nanog mailing list archives Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services)

---

From: Lavender-Jamie via NANOG <nanog () lists nanog org>
Date: Sun, 16 Aug 2026 00:59:31 +0100

---

On 2026-08-14 16:20, John Curran via NANOG wrote:

NANOGers -

ARIN is undertaking a community consultation on the Future of ARIN’s
Directory Services.  If you are interested in this topic, please see
details below, including how to join the ARIN-consult mailing list.

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Begin forwarded message:

From: ARIN <info () arin net>

Subject: [ARIN-consult] Consultation on the Future of ARIN’s Directory Services

Date: August 14, 2026 at 11:16:12 AM EDT
To: <arin-consult () arin net>

ARIN is seeking feedback from the community on a proposed road map to
streamline and consolidate its directory services.

ARIN currently maintains four directory information protocols:
Whois-RWS, RWhois, Whois (Port 43), and RDAP. Supporting multiple
redundant services that provide the same information creates
additional administrative and operational overhead to the
organization. To reduce ARIN’s attack surface, streamline operations
and lower future operational overhead, ARIN proposes retiring use of
older protocols in favor of RDAP as our single, standardized directory
service.

What excessive attack surface is there to operating whois? Yes, it is an additional service, but whois, in some form, has been around since forever and I am most certain that after so many years, there are well hardened whois servers available.

This transition is an important step toward improving alignment with
established IETF standards.

Which rfc calls for the decommissioning of whois? If there is one, I have not heard about it yet.

We have already seen this transition in the domain industry with ICANN
mandating the use of RDAP for directory services and dropping the
requirement to support Whois. We also expect RDAP clients to become
increasingly common in OS distributions in the coming years.

The reason why we have redundant services that provides the same information is for backwards compatibility. "[T]o become increasingly common in OS distributions in the coming years" does not inspire confidence. Right now, a whois client comes packaged and installed in every major distro. On a fresh install of fedora 44, I can run ``whois 1.2.3.4`` and it would just work, contra rdap, which requires an additional package (perl-rdapper) to be installed. Going back a bit, Fedora 42 has no packaged rdap client, unless you trust copr or snap. Fedora 42 only came to EOL this year.

These types of breaking changes must not be made until rdap obtains the same level of support that whois does.

------
Benefits of Transition to RDAP 

- Enhanced Directory Services: Future enhancements, such as
geolocation, will only be implemented in RDAP. 
- Standardization and Automation: RDAP’s standardized data structure
will improve automation for clients and provide greater flexibility in
managing future data changes. 

Great! That's amazing! However, maintaining rdap and whois simultaneously are not mutually exclusive.

- Reduced Technical Overhead: Removing old and redundant services will
provide time and cost savings for ARIN. 

What are the expected time and cost savings, and how do they stack up against the time and cost of everyone who currently uses whois to transition to rdap within the timeframe proposed?

------
Timeline and Retirement Planning

This consultation seeks community input for the proposed retirement
timelines below. We are keenly interested in receiving specific input
on any barriers and/or obstacles these changes may create for
customers, as well as steps ARIN can take to ensure a smooth
transition. Note that the retirement plans for each impacted directory
service will be completed independently, though in some cases work may
be conducted concurrently.

***
Whois-RWS Retirement Plan and Timeline

ARIN currently offers Whois-RWS in two formats: an API and a web
interface (located at https://whois.arin.net/ui/). Because the API has
the same functionality between Whois-RWS and RDAP, ARIN proposes
sunsetting the Whois-RWS API following a 180-day customer outreach
program. This will include updating the Whois-RWS payloads to include
a notification to users, as well as a robust communication
strategy that includes announcements, social promotion, and other
outreach.

The Whois-RWS web interface will remain available until work is
completed to ensure parity, providing equivalent query capabilities to
RDAP. The changeover from Whois-RWS to RDAP will be transparent to end
users visiting that URL. ARIN will inform the community a minimum of
30 days before the retirement of the Whois-RWS web interface, noting
the switch to RDAP will not change the end user experience.

