quien-whois-lookup

quien — Better WHOIS Lookup Tool

Skill by ara.so — Daily 2026 Skills collection.

quien is a Go-based CLI/TUI tool that replaces whois with tabbed interactive views and JSON-scriptable subcommands for domain WHOIS/RDAP, DNS records, mail configuration (SPF, DMARC, DKIM, BIMI), SSL/TLS, HTTP headers, tech stack detection, and IP/ASN/BGP lookups.

---

Installation

Homebrew (macOS/Linux)

brew tap retlehs/tap
brew install retlehs/tap/quien

Ubuntu / Debian

curl -fsSL https://apt.quien.dev/install.sh | sudo sh

Go

go install github.com/retlehs/quien@latest

Verify installation

quien --version

Optional — replace system whois:

# Add to ~/.bashrc or ~/.zshrc
alias whois=quien

---

Core CLI Commands

Interactive TUI (default)

# Launch interactive prompt
quien

# Open TUI directly for a domain
quien example.com

# Open TUI for an IP address
quien 8.8.8.8

JSON output (scriptable)

# Full JSON output for all tabs
quien --json example.com

# Individual subcommands (always output JSON)
quien dns example.com
quien mail example.com
quien tls example.com
quien http example.com
quien stack example.com
quien all example.com        # all data in one JSON object

---

TUI Tab Overview

Tab	Data shown
WHOIS	RDAP-first registration data, registrar, dates, nameservers
DNS	A, AAAA, MX, TXT, NS, CNAME, SOA records
Mail	MX, SPF, DMARC, DKIM, BIMI + VMC chain validation
TLS	Certificate chain, validity, SANs, cipher info
HTTP	Response headers, redirects, status codes
Stack	WordPress plugins, JS/CSS frameworks, external services
IP	Reverse DNS, network info, abuse contacts, ASN via RDAP/BGP

---

JSON Subcommand Examples

DNS records

quien dns github.com
# Output:
# {
#   "domain": "github.com",
#   "a": ["140.82.121.4"],
#   "aaaa": [],
#   "mx": [{"host": "aspmx.l.google.com", "priority": 1}],
#   "ns": ["dns1.p08.nsone.net", "dns2.p08.nsone.net"],
#   "txt": ["v=spf1 ip4:... ~all"],
#   ...
# }

Mail configuration audit

quien mail example.com
# Returns SPF record, DMARC policy, DKIM selectors found,
# BIMI record, VMC certificate chain validation

TLS/SSL inspection

quien tls example.com
# Returns certificate subject, issuer, validity dates,
# SANs, chain depth, protocol version, cipher suite

HTTP headers

quien http example.com
# Returns status code, redirect chain, all response headers
# (Content-Security-Policy, HSTS, X-Frame-Options, etc.)

Tech stack detection

quien stack example.com
# Parses HTML for:
# - WordPress version + active plugins
# - JavaScript frameworks (React, Vue, Angular, Next.js, etc.)
# - CSS frameworks (Tailwind, Bootstrap, etc.)
# - External services (analytics, CDNs, payment providers)

IP address lookup

quien 8.8.8.8
quien --json 8.8.8.8

# Returns:
# - Reverse DNS (PTR record)
# - RDAP network block info
# - Abuse contact
# - Origin ASN + prefix (RDAP with BGP fallback)
# - PeeringDB enrichment: org, peering policy, IX/facility counts,
#   traffic profile, peering locations

All data at once

quien all example.com | jq '.dns.a'
quien all example.com | jq '.mail.spf'
quien all example.com | jq '.tls.valid_until'

---

Scripting Patterns

Pipe JSON into jq

# Get all A records
quien dns example.com | jq '.a[]'

# Check if DMARC policy is reject
quien mail example.com | jq '.dmarc.policy == "reject"'

# Get certificate expiry
quien tls example.com | jq '.certificates[0].not_after'

# List detected JS frameworks
quien stack example.com | jq '.javascript_frameworks[]'

# Get ASN number for an IP
quien --json 1.1.1.1 | jq '.asn.number'

Shell script: bulk domain audit

#!/bin/bash
domains=("example.com" "github.com" "golang.org")

for domain in "${domains[@]}"; do
  echo "=== $domain ==="
  
  spf=$(quien mail "$domain" | jq -r '.spf.record // "MISSING"')
  dmarc=$(quien mail "$domain" | jq -r '.dmarc.policy // "MISSING"')
  tls_expiry=$(quien tls "$domain" | jq -r '.certificates[0].not_after // "N/A"')
  
  echo "SPF:   $spf"
  echo "DMARC: $dmarc"
  echo "TLS expires: $tls_expiry"
  echo
done

