]> CNNIC

4 South 4th Street, Zhongguancun, Haidian District Beijing 100190 China +86 10 5881 2677 zhoulinlin@cnnic.cn

CNNIC

4 South 4th Street, Zhongguancun, Haidian District Beijing 100190 China +86 10 5881 3147 nkong@cnnic.cn

CNNIC

4 South 4th Street, Zhongguancun, Haidian District Beijing 100190 China +86 10 5881 3038 shenshuo@cnnic.cn

ICANN

12025 Waterfront Drive, Suite 300 Los Angeles CA 90094-2536 United States +1 310 301 5800 steve.sheng@icann.org

LACNIC

Rambla Mexico 6125 Montevideo 11400 Uruguay +598-2604-2222 arturo.servin@gmail.com

Internet whois, restful, weirds, response object, inventory WHOIS output objects from registries, including both Regional Internet Registries (RIRs) and Domain Name Registries (DNRs), were collected and analyzed. This document describes the process and results of the statistical analysis of existing WHOIS information. The purpose of this document is to build an object inventory to facilitate discussions of data objects included in Registration Data Access Protocol (RDAP) responses.

Regional Internet Registries (RIRs) and Domain Name Registries (DNRs) have historically maintained a lookup service to permit public access to some portion of the registry database. Most registries offer the service via the WHOIS protocol , with additional services being offered via World Wide Web pages, bulk downloads, and other services, such as Routing Policy Specification Language (RPSL) . Although the WHOIS protocol is widely adopted and supported, it has several shortcomings that limit its usefulness to the evolving needs of the Internet community. Specifically: It has no query and response format. It does not support user authentication or access control for differentiated access. It has not been internationalized and thus does not consistently support Internationalized Domain Names (IDNs) as described in . This document records an inventory of registry data objects to facilitate discussions of registration data objects. The Registration Data Access Protocol (RDAP) (, , , and ) was developed using this inventory as input. In the number space, there were altogether five RIRs. Although all RIRs provided information about IP addresses, Autonomous System Numbers (ASNs), and contacts, the data model used was different for each RIR. In the domain name space, there were over 200 country code Top-Level Domains (ccTLDs) and over 400 generic Top-Level Domains (gTLDs) when this document was published. Different Domain Name Registries may have different WHOIS response objects and formats. A common understanding of all these data formats was critical to construct a single data model for each object. This document describes the WHOIS data collection procedures and gives an inventory analysis of data objects based on the collected data from the five RIRs, 106 ccTLDs, and 18 gTLDs from DNRs. The RIR data objects are classified by the five RIRs into IP address, ASN, person or contact, and the organization that held the resource. According to SPECIFICATION 4 ("SPECIFICATION FOR REGISTRATION DATA PUBLICATION SERVICES") of the new gTLD applicant guidebook and the Extensible Provisioning Protocol (EPP) (, , , and ), the DNR data objects are classified by whether they relate to the domain, contact, nameserver, or registrar. Objects that do not belong to the categories above are viewed as privately specified objects. In this document, there is no intent to analyze all the query and response types that exist in RIRs and DNRs. The most common query objects are discussed, but other objects such as RPSL data structures used by Internet Routing Registries (IRRs) can be documented later if the community feels it is necessary.

Data element - The name of a specific response object. Label - The name given to a particular data element; it may vary between registries. Most popular label - The label that is most supported by the registries. Number of labels - The number of different labels. No. of TLDs - The number of registries that support a certain data element.

WHOIS information, including port 43 response and web response data, was collected between July 9, 2012, and July 20, 2012, following the procedures described below. First, find the RIR WHOIS servers of the five RIRs, which are AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. All the RIRs provide information about IP addresses, ASNs, and contacts. Query the corresponding IP addresses, ASNs, contacts, and organizations registered in the five RIRs. Then, make a comparative analysis of the response data. Group together the data elements that have the same meaning but use different labels. DNR object collection process: A programming script was applied to collect port 43 response data from 294 ccTLDs. "nic.ccTLD" was used as the query string, which is usually registered in a domain registry. Responses for 106 ccTLDs were received. 18 gTLDs' port 43 response data was collected from their contracts with ICANN. Thus, the sample size of port 43 WHOIS response data is 124 registries in total. WHOIS data from the web was collected manually from the 124 registries that send port 43 WHOIS responses. Some of the response that which were collected by the program did not seem to be correct, so data for the top 10 ccTLD registries, like .de, .eu, and .uk, was re-verified by querying domain names other than "nic.ccTLD". In accordance with SPECIFICATION 4 of the new gTLD applicant guidebook and EPP (, , and ), the response data objects are classified into public and other data objects. Public data objects are those that are defined in the above references. Other objects are those that are privately specified data elements or objects in different registries. Data elements with the same meaning, but using different labels, were grouped together. The number of registries that support each data element is shown in the "No. of TLDs" column.

Table 1 shows the organization objects of the five RIRs.

