- RDAP returns structured JSON over HTTPS, and since 28 January 2025 it has replaced WHOIS as the required lookup service for gTLDs.
- Since GDPR took effect in May 2018, personal registrant data is usually redacted in public gTLD lookups, often shown as REDACTED FOR PRIVACY.
- A public domain lookup still shows the registrar, abuse contact, creation and expiry dates, status codes, nameservers and DNSSEC status.
- With a privacy service you remain the registrant of record, whereas a proxy service becomes the registrant and licenses the domain to you.
- Domain privacy is not anonymity, because registrars can disclose underlying data to law enforcement or trademark owners through legitimate requests such as ICANN's RDRS.
Check a name while you read
Every domain registration includes contact details for its holder. For decades, those details were published openly through a system called WHOIS. Today, most personal data is hidden by default, WHOIS has largely been replaced by RDAP for generic TLDs, and privacy services add another layer. This guide explains what is public, what is not, and what that means for you.
What registration data includes
When you register a domain, the registrar collects data such as:
- Registrant name, organization, postal address, email and phone number.
- Administrative and technical contacts (collection of these has been reduced under ICANN's newer policies).
- Technical data: the registrar, creation and expiration dates, nameservers, DNSSEC status and EPP status codes.
The technical data is almost always public. The personal contact data is where privacy rules apply.
WHOIS: the original lookup protocol
WHOIS is a simple text protocol from the early days of the internet. You send a domain name to a WHOIS server and get back a plain-text record. It has well-known limitations: no standard output format, no built-in way to authenticate users and give them different levels of access, and limited support for internationalized data.
RDAP: the modern replacement
The Registration Data Access Protocol (RDAP) was standardized by the IETF to address those problems. It returns structured JSON over HTTPS, supports internationalization, and allows differentiated access, so authorized parties can, in principle, see more than the public. ICANN required gTLD registries and registrars to support RDAP, and on 28 January 2025 their obligation to provide the legacy WHOIS service ended, making RDAP the definitive source for gTLD registration data.
Many ccTLDs still run their own WHOIS services, and some support RDAP as well. Tools such as our WHOIS lookup query the appropriate source for you, so you do not need to know which protocol a given TLD uses.
How GDPR changed public registration data
When the EU's General Data Protection Regulation took effect in May 2018, publishing personal data about registrants in a public directory became legally problematic. ICANN adopted a temporary specification that allowed registrars and registries to redact personal data, which was later replaced by a permanent Registration Data Policy. In practice:
- Personal data is usually redacted in public results for gTLD domains, often replaced by text such as "REDACTED FOR PRIVACY."
- Many registrars redact globally, not only for EU residents, because determining residence reliably is difficult.
- Organization names and country may still be shown in some cases.
- A way to contact the registrant must still be provided, typically through a web form or anonymized email.
Privacy and proxy services
Separate from redaction, many registrars offer privacy or proxy services:
| Type | How it works |
|---|---|
| Privacy service | You remain the registrant, but the service's contact details are displayed instead of yours. |
| Proxy service | The service itself is the registrant of record and licenses the domain to you. This gives you less direct control, so understand the terms. |
Many registrars now include privacy at no extra charge. Some extensions do not allow privacy services; for example, the .us policy prohibits them, and some ccTLDs set their own rules on what is displayed. Check before registering in those extensions.
What a public lookup typically shows today
- The domain's registrar and the registrar's abuse contact.
- Creation, last-updated and expiration dates.
- Status codes, such as clientTransferProhibited.
- Nameservers and whether DNSSEC is signed.
- Redacted or privacy-service registrant details, plus a contact method.
That is still a lot of useful information. You can tell how old a domain is, when it might expire, where it is hosted and who to report abuse to.
Getting access to redacted data
Parties with a legitimate interest, such as law enforcement, cybersecurity researchers or trademark owners pursuing a claim, can request disclosure of redacted data from the registrar. ICANN launched the Registration Data Request Service (RDRS) in 2023 as a central system to submit such requests to participating registrars. Disclosure is not automatic; the registrar weighs the request against the registrant's privacy rights and applicable law. UDRP proceedings also give complainants a route to learn the underlying registrant identity.
Should you use domain privacy?
For individuals, the answer is almost always yes, especially if you would otherwise publish a home address. For businesses, the calculation is different. Some companies prefer to show their organization name for transparency, which can also help with trust and with proving ownership in disputes. In either case:
- Keep your underlying data accurate. Privacy hides data; it does not replace it. Inaccurate data can lead to suspension and makes recovery harder if your account is compromised.
- Use an email you monitor. Renewal notices, transfer confirmations and relayed messages go there.
- Register in the right name. The registrant of record is the legal holder of the domain.
Registration data and domain security
Hiding your contact details also reduces your exposure to social engineering. Attackers who know a registrant's name, email and phone number can attempt targeted phishing, impersonate the owner in support calls, or try to take over the email account that controls the domain. Combine privacy with strong account security: two-factor authentication on your registrar account, a registrar lock, and a registrant email that is itself protected with 2FA. Our guide to domain security best practices covers these in more detail.
Be aware too of "domain listing" and "SEO service" letters and emails that use public registration data, such as your expiry date, to look like official renewal notices. Renew only through your actual registrar.
Privacy does not mean anonymity
Your registrar knows who you are, and data can be disclosed in response to valid legal requests or abuse reports. Privacy protects you from spam, scraping and unwanted contact; it does not shield illegal activity.
Practical uses for lookups
- Checking when a domain you want was registered and when it expires.
- Identifying the registrar to contact the owner through their relay.
- Verifying your own domain's status, nameservers and lock settings.
- Investigating suspicious domains that imitate your brand.
Try it now with the WHOIS lookup, or if you are still looking for an available name, start with the domain search.
FAQ
What is the difference between WHOIS and RDAP?
Both provide domain registration data. WHOIS is an older plain-text protocol, while RDAP returns structured data over HTTPS and supports differentiated access. For gTLDs, RDAP replaced WHOIS as the required service in January 2025.
Is domain privacy necessary?
It is strongly recommended for individuals to avoid publishing personal contact details. Much personal data is already redacted by default, but privacy services add protection and are often included free.
Can anyone find out who owns a domain with privacy enabled?
Not from a public lookup. Registrars can disclose the underlying data in response to legitimate requests, such as from law enforcement or trademark owners, and under legal process.
Why does my WHOIS show REDACTED FOR PRIVACY?
Since GDPR took effect in 2018, registrars and registries redact personal data in public registration results under ICANN policy. A contact form or anonymized email is usually provided instead.