Domain Privacy and WHOIS: What Gets Published
When you register a domain name, you must provide contact details: name, address, phone number, and email. Historically, these were published in a public directory called WHOIS. That exposed many website owners to spam and scams. Things have changed, but it's worth knowing what's visible and what's not.
What WHOIS is
WHOIS is a system for looking up information about who registered a domain. Registries and registrars maintain the data. Anyone could look up a domain and see its registrant details, registration dates, expiry date, and nameservers.
A newer protocol called RDAP is gradually replacing WHOIS with a more structured and controllable system, but people still commonly use the term WHOIS.
What's visible now
Since privacy laws such as the GDPR took effect in 2018, many registrars redact personal data in public records by default. You will often see only the registrar, dates, nameservers, and a generic contact method. What's displayed varies by registrar, domain extension, and country. Some country-code domains publish more or less than generic ones. Registrations for businesses can still show organizational details in some cases.
Domain privacy services
Many registrars offer a "privacy" or "proxy" service. It replaces your personal details in the public record with the service's contact information, and forwards messages to you. Some include it for free, others charge.
Benefits
- Reduces spam, junk mail, and unsolicited sales calls
- Keeps your home address and phone number out of public view
- Makes it harder for scammers to target you with convincing, personalized messages
Limitations
- It doesn't hide anything from the registrar, which holds your real details
- Authorities and courts can still obtain them through legal process
- Some domain extensions don't allow privacy services
- Forwarded email can occasionally be missed, including important notices. Make sure you can receive them
You must still provide accurate information
Domain rules require registrants to give accurate contact details, and the registrar may contact you to verify an email address. Providing false information can put your domain at risk of suspension. Respond to verification emails, because ignoring them can lead to your domain being suspended.
Choose your contact details carefully
- Use a role-based email such as domains@yourbusiness.com, or a separate address that more than one person can access, so you don't lose control if one person leaves. Don't use an address that depends on the domain itself, because it will stop working if the domain stops
- Use a business address if you have one, rather than a home address
- Keep details up to date so renewal notices and transfer approvals reach you. See how to transfer a domain name
Scams to watch for
People with public domain details often receive fake invoices for "domain renewals" or "search engine submission," and messages claiming your domain is about to expire or that someone wants to buy a similar domain. Check renewals only through your registrar's account. Don't pay unfamiliar invoices. See how to keep your website secure.
Ownership matters more than privacy
The name listed as registrant is generally the legal owner of the domain. If your web designer registered it under their name, you may not own it. Make sure you are the registrant. See who owns your website and accounts.
Privacy law and your site
Domain privacy protects your own registration data, which is separate from visitors' data. For how you handle visitors' personal information, see privacy policy and cookie banner basics and GDPR and your website.
Secure your account
Use two-factor authentication on your registrar account and enable registrar lock. See password managers for small teams.
The bottom line
Use privacy protection if offered, keep your real contact details accurate, use a shared business email, and make sure you're the registrant. Beware renewal scams.