Table 2 shows the contact objects of the five RIRs.

Table 4 shows the IP address objects of the five RIRs. Note: Due to the 72-character limit on line length, strings in some cells of the table are split into two or more parts, which are placed on separate lines within the same cell. A hyphen in the final position of a string indicates that the string has been split due to the length limit.

For instance, the original strings in the cells of Table 3 are "Administrative contact", "admin-c", and "abuse-mailbox", respectively.

As can be observed, some data elements were not supported by all RIRs, and some were given different labels by different RIRs. Also, there were identical labels used for different data elements by different RIRs. In order to construct a single data model for each object, a selection of the most common and useful fields was made. That initial selection was the starting point for .

WHOIS data was collected from 124 registries, including 106 ccTLDs and 18 gTLDs. All 124 registries support domain queries. Among 124 registries, eight ccTLDs and 15 gTLDs support queries for specific contact persons or roles. 10 ccTLDs and 18 gTLDs support queries by nameserver. Four ccTLDs and 18 gTLDs support registrar queries. Domain WHOIS data contain 68 data elements that use a total of 550 labels. There is a total of 392 other objects for domain WHOIS data.

As mentioned above, public objects are those data elements selected according to the new gTLD applicant guidebook and EPP. They are generally classified into four categories by whether they are related to the domain, contact, nameserver, or registrar.

WHOIS replies about domains include "Domain Name", "Creation Date", "Domain Status", "Expiration Date", "Updated Date", "Domain ID", "DNSSEC", and "Last Transferred Date". Table 6 gives the element name, most popular label, and the corresponding numbers of TLDs and labels.

Several statistical conclusions obtained from above data are: 95.16% of the 124 registries support a "Domain Name" data element. 85.48% of the 124 registries support a "Creation Date" data element. 76.61% of the 124 registries support a "Domain Status" data element. On the other hand, some elements such as "DNSSEC" and "Last Transferred Date" are only supported by 11.29% and 3.23% of the registries, respectively.

In the domain name space, contacts are typically divided into registrant, administrative contact, technical contact, and billing contact.

Table 7 shows all the contact information for a registrant. 14 data elements are listed below.

Among all the data elements, only "Registrant Name" is supported by more than one half of registries. Those supported by more than one third of registries are: "Registrant Name", "Registrant Email", "Registrant ID", "Registrant Phone", "Registrant Fax", "Registrant Organization", and "Registrant Country Code".

Table 8 shows all the contact information for an administrative contact. 14 data elements are listed below.

Among all the data elements, only "Admin Street" is supported by more than one half of registries. Those supported by more than one third of registries are: "Admin Street", "Admin Name", "Admin Email", "Admin ID", "Admin Fax", "Admin Phone", "Admin Organization", and "Admin Country Code".

Table 9 shows all the information for a domain name technical contact. 14 data elements are listed below.

Among all the data elements, there are no elements supported by more than one half of registries. Those supported by more than one third of registries are: "Tech Email", "Tech ID", "Tech Name", "Tech Fax", "Tech Phone", and "Tech Country Code".

Table 10 shows all the information for a domain name billing contact. 14 data elements are listed below.

Among all the data elements, there are no elements supported by more than one half of registries. Those supported by more than one third of registries are "Billing Name", "Billing Fax", and "Billing Email".

114 registries (about 92% of the 124 registries) have the "nameserver" data element in their WHOIS responses. However, there are 63 different labels for this element, as shown in Table 11. The top three labels for this element are "Name Server" (which is supported by 25% of the registries), "Name Servers" (which is supported by 16% of the registries), and "nserver" (which is supported by 12% of the registries). Data Element Most Popular Label No. of TLDs No. of Labels NameServer Name Server 114 63 Some registries have nameserver elements such like "nameserver 1", "nameserver 2" till "nameserver n". Thus, there are more labels than of other data elements.

There are three data elements about registrar information.

67.7% of the registries have the "Sponsoring Registrar" data element. The elements "Created by Registrar" and "Updated by Registrar" are supported by 11.3% and 8.9% of the registries, respectively.

So-called "other objects" are those data elements that are privately specified or are difficult to be classified. There are 392 other objects altogether. Table 13 lists the top 50 other objects found during data collection.

Some registries returned things that looked like labels, but were not. For example, in this reply:

"Name" and "Email" appeared to be data elements, but "Registrant" did not. The inventory work proceeded on that assumption, i.e., there were two data elements to be recorded in this example. Some other data elements, like "Remarks", "anniversary", and "Customer service Contact", are designed particularly for their own purpose by different registries.

Some preliminary conclusions could be drawn from the raw data. All of the 124 domain registries have the object names in their responses, although they are in various formats. Of the 118 WHOIS services contacted, 65 registries show their registrant contact. About half of the registries (60 registries) support admin contact information. There are 47 registries, which is about one third of the total number, that have technical and billing contact information. Only seven of the 124 registries give their abuse email in a "remarks" section. No explicit abuse contact information is provided. There are mainly two presentation formats. One is key-value; the other is data block format. Example of key-value format:

Example of data block format:

11 registries give local script responses. The WHOIS information of other registries are all represented in English.

