How to Find Out Who Owns a Domain Name: 5 Legal Methods
By Thomas Lovas Lokoy — researched and drafted with AI assistance, then fact-checked and approved by Thomas before publishing · Editorial policy
You usually cannot read a domain owner's name straight off a lookup any more, but you can still learn a great deal about them, and you can almost always reach them. Since ICANN's Registration Data Policy took effect on 21 August 2025, registrars must redact the registrant's name, street address, postcode and phone number wherever data protection law requires it, many do so for every record, and they publish an anonymised email address or a web form in place of the owner's email. What stays public is the registrar, the registration and expiry dates, the status codes, the nameservers, and the registrant's state or province and country. The five methods below start from those public fields and work outwards.
What a lookup shows in 2026, field by field
The policy is specific about what every registrar and registry must publish and what they must hide (sections 9.1 and 9.2 of the Registration Data Policy, read on 16 October 2026). This is the table to keep next to you while you read a record:
| Field | Public? | Why |
|---|---|---|
| Domain name, registrar, registrar IANA ID, creation date, status codes, date of last update | Always | Required in every record |
| Registry expiry date | Always | Required, with narrow exceptions |
| Registrar abuse contact email and phone | Always | Required in every record |
| Nameservers, DNSSEC data | If they exist | Published when collected |
| Registrant state/province and country | Yes | Published |
| Registrant organisation | Only with the registrant's agreement | Optional publication |
| Registrant name, street, postcode, phone, fax | No | Must be redacted where redaction applies |
| Registrant city | Sometimes | The registrar may redact it |
| Registrant email | No | Replaced by an anonymised address or a web form |
Two provisions matter more than the rest. Section 9.2.3 says a registrar that redacts "MUST Publish an email address or a link to a web form to facilitate email communication" with the registrant, and that the address or form "MUST NOT identify the contact email address or the contact itself". So the owner's name is hidden, but a route to the owner is mandatory. And section 9.2.5 says that where a domain uses a privacy or proxy service, the registrar "MUST Publish the full Registration Data of the Privacy or Proxy Service", which is why so many records now name a privacy company rather than a person.
A lookup of this site's own domain over RDAP on 16 October 2026 is a fair example of the normal case: the record returned the registrar's name, a registration date, an expiry date, one status code (clientTransferProhibited), two Cloudflare nameservers, and exactly one contact, the registrar's abuse email and phone. There was no registrant object in the record at all. That is what full redaction looks like, and it is now the default rather than the exception.
Method 1: Run the lookup and read everything that is left
Start with a plain lookup, because the fields that survive redaction answer more questions than people expect. Our WHOIS lookup returns them for any domain, and ICANN's own lookup at lookup.icann.org returns the same record over RDAP, the structured protocol that is replacing the old WHOIS text format.
- Registrar. This is who you will message in Method 2, and who you report abuse to. The IANA ID next to it is the registrar's unique number, useful when two companies trade under similar names.
- Creation date. A domain registered in 2004 and a domain registered last Tuesday are different kinds of counterparty. For a shop you are about to pay, a creation date of a few weeks ago is a reason to pause.
- Expiry date. If you want the name and the owner is not renewing, this is the date the clock starts. How domain backorders work explains what happens after it.
- Status codes. clientTransferProhibited is the normal locked state. clientHold means the registrar has told the registry not to put the domain in the DNS; ICANN's status-code page names legal disputes, non-payment and pending deletion as the usual reasons. redemptionPeriod means the registrar has asked the registry to delete the domain, and the owner has 30 days to restore it. pendingDelete means those 30 days are over. Our WHOIS explainer walks through each code.
- Nameservers. These identify who runs the domain's DNS, which is often the hosting company or a CDN. Nameservers at a registrar's default hosts suggest a small operation; nameservers at a corporate DNS provider suggest an IT department.
- Registrant state and country. Published even when everything else is redacted. It tells you which jurisdiction's law and company registers apply.
Write all of this down before you move on. The later methods are about matching these facts against other public sources.
Method 2: Message the owner through the registrar's relay
This is the method most people skip, and it is the one the rules were written to guarantee. The redacted record carries either an anonymised email address or a link to a web form. A message sent there is forwarded to the registrant's real address. Section 11.1.1 requires the registrar to keep log files that "confirm that a relay of the communication" to the registrant's email address "has occurred", and those logs may not record the sender, the recipient or the content.
Make the message easy to answer. Say who you are, what you want, and how to reply. If you are enquiring about buying the name, do not open with a number; how to buy a domain that is taken covers how to approach an owner without inflating your own price. If you are reporting phishing or fraud, use the registrar's abuse contact instead. It is published in every record precisely so that you do not need the owner's identity to report the owner's domain.
Give a relay message a couple of weeks. Many registrants ignore the relay address because it also collects spam, so a second message, or a letter to a company found through Method 5, is reasonable.
Method 3: Reverse WHOIS and historical records
A reverse WHOIS search runs the lookup backwards: instead of asking "who holds this domain", it asks "which domains share this email address, name or organisation". It works where the data was ever public. Three cases still produce results:
- Organisations. The registrant organisation field may be published when the registrant agrees, and a company that wants to be found often does agree. Where it is published, searching on it lists the company's other domains.
- Older records. Historical archives of registration data from before 2018 frequently carry the registrant's name and address. If the domain has been held by the same owner for a long time, an archived record from its early years may still name them.
- Country-code registries. ICANN's policy covers generic extensions such as .com; each country-code registry sets its own publication rules, and some publish the name of an organisation that holds a domain. Check the registry's own lookup and policy before assuming a ccTLD record is redacted.
