How to Find Who Owns a Domain When WHOIS Says Redacted

For most generic domains you can no longer see who owns them, and no lookup tool will magic that back into view. What you can see is the registrar, the dates, the nameservers and the status codes. What you can do is send a message through a relay form, report abuse to the registrar, or ask the registrar to disclose the hidden data if you have a legitimate reason. This post covers each route, what it really returns, and the order to try them in, from free and public to formal. And it says plainly where the routes stop working.

The short answer

Run the domain through an RDAP tool. ICANN's own is at lookup.icann.org, and if you'd rather stay on this site, the HostList WHOIS lookup shows the same kind of record. You will always get the registrar, the creation and expiry dates, the nameservers and the status. You will usually not get the owner's name or email, which is the part most people came looking for.

So how do you reach them? Two ways. Use the registrar's relay email or web form, or the privacy service's contact form if one is in use. Both pass your message along without revealing who receives it.

Getting the hidden data itself is a different thing. That takes a legitimate reason and a disclosure request to the registrar, and the registrar decides. Curiosity doesn't count, and neither does wanting to make an offer, however serious that offer may be.

Why WHOIS says "redacted" now

Two changes stacked up. First, the protocol. As of 28 January 2025, RDAP is the definitive source for gTLD registration data, in place of sunsetted WHOIS services. Registrars and gTLDs have offered RDAP since 2019, so this wasn't a surprise to anyone in the industry. ICANN's old whois.icann.org now redirects to its registration data lookup tool, which uses the RDAP services of registrars and registry operators. A WHOIS fallback only appears (behind a captcha) when the RDAP service is down. If you still call the whole thing a WHOIS lookup, fine, everyone does. But know what's underneath.

Second, the policy. ICANN's Registration Data Policy took effect on 21 August 2025 and applies to every ICANN-accredited registrar and every gTLD registry operator with an ICANN agreement. It lists the registrant name, street, city, phone and email as fields published subject to its redaction rules (section 9.2). Where redaction is needed to comply with applicable law, registrars and registries must apply those rules. Where they have a commercially reasonable purpose, they may apply them anyway. Put those two together and redaction becomes the normal state of things rather than the awkward exception.

The registrar is also required to give you a way to reach the registrant. Where it redacts the registrant email, the policy says it must publish an email address or a link to a web form that reaches the contact without identifying them. That is usually the practical door, not a side note.

Privacy and proxy services are a separate layer

Some owners pay for a privacy or proxy service on top. ICANN's RDRS FAQ draws a line between the two. For a privacy service, the registrar publishes the service's alternative contact details, while the registrant's identity may show as redacted and stays subject to disclosure requirements. For a proxy service, the registrar publishes the service's full registration data, unredacted. In both cases the name in the record belongs to the service. "Contact Privacy Inc." is the example you'll meet on Tucows-family registrars such as Hover.

One thing worth knowing: redaction isn't always total. If the registrant agrees, the registrar must publish the organisation name, so company-owned domains often show more than personal ones.

What a lookup still tells you

Don't dismiss a redacted record. ICANN's lookup FAQ lists what comes back, and most of it is useful:

• Domain status codes
• Nameservers
• Created, updated and expiry dates, as applicable
• The sponsoring registrar's name and IANA ID
• The registrar's abuse email and phone
• A reseller name and organisation, if one was involved (it may appear)
• DNSSEC information

The FAQ also says some data may be visible only to people who have shown a legitimate and proportionate purpose and been approved. If something is hidden, you should see a remark or a redacted label saying so. That label is telling you data exists. It isn't telling you the data has vanished.

Turning those fields into leads

The registrar tells you who to ask. That's the most important line in the record, because every route below goes through them (or through the privacy service they use). The creation date tells you how old the domain is, which is handy if you're judging a site's trustworthiness. A domain registered last week deserves a second look before you trust it with a payment. A quick pass through the domain age checker gives you that in seconds.

Nameservers and hosting tell you where the domain lives. Follow up with the hosting checker to see the host, the reverse IP lookup to see what else shares the server, and the DNS checker to read the records themselves. None of this names the owner. But a host with an abuse desk is another place to report to, and a shared server with a known operator can still tell you plenty about who you're dealing with.

If you're after a domain through a particular registrar, the registrar directory is a sensible place to check which company you're actually dealing with. Getting that wrong wastes time before you've even started.

Pick the route by what you want

The right route depends on your reason, not on how determined you are. Here's the decision table.

The last row gets overlooked. A business site often names its company somewhere, and a business register can confirm it. That beats a disclosure request on speed and cost, and it keeps you out of process theatre.

The order to work in

1. Run the domain through the ICANN lookup or the HostList tool and note the registrar, dates, nameservers and any privacy service.
2. Read the site: About page, imprint, contact page, footer, certificate details.
3. Use the free routes that reach the owner: the registrar's relay form or the privacy service's form.
4. If it's abuse, report to the registrar's abuse contact and, if you know it, the host.
5. If it's a trademark issue, stop and speak to a lawyer about UDRP.
6. Only after all that, and only with a legitimate reason, send a formal disclosure request.

This order is a sensible sequence, not a legal requirement. ICANN does ask that you check the lookup tool first before requesting nonpublic data. So start there, even if you already suspect the useful answer sits elsewhere.