The top 10 data elements are listed in Table 14.

Most of the domain-related WHOIS information is included in the top 10 data elements. Other information like name server and registrar name is also supported by most registries. A cumulative distribution analysis of all the data elements was done. About 5% of the data elements discovered by the inventory work are supported by 111 registries (i.e., 90%). About 30% of the data elements discovered by the inventory work are supported by 44 registries (i.e., 35%). About 60% of the data elements discovered by the inventory work are supported by 32 registries (i.e., 26%). About 90% of the data elements discovered by the inventory work are supported by 14 registries (i.e., 11%). From the above result, it is clear that only a few registries support all the public objects, most of the registries support just some of the objects.

The top 10 labels of different data elements are listed in Table 15.

As explained above, the "Name Server" label is a unique example because many registries define the name server elements from "nameserver 1" through "nameserver n". Thus, the count of labels for name servers is much higher than other elements. Data elements representing dates and street addresses were also common. A cumulative distribution analysis of label numbers was done. About 90% of data elements have more than two labels. It is therefore necessary to specify a standard and unified format for object names in a WHOIS response.

The results indicate that there are 392 other data objects in total that are not easy to be classified or are privately defined by various registries. The top 50 other objects are listed in Table 13 in . It is clear that various different objects are designed for some particular purpose. In order to ensure uniqueness of JSON names used in the RDAP service, establishment of an IANA registry is advised.

This section lists the limitations of the survey and some assumptions that were made in the execution of this work. The input "nic.ccTLD" may not be a good choice, for the term "nic" is often specially used by the corresponding ccTLD, so the collected WHOIS data may be customized and different from the common data. Since the programming script queried the "nic.ccTLD" in an anonymous way, only the public WHOIS data from WHOIS servers having nic.ccTLD were collected. So, the private WHOIS data were not covered by this document. 11 registries did not provide responses in English. The classification of data elements within their responses may not be accurate. The extension data elements are used randomly by different registries. It is difficult to do statistical analysis. Sample sizes of contact, name server, and registrar queries are small. Only WHOIS queries for contact ID, nameserver, and registrar were used. Some registries may not support contact, name server, or registrar queries. Some may not support query contact by ID. Contact information of some registries may be protected.

There are some objects that are included in the existing WHOIS system but not mentioned in . This document is intended to give a list of reference extension objects for discussion.

company - the company name registered by the registrant. maintainer - authentication information that identifies who can modify the contents of this object. list of resources - a list of IPv4 addresses, IPv6 addresses, and Autonomous System numbers. referral NOC contact - the Network Operations Center contact.

The following objects are selected from the top 50 other objects in that are supported by more than five registries. These objects are considered as possible extension objects. zone-c - The identifier of a 'role' object with authority over a zone. maintainer - authentication information that identifies who can modify the contents of this object. Registration URL - typically the website address of a registry. anonymous - whether the registration information is anonymous or not. hold - whether the domain is "on hold" or not. nsl-id - nameserver list ID. obsoleted - whether a domain is obsoleted or not. Customer Service Contact - a kind of contact.

This document does not provide any security services or introduce additional considerations to those discussed in .

&RFC2622; &RFC3912; &RFC5730; &RFC5731; &RFC5732; &RFC5733; &RFC5890; This document describes JSON data structures representing registration information maintained by Regional Internet Registries (RIRs) and Domain Name Registries (DNRs). These data structures are used to form Registration Data Access Protocol (RDAP) query responses. This document describes uniform patterns to construct HTTP URLs that may be used to retrieve registration information from registries (including both Regional Internet Registries (RIRs) and Domain Name Registries (DNRs)) using "RESTful" web access patterns. These uniform patterns define the query syntax for the Registration Data Access Protocol (RDAP). This document is one of a collection that together describes the Registration Data Access Protocol (RDAP). It describes how RDAP is transported using the Hypertext Transfer Protocol (HTTP). RDAP is a successor protocol to the very old WHOIS protocol. The purpose of this document is to clarify the use of standard HTTP mechanisms for this application. This document specifies a method to find which Registration Data Access Protocol (RDAP) server is authoritative to answer queries for a requested scope, such as domain names, IP addresses or Autonomous System numbers. ICANN

This document is the work product of the IETF's WEIRDS working group, of which Olaf Kolkman and Murray Kucherawy were chairs. The authors especially thank the following individuals who gave their suggestions and contributions to this document: Guangqing Deng, Frederico A C Neves, Ray Bellis, Edward Shryane, Kaveh Ranjbar, Murray Kucherawy, Edward Lewis, Pete Resnick, Juergen Schoenwaelder, Ben Campbell, and Claudio Allocchio.