Use Prefix WhoIs from the tools you already run.
Every integration on this page does the same thing: at the moment your software has an address in hand, it asks the live routing table who announces it, and acts on the answer. Some we wrote; some are a line in a configuration file. If yours is missing, the rules for writing one are below.
Install, or paste, and go.
Prefix WhoIs Milter
Postfix and Sendmail. X-PWhois-* headers for the originator and the deliverer on every message.
MAILPlug-in for Rspamd
The same headers, plus symbols and variables for your Rspamd rules. No separate daemon.
BAN NOTICESFail2Ban
One line in a .local file and every ban notice carries the origin AS, organization and country.
ASSISTANTSMCP for AI assistants
Claude, Cursor and any MCP client ask the routing table directly. No account, no key.
COMMAND LINELFT and WhoB
Traceroute with AS resolution on every hop, and a whois client built for network engineers.
LIBRARIESC and PHP libraries
Single and bulk lookups from your own code, with the wire protocol handled for you.
Any stock whois client works too: whois -h whois.pwhois.org 8.8.8.8.
Eight rules of the road.
Prefix WhoIs is a query service, not a dataset. An integration that follows these rules behaves well on a busy mail server, survives an outage on either side, and stays inside the free allowance.
Query at the moment of need
Look up an address when you have one in hand. The service answers single addresses and batches over port 43, and that is the whole interface: there is no data file, no DNS zone and no bulk export, so integrations are live lookups by design.
Identify yourself
Put app="name-version" at the front of the query, letters, digits, dot, space, underscore and hyphen only. It changes nothing in the answer and it is how the service recognises a kind of traffic when you ask for a larger allowance.
Respect the allowance
Every network address gets 5,000 queries a day, reset at 00:00 UTC; hosts behind one NAT address share one. When it is used up the server answers with a short notice instead of a record. Detect that and stop for the day rather than retrying per message. Higher limits are customarily granted free for reasonable use: ask.
Cache briefly, by prefix
Repeat senders should cost one query, not one per message. Cache answers for about an hour, keyed by the returned prefix so every address in the block hits the cache, bounded in size, and shared across your workers where you can (the Rspamd plug-in uses Redis). A cache is de-duplication, not a copy of the table; do not build one.
Skip what has no route
Private, loopback and link-local addresses, and your own authenticated users, have nothing to look up. Filter them before the query.
Fail open
A slow or unreachable lookup must never delay or refuse mail, block a login, or hold an alert. Use a short timeout, and after a few consecutive failures stop querying for several minutes before trying again, so an outage on either side never turns into per-message latency.
Connect over IPv4
Queries over IPv6 are limited to a smaller allowance and fewer output types. Resolve the A record, or pin the address family, when your runtime would otherwise prefer IPv6.
Handle the data as the registries ask
Answers include registry information. Use it to make your decision and discard or cache it briefly; redistribution is not part of the free service and needs a conversation first.
Before you ask.
What does a query look like on the wire?
A single line to whois.pwhois.org port 43, for example app="mytool-1.0" 8.8.8.8, answered with Field: value lines. type=all adds registry fields; type=cymru gives the one-line format many tools already parse. The FAQ covers the output formats, and whois -h whois.pwhois.org 8.8.8.8 shows you a live answer.
Is there an HTTPS or DNS interface?
No. Port 43 and the MCP server are the two doors. If your platform cannot open outbound TCP to port 43, run a small relay on a host that can and point your tool at it.
How fresh is the answer?
It comes from the current routing table. Cache-Date in every record says when that table was built.
Do you keep what I ask about?
No. Like the whois service itself, queries are not stored. The address you connect from is remembered so your queries share its allowance, and usage is published only as aggregate percentages.
I wrote one. Will you list it?
Yes, if it follows the rules above. Send the link through the request form.