Hacker News Reader

Comment by billpg | Hacker News Reader

Why do domains have WHOIS records anyway? I get why IP blocks have it because machines actually do things from behind IP addresses, but the only thing I'm doing from a domain name is stopping other people from using it.

Someone is hosting copyrighted content? Look up that machine's IP-WHOIS.

Someone is trying to DDOS me? Look up that machine's IP-WHOIS.

Someone is holding a domain I want? If their answer is going to be anything other than a straight "no", they'll happily provide a way to be contacted.

Please tell me how I'm wrong.

View on HN

A single IP can host many domains, each of which may have separate technical and administrative contacts. Conversely, different subdomains (and MX for email) can live on different IPs. If I use dyndns, there isn’t any fixed relation between IP and domain at all. I happen to own several domains, but I don’t own the IPs where they are hosted.

But why would I, a complete stranger to you, need to look up that contact information? We both hold a number of domains, but that alone isn't a reason for needing to contact each other.

For example if I published something on my web page you have privacy or copyright claims to. Or if my mail server errors out in the middle of trying to send email to your mail server. Or if the domain name is violating someone else's rights. Or if some public service or functionality is broken on the domain and you want to inform those who are in charge of the domain. Tnere are any number of reasons why you'd want to contact a domain registrant or the relevant technical or administrative contact.

It probably made more sense in the pre-web Internet, when not all domains were necessarily serving web traffic. Or had any obvious or standardized way of serving a "contact us" page.

The DNS SOA record has an RNAME field that is available to convey this information.

See also the RP (Responsible Person) record; RFC 1183: https://www.rfc-editor.org/rfc/rfc1183.html

These days they are somewhat useless as every domain name provider redacts everything about the owner.

IPs are shared by many machines these days, in particular CGNAT bundles many machines in potentially very disperse locations together. You can't identify the source of DDOS by whois in that case.

You can, it's just the answer will be "Someone using (ISP)". Even then, that ISP will be the one to contact.

Reply on news.ycombinator.com