***
RWhois Retirement Plan and Timeline

When RWhois server use is retired, we will provide organizations with
a recommendation for an open-source RDAP server implementation. To
help ease the transition and migration of data, ARIN plans to provide
a conversion tool for populating that recommended RDAP server with
existing RWhois data. When the tool is publicly available, ARIN
proposes a 365-day sunsetting timeline for RWhois. This will allow for
robust communication and direct outreach to organizations who use
RWhois and plan to either convert to the RDAP client or discontinue
their use of local clients and report their reassignment information
directly to ARIN instead.

***
Whois (Port 43) Retirement Plan and Timeline

ARIN understands that Whois (Port 43) carries a high volume of queries
and will require the longest timeline to retire. We propose a two-year
sunsetting window, during which ARIN will engage in active outreach to
users. This will include updates to Whois (Port 43) results during the
sunsetting period that will contain information about the retirement
deadline.

Because Whois (Port 43) has been the historically preferred method of
querying Internet number resource registration data, it remains
heavily used by cybersecurity professionals, researchers, law
enforcement, and many other types of organizations. ARIN will seek to
engage beyond our community to raise awareness of the planned
retirement date for Whois (Port 43).

------
After the retirement of the directory service protocols described
above and listed below, ARIN will only support RDAP as our single,
standardized directory service.

- Whois-RWS: on or after 1 July 2027
- RWhois: dependent on migration tool release date, but no sooner than
1 January 2028
- Whois (Port 43): on or after 1 January 2029

Throughout the sunsetting process for all services, ARIN will engage
with our community to ensure customers and users are well-informed
about the retirement of the described services and ARIN’s transition
to RDAP as its standard directory service.

With all due respect, ARIN is an internet registry. ARIN is not some tech company that must be at the forefront of innovation, moving fast and breaking things.

We look forward to your feedback on the proposed timelines for
retirement for Whois-RWS, RWhois, and Whois (Port 43). We ask that you
consider each service independently, with the understanding that each
of these services may impact your organization differently.

Hard no on two years for Whois as there is insufficient Rdap support at this time.

No comment on Whois-RWS and RWhois.

Please provide comments to arin-consult () arin net. You can subscribe to
this mailing list at
https://lists.arin.net/mailman/listinfo/arin-consult.

This consultation will remain open until 5:00 PM ET on 14 September
2026. ARIN seeks clear direction through community input, so your
feedback is important.

Thank you for your continued support in improving ARIN’s services.

Regards,

John Curran
President and CEO
ARIN

------
Relevant links:
- Presentation from ARIN 56:
https://www.arin.net/participate/meetings/ARIN56/materials/arin56_directoryservices.pdf
- IETF Standard for RDAP: https://www.rfc-editor.org/info/std95
- Guide to RDAP Client Implementations:
https://rdap.rcode3.com/client_implementations/index.html

- ARIN RDAP Documentation: https://www.arin.net/resources/registry/whois/rdap/

_______________________________________________
ARIN-Consult
_______________________________________________
NANOG mailing list
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/VPMTFPBUX5YC6NLFMFNTWFZCDZF5X47O/

_______________________________________________

NANOG mailing list https://lists.nanog.org/archives/list/nanog () lists nanog org/message/LTYDQCW6HHMETMNBWDS37A3RPKIHUTKW/

---

Current thread:

• Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services) John Curran via NANOG (Aug 14)
  • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services) Randy Bush via NANOG (Aug 14)
    • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARINʼs Directory Services) John Curran via NANOG (Aug 14)
      • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARINʼs Directory Services) Cat Okita via NANOG (Aug 14)
    • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services) Job Snijders via NANOG (Aug 14)
      • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services) Sam Thomas via NANOG (Aug 15)
    • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARINʼs Directory Services) Mark Kosters via NANOG (Aug 14)
  • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services) Lavender-Jamie via NANOG (Aug 15)
    • Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services) Randy Bush via NANOG (Aug 15)
    • Re: Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Services) John Levine via NANOG (Aug 15)