Our reverse WHOIS tool accepts an email address, a name, a company name or an organisation number, and a single historical match can turn a redacted record into a named owner.
Method 4: Certificate Transparency logs
Every TLS certificate issued by a publicly trusted authority is recorded in public Certificate Transparency logs, and crt.sh lets you search them by domain. A query returns one row per certificate with the certificate's validity dates, its Common Name, its Matching Identities, and the issuing authority.
Read the results for three things:
- Other hostnames on the same certificate. The Matching Identities column lists every name a certificate covers. A certificate that covers the domain you are researching and three other brands was requested by one operator for all four.
- The issuer. A certificate from a CDN's default authority, issued automatically, tells you the site sits behind that CDN. A certificate bought from a commercial authority tells you someone paid for it.
- An organisation name, but only on some certificates. Domain-validated certificates, the type issued free by Let's Encrypt and by most hosting control panels, contain no organisation at all. Organisation-validated and extended-validation certificates do, and the authority has verified it against a legal entity. Open the certificate detail and look at the Subject; if there is an O= value, you have a verified company name.
Do not read more into the logs than is there. A certificate proves who controlled the hostname when it was issued, not who owns the registration today.
Method 5: DNS records, the website itself and the public registers
The registration record is one source among several, and the others are often more revealing.
- MX records name the mail provider. A domain whose mail runs through a corporate mail service is run by an organisation; a domain whose MX points at the registrar's own mail is probably run by one person.
- TXT records carry SPF entries that list every service allowed to send mail for the domain, plus verification tokens for services the operator has connected. They do not name a person, but they describe the operation.
- The site's own legal pages. Terms, privacy policies and contact pages routinely name the company, its registration number and its address, because several jurisdictions require a commercial site to carry a legal notice identifying its operator. Germany's Impressum requirement is the best known, and many European sites carry one even when they do not have to.
- Company registers. A company name or registration number from the site, combined with the registrant country from the lookup, takes you to the national register: Companies House in the United Kingdom, the Brønnøysund Register Centre in Norway, EDGAR for public companies in the United States, and the equivalent in every other country. Aggregators such as OpenCorporates search many registers at once.
- Trademark databases. If the domain is a brand, the brand is usually registered. The WIPO Global Brand Database, EUIPO and USPTO searches are free and name the owner of the mark.
- The Wayback Machine. Earlier versions of the site, saved at web.archive.org, may carry an owner's name from before a redesign removed it.
When the owner will not answer
Each reason for wanting the owner has its own fallback:
- You want to buy the name. If it is expiring, a backorder is the route; if it is renewing, a broker or a direct offer is. How to buy a domain that is taken covers both.
- You have trademark rights in the name. You do not need the registrant's identity to start a UDRP case. WIPO's Q&A on registrant data and the UDRP explains that it asks the registrar to confirm the underlying registrant's contact details after a complaint is filed, and the complainant can then amend the complaint. UDRP disputes explained sets out what you have to prove.
- The domain is being used against you. Report it to the registrar's abuse contact and to the hosting provider identified by the nameservers and the site's IP address. Both are public.
- You need the identity for a legal process. Every registrar must link from its homepage to its process for disclosure requests (section 10.1). ICANN updated the policy page on 12 May 2026 with deadlines for urgent requests from authenticated law-enforcement and similar authorities, limited to threats such as an imminent threat to life: acknowledgement within two hours and a response within 24 hours, absent exceptional circumstances (section 10.7). For everyone else this is a job for a lawyer, not a lookup tool.
What you must not do
The public parts of the record are public, and reading them is lawful everywhere we are aware of. Three things are not: scraping registration data in bulk against the registrar's terms, contacting a registrar's support desk while pretending to be the owner, and harvesting relay addresses to send unsolicited mail. The second of those is also the most common way domains get stolen, which is why protecting a domain from hijacking is worth reading from the owner's side too.
Where to go next
Run the WHOIS lookup first and the reverse WHOIS search second. If the reason you are looking is that your own details are in a record somewhere, WHOIS privacy explained covers what redaction and privacy services each do, and what neither of them does.
Frequently asked questions
Can I find out who owns a domain for free?
Yes. A WHOIS or RDAP lookup is free and shows the registrar, the registration and expiry dates, the status codes, the nameservers and the registrant's state and country. The owner's name is usually redacted, but where it is, the record carries a free way to message them: an anonymised email address or a web form that the registrar must publish.
Why does the record say "REDACTED FOR PRIVACY" or name a privacy company?
Since 21 August 2025, ICANN's Registration Data Policy requires registrars to redact the registrant's name, street address, postcode and phone number where data protection law applies, and allows them to redact more widely for "a commercially reasonable purpose", so many apply it to every record. Where the owner used a privacy or proxy service, the policy requires the service's own details to be published instead, so the record names the service rather than the person.
How do I contact a domain owner whose details are private?
Use the relay the registrar is required to publish: an anonymised email address or a web form link in the record. Messages sent there are forwarded to the registrant, and the registrar must keep a log confirming that the relay happened. For abuse reports, use the registrar's abuse contact, which is published in every record.
Can I find out who owned a domain in the past?
Often. Historical registration records from before 2018 frequently name the registrant, and a reverse WHOIS search on a name, email address or organisation finds the domains that shared it. The Wayback Machine may also hold earlier versions of the site that named its operator.
Is a WHOIS lookup legal?
Reading the published record is lawful and is what the record exists for. Scraping it in bulk against the registrar's terms, impersonating the owner to a registrar, or using relay addresses for unsolicited mail is not.
Sources
Last updated:
