How to Find Out Who Owns a Domain

What a domain lookup returns now

Look up a generic domain today and you get a full record. It simply will not contain a person. The registrar is named, the dates are there, the status codes are there, the nameservers are there, and where the registrant name, street address, phone number and email should sit you get a redaction marker or a link to a web form.

That is not a fault in the tool you used, and it is not the registrant hiding something. It has been the default state of nearly every generic top-level domain registration since 2018, whether or not the registrant asked for privacy.

What is published now is operational data: who sponsors the name, what state it is in, where its DNS points, who to contact about abuse. What is not published is identity data. Hold on to that distinction, because for most reasons people run a lookup, operational data is the answer.

What WHOIS published for twenty years

WHOIS is specified in RFC 3912, published in September 2004 and describing a protocol already ancient by then. The mechanics are as crude as they sound. A client opens a TCP connection to port 43, sends a text query, and the server replies with free-form text and closes the connection. Closing the connection is how the client knows the answer has ended.

For roughly two decades that reply contained the whole registrant record: name, postal address, telephone number and email, plus administrative and technical contacts. That was the design intent, not an oversight.

The limitations were documented rather than fixed. RFC 3912 records that the protocol lacks mechanisms for access control, integrity and confidentiality, and concludes that such a protocol would not normally be acceptable to the IETF at the time of writing. Its own advice was that WHOIS should carry only information that is non-sensitive and intended to be accessible to everyone.

For anyone who ever tried to parse it, that meant no standard output format, no reliable internationalization, no authentication, no way to tell an absent field from a withheld one, and no way to return more to an authorized requester than to an anonymous one. ICANN standardized field labels in 2017, which fixed the labels, not the protocol.

Why redaction applied to everyone, not only to Europeans

The General Data Protection Regulation became applicable on 25 May 2018 across the EU and EEA, with extraterritorial reach over anyone processing the data of people located there. Publishing the name, address, telephone number and email of every registrant to the open internet was incompatible with it.

ICANN's response was the Temporary Specification for gTLD Registration Data, adopted by the ICANN Board on 17 May 2018 and effective on 25 May 2018. It required registrars and registries to treat registrant contact fields as redacted unless the registrant consented to publication, masking registrant name, street address, telephone and fax, along with administrative and technical contact details.

No carve-out was made for registrants outside Europe, and the protocol is a good part of the reason one would have been unworkable. WHOIS publishes a single record to everybody and cannot authenticate who is asking, so a registry cannot serve a fuller record to a requester verified as out of scope. Varying the record by registrant location would also leak that classification to anyone comparing two lookups.

The vocabulary matters. Redaction is a registry or registrar withholding data it holds and continues to hold. It is not a privacy service, and it is not anonymity.

RDAP, and the date it became the definitive source

The successor is RDAP, the Registration Data Access Protocol, standardized as STD 95 across five RFCs. It answers over HTTPS rather than plaintext port 43, returns structured JSON rather than free-form text, uses real HTTP status codes so a 404 unambiguously means the name is not registered, and handles Unicode properly.

Two details matter when reading the output. RFC 8056 maps EPP status codes to RDAP status values and the names are not identical: ok becomes active, clientTransferProhibited becomes client transfer prohibited. And RFC 9537, published on 29 March 2024, lets a server signal explicitly which fields were redacted and by which method — solving the problem WHOIS never could, of telling a field that does not exist apart from a field you are not permitted to see.

ICANN's announcement of 27 January 2025 set the date. As of 28 January 2025, RDAP is the definitive source for delivering generic top-level domain registration information in place of sunsetted WHOIS services. From that date gTLD registries and registrars are no longer required to provide WHOIS, with .com, .name and .post carved out under their own legacy commitments.

Read that carefully, because it is widely misreported. RDAP is mandatory; WHOIS is no longer required but was not banned, and plenty of contracted parties still run it. The consequence is concrete: any script or monitor still built on port 43 for generic extensions may be reading something absent, stale or a thin pointer to RDAP.

What is still public, and why it usually answers the question

The Registration Data Policy, effective 21 August 2025, governs what appears. Available freely and instantly, with no request and no justification:

• The sponsoring registrar, its IANA ID and URL, and its abuse contact email and telephone number — required to be public, and the correct route for reporting abuse.
• Creation, expiry and last-updated dates.
• The full set of status codes, showing whether the name is locked, on hold, expired or in redemption.
• The nameservers, and from them the DNS provider and often the hosting arrangement.
• DNSSEC signing status.
• The registrant's country and usually state or province, plus organization and postal code where collected and published.
• An anonymized contact email or web form that reaches the registrant without identifying them.