Reaching the owner through a privacy service

Hover's help page is the cleanest worked example of the relay route, and the steps are short. Hover's article goes like this:

1. Run a WHOIS lookup and confirm the Registrant Name reads "Contact Privacy Inc." That tells you the contact form will work.
2. Go to contactprivacy.com, enter the domain name and submit.
3. Choose the contact you want to reach from the drop-down (the registrant or admin contact, for instance).
4. Enter your email address and a short, clear subject line.
5. Write the message, tick the captcha and submit.

You'll get an on-screen confirmation that the message went to the contact you picked. After that it's out of your hands. Contact Privacy Inc. only relays the message, and Hover is blunt about it: whether the owner replies is entirely up to them. Vague or spam-like messages are less likely to get an answer, as they should be.

So write for someone who doesn't know you. Say why you're writing and what you want in the first line. "I'd like to ask whether this domain is for sale" beats three paragraphs of preamble. Keep it polite and short. And don't expect a reply within the hour, or at all.

The same logic applies to a registrar's own form when there's no separate privacy service. Different front door, same relay. The form changes, but the constraint does not.

Asking for the hidden data

When the relay gets you nowhere and you have a genuine legal reason, the next step is a disclosure request. Under the Registration Data Policy the registrar must publish how to submit one, so look on their site first. A valid request generally includes:

• Who you are, with your contact details
• Which data you want
• Your legal basis and reason
• A good-faith statement
• Agreement to process the data lawfully

The registrar must acknowledge a request within two business days and respond within 30 calendar days, absent exceptional circumstances. And it decides each one on its merits. That word matters: nobody is promising you the data, only a decision.

A revision dated 12 May 2026 added a response timeline for urgent requests. Those are narrow: the policy's definition covers an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation, made by an authenticated requestor. A domain dispute isn't one, and dressing it up won't help.

ICANN's RDRS

The other route is ICANN's Registration Data Request Service (RDRS). Know what it is and isn't. ICANN's requestor FAQ describes it as a proof of concept ticketing system. Some points to hold on to:

• You need an ICANN account.
• Registrar participation is voluntary. If yours isn't taking part, contact them directly.
• Country-code domains aren't covered.
• Any disclosure happens outside the RDRS, directly between registrar and requestor, and the registrar stays responsible for deciding.
• The service does not guarantee access to registration data.
• It shouldn't be used for official UDRP or URS filings.

Outcomes are Approved, Partially approved, Denied, Data publicly available, or Canceled. If you disagree with a decision, ICANN won't reexamine it, though you can complain to ICANN Contractual Compliance if the response didn't meet the disclosure requirements. That is a narrow complaint route, not an appeal in disguise.

And who is it for? ICANN names law enforcement, intellectual property professionals, consumer protection advocates, cybersecurity professionals and government officials. A buyer wanting a nice .com isn't on that list. Sales enquiries and curiosity go through the relay form, not here.

Country-code domains play by other rules

A .uk, .de or .io domain isn't a gTLD, so ICANN's policy and RDRS don't govern it. Each registry sets its own rules about what it publishes and who can ask for more. The RDRS FAQ says that for a ccTLD you should contact the relevant ccTLD operator. So go to that registry's own lookup and read its policy page. What you see there can differ a lot from the gTLD pattern, and ICANN's lookup may not show it at all.

What not to do

Don't pay a site that promises to "unmask" a redacted owner. If the registrant data is legally hidden, a paid lookup isn't going to show you something the official routes won't, and you can't tell where the data came from. I won't advise ways round redaction, and neither should any guide that wants you to stay on the right side of privacy law.

Don't send threats through a relay form. It's a message to a stranger via a middleman, and a hostile one gets ignored (or forwarded to a lawyer). If you have a legal grievance, use the proper process. The relay is for contact, not intimidation.

If the contact data you do see looks fake, ICANN takes complaints. The lookup FAQ points to its domain name registration data inaccuracy complaint form, which goes to ICANN Contractual Compliance. Hidden data is legal. False data isn't, and that distinction is not optional.

Frequently Asked Questions

Can I find out who owns a domain for free?

You can find out who the registrar is, when the domain was created and where it's hosted, all free. The owner's name is a different matter. For most gTLDs it's redacted, so free routes mean the relay form, the site's own pages, or a business register. That is still useful work, just not the same as disclosure.

Why does WHOIS say "redacted for privacy"?

Because the Registration Data Policy requires registrars and registries to redact personal data where the law demands it, and lets them do so for a commercially reasonable purpose. A privacy service on top will show its own details instead. So the absence of a person’s name is usually the system working, not a broken lookup.

Is WHOIS still a thing?

In name, yes. In practice, for gTLDs, RDAP has been the definitive source since 28 January 2025. Most tools still call themselves WHOIS lookups, and ICANN's old whois.icann.org redirects to its RDAP tool. The label has lingered longer than the plumbing.

Can I find the owner of a .uk or other country domain?

Check the registry's own lookup and rules. ICANN's policy doesn't cover country codes, and the RDRS doesn't either.

How long does a disclosure request take?

The registrar must acknowledge within two business days and respond within 30 calendar days, barring exceptional circumstances. The answer could still be no. A deadline is not the same thing as entitlement.

The single most useful fact: for most domains you won't see the owner, but the registrar field is never redacted, and that company is your route to them, whether by relay form, abuse report or formal request. The sharpest caveat is that the registrar decides every disclosure, so a good reason improves your chances but guarantees nothing.