Who Owns a Domain Name? How to Find Out
Most guides tell you to run a WHOIS lookup and stop there. Since 2018 that lookup usually returns a redacted record. Here is what is still public, what it tells you, and the legitimate ways to reach an owner whose name is hidden.
September 9, 20267 min readWHOIS · RDAP · Domain data
See any taken domain’s registrar and its registration and expiry dates, straight from the registry.
Look up a domainYou found a domain you want and it is taken. The obvious next question is who has it, and the obvious next step is a WHOIS lookup.
That step will probably disappoint you. For most domains registered in the last several years the owner's name, email and address are replaced with a redaction notice. This is not a bug or a paywall. It is the correct and intended behaviour, and no service can lawfully hand you that data just because you asked.
What follows is what you can still learn, why the rest is hidden, and what actually works when you need to reach the person behind a name.
The short version
| What you want | Realistic answer |
|---|---|
| The registrant's name | Usually redacted, occasionally public for companies |
| The registrar | Always public |
| Creation and expiry dates | Always public |
| Nameservers | Always public |
| Registry status codes | Always public |
| A way to contact the owner | Usually available, indirectly |
| Whether the domain is for sale | Often discoverable |
The useful reframe is this. You will rarely learn who. You will almost always learn enough.
Start with the registration record
Every registered domain has a record held by the registry that operates its extension. Two protocols serve it.
WHOIS is the original, dating to 1982. It speaks plain text over port 43, and every registry formats its output differently, which is why two WHOIS tools can show you meaningfully different things for the same name.
RDAP, the Registration Data Access Protocol, is the modern replacement. Defined across IETF RFCs 7480 to 7484 and 9224, it returns structured JSON over HTTPS with defined field names, proper Unicode handling and granular access control. ICANN sunsetted the WHOIS requirement on 28 January 2025, removing the obligation for gTLD registries and registrars to run it on port 43, so RDAP is now the definitive source for gTLD registration data.
For anyone reading a record programmatically this matters enormously. Instead of guessing at loosely formatted text, you get a structured response and an HTTP status you can trust together. A standards-shaped "not found" from the authoritative RDAP server is strong evidence that no registration exists. Unrecognised error bodies still deserve caution, because a status code alone is not a guarantee of registrability.
Our checker routes every query through the IANA RDAP bootstrap, so each lookup reaches the registry that actually operates the extension rather than a middleman's cached copy.
Why the name is redacted
In May 2018 the GDPR came into force, and the domain industry had a problem. Publishing the name, home address, email and phone number of every registrant in a globally readable database is difficult to reconcile with European data protection law.
ICANN's response was a temporary specification, later settled into permanent policy, that requires registrars to redact personal registrant data from public records. What survives is the technical and administrative data that keeps the internet working.
Two consequences are worth understanding. Redaction applies to natural persons in particular, so a domain registered to a company sometimes still shows the organisation name. And redaction is not the same as privacy protection, which is a separate paid service that substitutes the provider's details for yours in the record.
What is still public, and what it tells you
The remaining fields are more informative than people expect.
| Field | What you can infer |
|---|---|
| Registrar | Where to send a transfer or abuse enquiry, and a hint at the owner's sophistication |
| Creation date | A 1998 registration is a different conversation from a 2025 one |
| Expiry date | When it lapses, and whether it is renewed in long blocks |
| Updated date | Recent changes suggest an active owner |
| Nameservers | Often identifies the host, or reveals the domain is parked for sale |
| Status codes | Whether it is locked, expired, in redemption or in dispute |
Nameservers are the underrated field. If they point at a parking or brokerage service, the domain is very likely listed for sale, and you have found your route in without contacting anyone. If they point at a real host, someone is using it.
Dates are the other tell. A name registered fifteen years ago and renewed in ten-year blocks belongs to someone who is not going to sell casually. A name registered eight months ago with a marketplace nameserver is inventory.
Read the status codes before you do anything else
The registry publishes a set of EPP status codes on every domain, and they answer questions that would otherwise take emails to resolve.
| Code | Meaning for you |
|---|---|
| ok | Nothing unusual, actively registered |
| clientTransferProhibited | Normal registrar lock, not a problem |
| redemptionPeriod | Expired, recoverable only by the current owner, at a restore fee |
| pendingDelete | Being deleted, will drop soon |
| serverHold | Suspended, often a dispute or abuse matter |
| clientHold | The registrar suspended it, frequently non-payment |
If you are waiting for a name to become available, these codes are your timeline. A domain in pendingDelete has days left. A domain in redemptionPeriod may still be reclaimed by its owner and often is. The full expiry lifecycle is worth understanding before you plan around a drop date.
How to actually reach the owner
Four routes work, roughly in order of how well they work.
The registrar's anonymised contact. Redacted records normally include a forwarding address or a web form that relays to the registrant. It is designed for exactly this. Messages do get through, though you should expect no reply from someone who has no interest in selling.
The website itself. If the domain resolves to a live site, the contact page, imprint or privacy policy is faster and more reliable than any lookup. In several jurisdictions, Germany especially, an imprint with real contact details is a legal requirement.
The marketplace listing. Check whether the name is listed at the large aftermarket venues. A listed domain has a price and a process, and you skip the introduction entirely.
A broker. For a name that matters commercially, a broker approaches on your behalf. This costs money and is worth it for one specific reason beyond convenience: the moment a seller knows a funded company wants their name, the price changes. Anonymity is the product you are buying.
Country extensions play by different rules
Everything above describes gTLDs like .com and .org, which ICANN coordinates. Country-code extensions set their own policy and vary widely.
Some publish more than gTLDs do. Some publish almost nothing. Several restrict registration to residents or registered businesses, which means the registrant is at least verifiable even when it is not public. A few operate their own lookup service with terms that differ from the general RDAP rules.
If you are researching a ccTLD, check the registry's own lookup page rather than assuming the gTLD rules apply.
When the record gives you nothing
There are legitimate ways to piece together a picture from public infrastructure data, and they are the ones professionals use.
- Certificate Transparency logs record every TLS certificate issued for a domain, and certificates often name an organisation. These logs are public by design.
- Mail records reveal the email provider, and a self-hosted mail domain often names the company running it.
- Reverse lookups on an IP or nameserver can reveal other domains held by the same operator, which sometimes includes one that is not redacted.
- Trademark databases are the right tool when the domain matches a brand, and they list a real legal entity with an address.
- Archived copies of the site from before it went dark frequently carry the contact page that no longer exists.
What not to do
Do not buy scraped registrant databases. The data is stale, its provenance is usually unlawful, and using it to contact people creates a GDPR problem that is now yours rather than the seller's.
Do not treat a redacted record as an obstacle to route around. It reflects a deliberate legal position, and the anonymised relay exists precisely so that legitimate enquiries have a path.
And do not read availability as permission. A name being registrable says nothing about whether you can trade under it. That is a trademark question, and the two are entirely separate.
The practical sequence
- Run the domain through a lookup that shows status codes and dates.
- Read the nameservers. Parked or brokered means it is probably for sale.
- Read the dates. Old and long-renewed means a hard sell. New with marketplace nameservers means inventory.
- If it resolves, use the website's own contact route.
- If it does not, use the registrar's anonymised relay.
- If the name genuinely matters to your business, hire a broker and stay anonymous.
And if the answer turns out to be that the owner will never sell, that is a real answer too. Generating alternatives from the concept rather than the word is usually faster than a negotiation you are going to lose.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain