bin/whois/whois.c.orig	2017-08-17 14:00:08.917506928 -0400
+++ usr.bin/whois/whois.c	2017-08-17 14:00:28.975792449 -0400
@@ -76,7 +76,7 @@
 #define GERMNICHOST	"de.whois-servers.net"
 #define FNICHOST	"whois.afrinic.net"
 #define	DEFAULT_PORT	"whois"
-#define	WHOIS_SERVER_ID	"Whois Server: "
+#define	WHOIS_SERVER_ID	"Registrar WHOIS Server: "
 #define	WHOIS_ORG_SERVER_ID	"Registrant Street1:Whois Server:"

 #define WHOIS_RECURSE		0x01

More information about the dns-operations mailing list