WHOIS services are mainly run by registrars and registries; for example Public Interest Registry (PIR) maintains the .ORG registry and associated WHOIS service. ICANN organization coordinates the central registry for Internet resources, which includes a reference to the WHOIS server of the responsible registry as well as the contact details of this registry.
Registries also maintain another vital system, the authoritative name servers, which hold the key to where a website is located. For example, if you type www.icann.org into a browser, your ISP will query the name servers starting from the hard coded root servers to find out which name servers are associated to that domain name. One of those name servers is then contacted and will return the IP address for that domain name. Your computer can now connect to the computer that will serve up the ICANN homepage.
The selection of which registry operator is to be queried each time depends on the trailing part of the domain (e.g. .COM, .NET, .UK), also known as the top-level domain (TLD). If the ISP doesn't already know, it can determine which name server need to be asked for a given part of the domain name, beginning with asking a root server. There are various root servers located all over the world that point to the appropriate downstream name servers.
WHOIS is designed to work in the same way: Starting at WHOIS.IANA.ORG, follow the references to the downstream WHOIS servers unless the required information is obtained. This process is illustrated below for a "thick" registry. If the registry has not yet fully transitioned to "thick" still uses a "thin" data model, an additional process query at the registrar's database is required to obtain the WHOIS data for the domain name.
Last Updated: July 2017