How to follow a WHOIS referral server

A referral in WHOIS output is the handoff from a broad registry answer to the server that can answer for the specific domain, IP address, or AS number. Following it manually matters when the first response only proves the allocation boundary and a ticket, allowlist, or abuse review needs the resource record itself.

IANA commonly exposes referrals with refer or whois fields, and registry records can expose registrar or downstream WHOIS servers in their own output. Query the named server with the same object, then compare the final record to the first response before treating it as evidence.

The commands below use an ASN because the IANA-to-ARIN handoff fits in a short transcript. The same pattern works for domains and IP addresses, but only follow a server named by the record that matched your object; a guessed server can return a valid-looking record for the wrong scope.

Related: How to check IANA WHOIS records
Related: How to select a whois server
Related: How to query a domain with whois

Steps to follow a WHOIS referral server:

  1. Query IANA or the first known registry server for the object. 
    $ whois -h whois.iana.org -p 43 AS15169
% IANA WHOIS server
% This query returned 1 object

refer:        whois.arin.net

as-block:     13312-15359
organisation: Assigned by ARIN
whois:        whois.arin.net
source:       IANA

    Some WHOIS clients document automatic referral modes, but support differs by platform. Use an explicit -h query when the server path must be visible in saved evidence.

    Related: How to check IANA WHOIS records
    Related: How to query an ASN with whois

  2. Confirm that the referral belongs to the queried object. 
    refer:        whois.arin.net
as-block:     13312-15359
source:       IANA

    The IANA record proves that AS15169 sits inside a block assigned to ARIN. It is not the final ASN registration record.

  3. Query the referred WHOIS server with the same object. 
    $ whois -h whois.arin.net AS15169
ASNumber:       15169
ASName:         GOOGLE
ASHandle:       AS15169
RegDate:        2000-03-30
Updated:        2012-02-24
Ref:            https://rdap.arin.net/registry/autnum/15169

OrgName:        Google LLC
OrgId:          GOGL
##### snipped #####
  4. Compare the first and final records before using the result. 
    IANA refer:  whois.arin.net
IANA block:  13312-15359
ARIN object: AS15169
ARIN org:    Google LLC

    The success state is a final record that adds object, organization, registrar, allocation, status, or reference fields that were not present in the referral response.

  5. Follow another referral only when the current record clearly names one for the same object.

    Domain records may point from a registry server to a registrar WHOIS server. IP and ASN records may point to RDAP references or downstream reassignment data. Stop when the next server or URL no longer contains the queried domain, address, range, or AS number.

    Related: How to query RDAP for a domain
    Related: How to query an IP address with whois

  6. Save the referral response and final record separately when the source path matters. 
    $ whois -h whois.iana.org -p 43 AS15169 > AS15169.iana.whois
$ whois -h whois.arin.net AS15169 > AS15169.arin.whois

    Keep the files separate so a reviewer can see both the referral source and the server that supplied the detailed record.

    Related: How to save raw whois output