Domain Privacy and WHOIS: What Is Public and What Should You Hide
WHOIS and RDAP records list who registered a domain. Learn what is public today, how privacy services work and why your contact details must still be accurate.
When you register a domain, you must give contact details: your name, an address, a phone number and an email address. Traditionally these were published openly in a public database called WHOIS. That made it easy for spammers, scammers and competitors to collect your details. Today the picture is more nuanced. This article explains what is public, what privacy services do and what you should still keep accurate.
What WHOIS and RDAP are
WHOIS is a long-standing system for looking up the registration data of a domain. RDAP, the Registration Data Access Protocol, is a newer, more structured replacement that is gradually taking over. For ordinary users the difference is small: both let anyone look up a domain and see registration information, subject to the rules of the registry.
A lookup typically shows:
- The registrar and the registration and expiry dates.
- The name servers.
- Status flags such as whether the domain is locked against transfer.
- Contact information for the registrant, administrator and technical contacts, where it is published.
What changed with privacy law
Since European data protection rules came into force in 2018, many registrars and registries redact personal data from public lookups by default. In practice, you will often see "redacted for privacy" in place of a name and email for individual registrants. The details still depend on the extension and the registrar. Some country-code registries publish less or more than others, and the treatment of business registrants can differ from individuals. Do not assume that your details are hidden. Look up your own domain and see.
What a privacy service does
A domain privacy service, sometimes called a proxy service, places its own details in the public record in place of yours, often with a forwarding email address. Messages sent to that address can be passed on to you. Some registrars include this free, and others charge a small yearly fee. The benefits:
- Less spam and fewer unsolicited sales calls.
- Less exposure of a home address, if you work from home.
- A barrier against some forms of social engineering.
Limits: the registrar still has your real details, and they may be released in response to valid legal requests or in some disputes. Privacy does not make you anonymous.
Why accurate details still matter
| Detail | Why it must be right |
|---|---|
| Registrant email | Receives verification and renewal notices; failing to verify can lead to suspension |
| Registrant name | Proves ownership if you must recover or transfer the domain |
| Phone and address | Needed by some registries and for legal notices |
| Technical contact | Used by some services for validation |
Registrars are required to verify the registrant's email address when a domain is registered or when the contact details change. If you ignore the verification message, the domain can be suspended after a deadline, which takes your website and email offline. Make sure the email goes to a mailbox you check and that does not depend on the domain itself.
Business versus personal details
Use the company's legal name as registrant for a business domain, not an individual employee. That way, ownership stays with the business if the person who registered it leaves. Use a shared role mailbox for contacts, and keep a record of the account owner and who can approve changes.
Practical steps
- Look up your own domain with a WHOIS or RDAP lookup tool and see what is shown.
- If personal details are visible and you do not want that, turn on privacy at your registrar, or choose a registrar where redaction is included.
- Check that the registrant details behind the privacy layer are correct.
- Whitelist your registrar's emails in your spam filters.
- Review the information whenever your company name, address or email changes.
Spam and scams that use WHOIS data
Even with redaction, you may receive messages about SEO services, fake renewal notices or offers to buy "similar" domains. Treat unsolicited messages with caution. Check any invoice against your registrar account, and never share your transfer authorisation code with anyone who asks for it by email.
Legal and compliance points
Some countries and extensions require that businesses publish certain details, such as a trading name, on their website or in the registry. Check the rules for your jurisdiction and extension. Privacy services are not a way around disclosure requirements that apply to your business.
Registrar lock and account security
Privacy settings protect information, but the bigger risk is somebody taking control of the account. Use a long, unique password for the registrar login, switch on two-step sign-in, and keep the transfer lock enabled. If your registrar offers extra approval steps for changes to critical settings, use them. Attackers who hijack a registrar account can redirect a website and intercept email, which is a far worse outcome than a public email address in a database.
Domains and hosting with Zebra Hosting
Your domain registration stays with your registrar, and you connect it to Zebra Hosting through nameservers or DNS records. Support in 17 languages can help you check that everything points correctly. For broader protection of your site and accounts, see the security page, or review our hosting options.
