How to Find Who Owns a Domain

To find who owns a domain, run a WHOIS or RDAP lookup as your first step. That single query returns the registrar, the registration and expiry dates, the name servers, and, when the owner has not enabled privacy protection, a name, organization, email address, and mailing address. If you have never run one before, the pillar guide on WHOIS explained walks through the format and what each line means.

The catch is that most records today are redacted, so the contact fields read "REDACTED FOR PRIVACY" or point to a proxy service rather than a person. That does not mean the trail ends. Plenty of useful data stays visible even on a private record, there is now an official channel for requesting the hidden fields, and several indirect routes reach the actual owner. This guide covers all three, in the order you should try them.

Step 1: run a WHOIS or RDAP lookup

WHOIS is the original protocol for querying domain registration data, defined in RFC 3912. RDAP, the Registration Data Access Protocol, is its modern successor and returns structured JSON instead of free-form text. Both answer the same question: who registered this name, and through whom.

The fastest neutral starting point is ICANN's official lookup, which queries authoritative registry and registrar data directly. You can also run the domain through the tool at the root of this site.

If you prefer the command line, WHOIS is one line:

whois example.com

RDAP is worth learning because it is explicit about which fields exist and which were withheld. To find the right RDAP server for a given TLD, use IANA's bootstrap registry, the mechanism specified in RFC 9224:

curl -s https://data.iana.org/rdap/dns.json
curl -s https://rdap.verisign.com/com/v1/domain/example.com

The JSON response carries an events array with the registration, expiration, and last-changed dates, a status array holding the EPP status codes, an entities array for whichever contacts are disclosed, and a nameservers array. The structure is defined in RFC 9083. For a line-by-line tour of the output, read how to read a WHOIS record.

Step 2: read what is still visible

Privacy protection hides personal contact fields. It rarely hides operational data, and that data is often enough to make progress.

Field	Usually visible when redacted?	Why it helps
Registrar	Yes	Tells you which company to contact for relay
Creation date	Yes	Shows how long the owner has held the name
Expiry date	Yes	Hints at whether the name may soon drop
Name servers	Yes	Reveals the DNS or hosting provider
Domain status codes	Yes	Shows locks, pending transfers, and disputes
Organization	Sometimes	Company names are often published; personal names are not
Country	Frequently	Narrows jurisdiction for any formal route
Registrant name and email	No, replaced by a proxy	Personal data is masked

The registrar and name servers matter most. The registrar is your channel for relaying a message, and the name servers frequently point to a host or platform that can confirm an active operator. Organization is the quiet win: because redaction targets personal data rather than company data, a corporately held domain often names its owner outright even on an otherwise private record. If you want the full reasoning behind which fields disappear, see why is WHOIS data redacted.

Step 3: request the hidden fields through RDRS

If the operational data is not enough, there is now a formal route that did not exist a few years ago. ICANN's Registration Data Request Service gives you one interface that forwards disclosure requests to participating registrars, with templates, document upload, and status tracking, instead of chasing each registrar separately.

You need a legitimate interest, and you should be realistic about the odds. Across the two-year pilot that ran to 30 November 2025, ICANN reported more than 3,700 disclosure requests, of which 26 percent were approved, 55 percent were denied, and 19 percent were partially approved or concerned data that was already public. Denial is the most likely single outcome, so the strength of your stated interest does more work than the speed of your filing.

On timing, registrars must respond without undue delay and, absent exceptional circumstances, within 30 calendar days of acknowledging the request. Curiosity will not clear the bar; a legal claim, trademark enforcement, fraud investigation, or a security incident tied to the domain might.

Step 4: reach the owner indirectly

Most people asking who owns a domain want to send a message rather than obtain a legal identity. These routes do that without any disclosure request.

1. Registrar relay. Most registrars publish an abuse or owner-contact form. You submit a message and they forward it to the registrant without exposing the address. Spam and trademark complaints usually have dedicated channels.
2. The domain's own website. If a live site sits on the domain, its contact page, about page, or footer often names the operator directly. The simplest answer is frequently on the homepage.
3. The proxy's forwarding address. Records under a privacy service usually list a forwarding email or a unique alias at the proxy's own domain. Mail sent there is passed along by the provider.
4. RDAP entities. When a WHOIS display strips a field, the raw RDAP response sometimes still carries an abuse or technical contact in its entities array. Query it directly and read the full JSON rather than a rendered summary.
5. Formal legal routes. For trademark disputes, an ICANN UDRP filing can compel disclosure. For litigation, a subpoena to the registrar obtains the underlying registrant data.

If the domain is one you want to buy

A large share of ownership lookups are really purchase enquiries, and the approach differs. Check whether the name is already listed on a marketplace before you write to anyone, since a listed domain has a price and a process attached. Look at the expiry date you pulled in step one: a name close to expiry may drop rather than need buying, though valuable names are usually renewed. If the record is redacted and no site is live, the registrar relay is your realistic channel, and a specific offer tends to get answered where a vague "is this for sale?" does not. Brokers exist for high-value names and will handle anonymity on both sides.

Country-code domains work differently

ICANN's registration data rules bind accredited registrars and generic top-level domain registries, which covers .com, .org, .net, .app and the rest of the gTLD space. Country-code registries sit outside that contractual reach and set their own policies. Nominet publishes different fields for .uk than DENIC does for .de, some ccTLDs run their own dedicated WHOIS service rather than appearing in the usual tools, and a few withhold almost everything. If a lookup returns thin or oddly formatted output, check the registry's own service before concluding the data is hidden.

Historical and reverse lookups

Two techniques come up often and both deserve honesty about their limits. Historical WHOIS archives can show pre-2018 records, when personal details were routinely public, which occasionally identifies a long-term holder that current redaction masks. Reverse WHOIS searches for other domains sharing a registrant detail. Neither is available from the free official tools; both are commercial products from third-party vendors, their coverage is uneven, and archived data may be years out of date. Treat what they return as a lead to confirm rather than as proof of present ownership.

A note on intent

Looking up ownership and reaching out is legitimate. People buy domains from each other constantly, report abuse, resolve trademark conflicts, and pitch partnerships. Keep the contact relevant and avoid bulk or automated outreach, since anti-spam rules apply to anything you collect. Treat a redacted record as a privacy choice to respect rather than a wall to climb over.

For more on why so many records hide personal data, see WHOIS privacy explained and why is WHOIS data redacted. To interpret every line of a raw result, read how to read a WHOIS record.

Run a lookup now

Curious who is behind a specific name? Run a free WHOIS lookup from the home page and see the registrar, dates, name servers, status codes, and any public contact details in seconds.