WHOIS, RDAP and Domain Privacy: What Registration Data Is Public
Every registered domain has registration data: who registered it, through which registrar, when it was created and when it expires. For decades this information was published through the WHOIS service. Today the picture is different. Much personal data is redacted, a newer protocol called RDAP is replacing WHOIS, and privacy services are common. Here is what is typically public and what is not.
What WHOIS was designed for
WHOIS is a simple query protocol from the early internet. A lookup returned a text record with the registrant's name, organization, address, email and phone, plus administrative and technical contacts, the registrar, nameservers and key dates. The format differed between registries and registrars, which made automated processing difficult.
RDAP: the structured successor
The Registration Data Access Protocol (RDAP) provides the same kind of information over HTTPS in a structured JSON format. It supports standardized queries, internationalized data and differentiated access, meaning different users can be shown different levels of detail. For generic top-level domains, ICANN has moved registries and registrars to RDAP as the primary service, while many tools still present the results in a WHOIS-like view.
What is usually public
- the domain name and its status codes, such as transfer locks;
- the sponsoring registrar and its abuse contact;
- creation, last update and expiry dates;
- nameservers and DNSSEC status;
- often the registrant's organization (if any), state or province and country.
What is usually redacted
Since data protection laws such as the EU's General Data Protection Regulation took effect, registrars generally redact personal data of individual registrants from public output: name, street address, phone number and email address. Instead, the record may show "REDACTED FOR PRIVACY" and offer a web form or an anonymized email address to contact the registrant. Practices vary by registrar, by registry and especially among country-code TLDs.
Privacy and proxy services
Separately from legal redaction, many registrars offer privacy or proxy services. A privacy service shows the registrant's name but replaces contact details with the provider's. A proxy service registers the domain in the provider's name on the customer's behalf. Proxy arrangements have legal implications for who is the registered holder, so read the terms. Some TLDs restrict or prohibit these services.
Accuracy still matters
Even when data is hidden from the public, registrants must provide accurate contact information to their registrar, and registrars are required to verify certain details. Inaccurate data can lead to suspension. More practically, the registrant email is where renewal reminders and transfer approvals are sent, so it must be one you read.
Who can see redacted data?
Parties with a legitimate interest, such as law enforcement, cybersecurity researchers or rights holders pursuing infringement claims, can request access to non-public data. Requests are handled by registrars under applicable law and ICANN policies, and disclosure is not automatic.
Historical records
Commercial services archive registration data over time, so details published before redaction became common, or before a privacy service was added, may still be found in historical lookups. If you are concerned about privacy for a new project, enable redaction or a privacy service from the first day of registration rather than adding it later. When buying an existing domain, historical records can also help you understand its ownership history.
How to look up registration data
- Use the registry's or registrar's RDAP or WHOIS lookup, or ICANN's lookup tool for gTLDs.
- For country-code TLDs, use the registry's own lookup service.
- To contact a registrant whose data is redacted, use the contact form or anonymized email shown in the record.
- To report abuse, use the registrar's abuse contact listed in the record.
Key takeaways
- RDAP is the structured successor to WHOIS for registration data.
- Dates, registrar and nameservers are public; personal contact data is often redacted.
- Privacy and proxy services add another layer and have different legal effects.
- Keep your own contact data accurate, because the registrar still relies on it.