Now match that against why people actually run a lookup. Reporting a phishing page: use the registrar abuse contact, public precisely for this purpose. Making an offer on a name: use the relay address or web form. Working out whether a name is about to become available: read the dates and status codes. Diagnosing why a site went dark, or checking that a domain you are buying is unencumbered: the status codes and nameservers answer within a minute.

Redacted fields only block you when you need to identify a human being in order to serve, sue or verify them — a smaller set of cases than the volume of complaints suggests.

Country-code registries answer only to themselves

ICANN's policies bind generic extensions. Country-code registries set their own rules and vary enormously, in both directions.

• .us publishes the registrant's full name, postal address, email address and telephone number, and prohibits privacy and proxy services outright. The registry runs detection algorithms against proxy registrations and enforces registrars' obligation not to offer them.
• .de withholds individuals' data by default at no cost while publishing legal entities by design. DENIC offers third-party disclosure in four categories only — rights holders, public authorities, judgment creditors and insolvency administrators — and states plainly that there is no way to query which domain is held by a given person.
• .nl has withheld private individuals' data since 2016 and publishes business registrants. Its lookup is searchable by domain name only, with no reverse lookup, four permitted purposes, an express ban on automated queries and a daily per-IP rate limit.
• .es exposes only the holder's name, behind an authorization gate, and operates no RDAP service at all.
• .ch publishes essentially nothing by default, though the registry holds accurate holder identity and may revoke a name where the holder fails to disclose it.

Two rules follow. RDAP is not mandatory for country-code extensions and there is no single WHOIS sunset date for them, so check what a registry actually runs before building anything on it. And where such a registry does publish in full, it publishes to everyone, indefinitely, often with no privacy product available to change that.

The three legitimate routes to a registrant's identity

Identity is obtainable. It requires a lawful basis, a formal request, and patience.

A disclosure request to the registrar. Under the Registration Data Policy the registrar must acknowledge a disclosure request within two business days and give a substantive response within thirty calendar days of that acknowledgement. Genuinely urgent matters — imminent threats to life, serious bodily injury, critical infrastructure or child exploitation — carry a two-hour acknowledgement and a 24-hour response, extendable to a maximum of 72 hours. ICANN's Registration Data Request Service is a free, centralized front door for these requests, launched in November 2023 as a two-year pilot and continued by Board resolution at ICANN84. Its weakness is that registrar participation is voluntary: the pilot ended with 80 registrars covering around 46 percent of gTLD domains. Outcomes were 26 percent approved, 55 percent denied and 19 percent partially approved or already public. A legitimate interest carries a request; curiosity does not. Nor is a better system coming as designed — on 12 March 2026 the ICANN Board declined to adopt the SSAD recommendations from the EPDP Phase 2 Final Report.

A UDRP complaint. The Uniform Domain-Name Dispute-Resolution Policy is written into the registration agreement of every generic domain, and filing against a privacy-shielded domain typically causes the registrar to reveal the underlying registrant to the dispute provider. A complainant must prove all three elements: identity or confusing similarity to a mark in which they have rights, no rights or legitimate interests on the registrant's part, and registration and use in bad faith. That last conjunction is load-bearing — a name registered in good faith before the complainant's mark existed generally fails it, however objectionable its current use. Cases typically complete within about two months, and a panel can only transfer, cancel or deny. Damages are unavailable, so if compensation is the objective this is the wrong forum.

Court process. Subpoenas to the registrar, court orders and law enforcement process remain available and are unaffected by any of the above. The registrar holds the full registration data; it is a contracted party with compliance obligations, not a black box.

Redaction is not anonymity

The correction worth making: nobody deleted the registrant's details. The registrar collected them, holds them, escrows them, and discloses them under process. Accuracy obligations still apply, and inaccurate registration data is itself a breach that can cost a registrant the name.

Work in order. Read the public record first and ask honestly whether it answers your question, because usually it will. To reach the registrant, use the relay address or web form. To report abuse, use the registrar abuse contact. If you genuinely need identity, choose the route that matches your basis — a disclosure request where you have a stated lawful interest, a UDRP complaint where you have trademark rights and the facts for all three elements, court process where you need something enforceable — and start early.

What ended in 2018 was the era of typing a domain into a box and learning a person's name. Accountability did not end with it. It moved from a public text file to a process with deadlines attached.