What you can find out about a domain owner in 2026
Considerably less than you could a decade ago, and the reason is regulatory rather than technical. Before 2018, WHOIS published the registrant's name, postal address, email, and telephone number for most generic extensions, in an unstructured text format served over port 43. The General Data Protection Regulation made publishing that data for individuals unlawful in the European Economic Area, and because registries could not reliably determine which registrants were EEA residents, most redacted contact data for everyone.
What remains public is still useful: the sponsoring registrar and its abuse contact, the creation and expiry dates, the status codes, the nameservers, and whether the domain is DNSSEC-signed. For most practical purposes — is this domain about to expire, who would I serve a complaint on, is this a newly registered throwaway — that is enough.
RDAP, not WHOIS
This tool queries RDAP, the Registration Data Access Protocol, which ICANN made the definitive source for generic top-level domain registration data as of 28 January 2025, replacing the sunsetted port-43 WHOIS service. RDAP returns structured JSON rather than free text and allows for differentiated access — the mechanism by which accredited requesters can be shown more than the general public.
Two details are widely misreported. WHOIS was not banned: generic registries and registrars are simply no longer required to run it, with .com, .name and .post still under an obligation, and many contracted parties continue to offer it voluntarily. And coverage is not universal — country-code registries sit outside ICANN's contractual authority altogether, and some publish very little or nothing.
Reading the creation date
The creation date is the most under-used field in the record, and for triage work often the single most informative one. A domain registered three days ago and a domain registered in 2004 are different kinds of object, and the difference is actionable.
A very recent creation date on a domain presenting itself as an established business is one of the strongest cheap signals available. Invoice fraud, brand impersonation and phishing all depend on domains registered days or weeks before use, because the domain is disposable by design. Combine the date with the nameservers and the mail configuration and the picture is usually unambiguous within a minute: an eight-day-old domain, generic parking nameservers, mail newly configured at a free provider, and an expiry exactly one year out is not a fifteen-year-old supplier changing its bank details.
The date has an operational meaning too. A registrar may deny an inter-registrar transfer within sixty days of the creation date shown in the record, so a newly registered name generally cannot be moved yet, and that is normal rather than a fault.
Two caveats keep the signal honest. A domain that expired, dropped and was re-registered receives a new creation date, so a name that has existed since the 1990s can legitimately show a recent one. And an old creation date says nothing about how long the current holder has had it — a name created in 1998 may have changed hands last week.
What the nameservers tell you
The nameserver list describes operational reality rather than paperwork. It tells you which servers the registry has delegated the zone to, and by extension where the records actually live and who would have to change them.
The hostnames are the evidence. Registrar-branded nameservers mean the domain is on the registrar's bundled DNS and the records are edited in its control panel. Provider-branded nameservers mean a third-party DNS host, a CDN or a hosting company holds the zone, and the registrar controls only the delegation. Nameservers on the domain's own name mean self-hosting or a white-labelled service, and require glue records at the registry to resolve at all.
Why this matters more than it looks: the most common self-inflicted outage is editing records in one place while the delegation points somewhere else. Nothing you change is being served, because you are editing a zone nobody is reading. Note that the record shows the delegated nameservers, not who operates them — you infer that from the hostnames, and white-labelling can make the inference wrong.
Reading the status codes
The status codes are the most under-explained part of a record, and the key is the prefix. Codes beginning client were set by the registrar, usually at the registrant's request: clientTransferProhibited means the registrar lock is on, which is a good thing and the default at most registrars. Codes beginning server were set by the registry itself and cannot be removed by the registrar — these often indicate a dispute, a legal hold, or a policy action. redemptionPeriod means the domain has been deleted and is in its recovery window. pendingDelete means recovery is over and it will drop shortly. inactive means no nameservers have been set, so the registration is fine but nothing resolves.
One trap catches people reading RDAP rather than legacy WHOIS: the status names are rendered differently. The healthy state ok appears as active, and camel-case codes appear as spaced lower-case phrases. Note also that a domain showing only a registrar lock will not show ok at all, because that status cannot be combined with any other.
When a country-code registry publishes nothing
Country-code registries answer to their own national frameworks, and the spread of what they publish is enormous in both directions. Some publish more than generic extensions do: .us prohibits privacy and proxy services outright and publishes full registrant contact details, and .com.au always publishes the registrant's legal name and company number, because the public identity of the licence holder is part of how eligibility is policed. Others publish almost nothing, or gate access behind a rate limit or a per-query form.
If a lookup comes back empty, work through the options in this order.
- Confirm the domain exists at all. An empty record is a policy statement, not evidence of an unregistered name. Run an availability check and a DNS lookup: a name that resolves is plainly registered whatever the registry publishes.
- Try the registry's own lookup. Many country-code registries run a web interface that returns more than any third-party tool can, precisely because they meter it.
- Use the technical record instead. Nameservers, mail configuration and certificate transparency logs often identify a site's operator when the registration record will not identify the registrant.
- Go through process where identity matters. Many country-code registries operate their own dispute policy; for anything else, the registrar responds to lawful process and not to curiosity.
If you need the registrant's identity
Redaction is not anonymity. Registrars retain full registrant data and disclose it under legal process. For trademark matters, a complaint filed with an approved dispute provider will typically result in the registrar revealing the underlying registrant to the provider. For litigation, a subpoena to the registrar is the ordinary route.
ICANN also operates the Registration Data Request Service, a free centralised front door for requesting non-public generic registration data. Its limits are structural: registrar participation is voluntary, covering around half of generic domains or less, and pilot outcomes were 26 per cent approved, 55 per cent denied, and 19 per cent partially approved or already public. The service continues beyond its pilot by Board resolution, but the standardised access system it was meant to precede was not adopted, so a voluntary, partial service is what exists.
What is public now is operational data — who the registrar is, what state the domain is in, where its DNS points, who to contact about abuse — not identity. Identity requires a lawful basis, a formal request, and usually patience.