Shell script: check domain expiry

#!/bin/bash
DOMAIN="${1:?Usage: $0 <domain>}"

expiry=$(quien --json "$DOMAIN" | jq -r '.whois.expires // .rdap.expires // empty')

if [ -z "$expiry" ]; then
  echo "Could not determine expiry for $DOMAIN"
  exit 1
fi

echo "$DOMAIN expires: $expiry"

Go integration — run quien as subprocess

package main

import (
    "encoding/json"
    "fmt"
    "os/exec"
)

type DNSResult struct {
    Domain string   `json:"domain"`
    A      []string `json:"a"`
    MX     []struct {
        Host     string `json:"host"`
        Priority int    `json:"priority"`
    } `json:"mx"`
    TXT []string `json:"txt"`
}

func lookupDNS(domain string) (*DNSResult, error) {
    out, err := exec.Command("quien", "dns", domain).Output()
    if err != nil {
        return nil, fmt.Errorf("quien dns failed: %w", err)
    }
    var result DNSResult
    if err := json.Unmarshal(out, &result); err != nil {
        return nil, fmt.Errorf("parse error: %w", err)
    }
    return &result, nil
}

func main() {
    dns, err := lookupDNS("example.com")
    if err != nil {
        panic(err)
    }
    fmt.Printf("A records for %s: %v\n", dns.Domain, dns.A)
    for _, mx := range dns.MX {
        fmt.Printf("MX %d: %s\n", mx.Priority, mx.Host)
    }
}

Go integration — full audit struct

package main

import (
    "encoding/json"
    "os/exec"
)

type FullAudit struct {
    WHOIS struct {
        Registrar string `json:"registrar"`
        Created   string `json:"created"`
        Expires   string `json:"expires"`
        Updated   string `json:"updated"`
    } `json:"whois"`
    DNS struct {
        A   []string `json:"a"`
        NS  []string `json:"ns"`
        TXT []string `json:"txt"`
    } `json:"dns"`
    Mail struct {
        SPF struct {
            Record string `json:"record"`
            Valid  bool   `json:"valid"`
        } `json:"spf"`
        DMARC struct {
            Record string `json:"record"`
            Policy string `json:"policy"`
        } `json:"dmarc"`
    } `json:"mail"`
    TLS struct {
        Certificates []struct {
            Subject  string `json:"subject"`
            NotAfter string `json:"not_after"`
        } `json:"certificates"`
    } `json:"tls"`
    Stack struct {
        JavascriptFrameworks []string `json:"javascript_frameworks"`
        CSSFrameworks        []string `json:"css_frameworks"`
        ExternalServices     []string `json:"external_services"`
    } `json:"stack"`
}

func auditDomain(domain string) (*FullAudit, error) {
    out, err := exec.Command("quien", "all", domain).Output()
    if err != nil {
        return nil, err
    }
    var audit FullAudit
    return &audit, json.Unmarshal(out, &audit)
}

---

Agent Skill Integration

Install quien as an agent skill so AI coding agents automatically use it for domain/IP lookups:

npx skills add retlehs/quien

---

Key Behaviors to Know

• RDAP-first: Uses RDAP protocol before falling back to raw WHOIS. Broader TLD coverage via IANA referral.
• Automatic retry: All network lookups use exponential backoff — transient failures are retried automatically.
• BGP fallback: If RDAP does not return ASN data for an IP, quien queries BGP routing tables for origin ASN/prefix.
• PeeringDB enrichment: ASN lookups are enriched with PeeringDB data (peering policy, IX presence, traffic profile).
• VMC validation: BIMI lookups validate the full VMC certificate chain, not just the record presence.
• Tech stack from HTML: Stack detection fetches and parses the actual HTML of the target, not just HTTP headers.

---

Troubleshooting

quien: command not found

# If installed via go install, ensure GOPATH/bin is in PATH
export PATH="$PATH:$(go env GOPATH)/bin"

TUI doesn't render correctly

# Ensure your terminal supports true color and UTF-8
echo $TERM          # should be xterm-256color or similar
echo $LANG          # should include UTF-8

Rate limiting / lookup failures

• RDAP and WHOIS servers may rate-limit. quien retries with backoff automatically.
• For bulk scripting, add sleep 1 between calls to avoid hitting rate limits.

No DKIM results

• DKIM requires knowing the selector. quien probes common selectors (google, default, mail, etc.) but custom selectors won't be discovered automatically.

IP lookup shows no ASN

• Some IP blocks are not in RDAP. quien falls back to BGP; if both fail, the block may be unrouted or private.

JSON output is empty / malformed

# Confirm the subcommand syntax — subcommands always output JSON
quien dns example.com        # correct
quien --json dns example.com # incorrect - --json is for top-level only