generatepassword.eu

WHOIS vs RDAP: how to find who owns a domain after the GDPR

5 min read · Published · Password and DNS Toolbox

Short answer

Look the domain up with an RDAP/WHOIS lookup: it shows the registrar, dates, status and name servers. The owner's personal details are usually redacted because of the GDPR. To reach the owner, use the registrar's contact form or abuse address shown in the result; for legal matters, registrars can disclose data on a legitimate request.

Key points

  • ICANN retired WHOIS requirements for gTLDs on 28 January 2025; RDAP is now the definitive source.
  • Personal registrant data is redacted by default since 2018.
  • Registrar abuse contacts and disclosure requests are the legitimate routes.

From WHOIS to RDAP

WHOIS is a 1980s text protocol on port 43 with no standard format. RDAP (Registration Data Access Protocol) replaces it with structured JSON over HTTPS, standard error codes and support for access control. ICANN made RDAP the definitive source for generic top-level domains (.com, .org, .net and hundreds more) and ended the WHOIS requirement on 28 January 2025.

Country-code domains follow their own registries' rules. DENIC offers RDAP for .de; some, such as .eu, still rely on classic WHOIS. Our WHOIS lookup uses RDAP where available and falls back to WHOIS automatically.

Why you see "REDACTED"

Since the GDPR took effect in May 2018, registries and registrars no longer publish personal contact data by default. You will usually still see the registrar, creation and expiry dates, status codes, name servers and sometimes the registrant's country or organisation.

Legitimate ways to reach a domain owner

  • Registrar contact form or relay e-mail — many registrars forward messages to the holder.
  • Abuse contact — for phishing, malware or spam, report to the registrar's abuse address shown in the lookup, and to the hosting provider (find it with the IP WHOIS lookup).
  • Disclosure requests — lawyers and authorities can request redacted data from the registrar with a legitimate interest.
  • The website itself — an imprint or contact page (required for commercial sites in Germany and Austria).

What the public data is still good for

  • Domain age — brand-new domains in suspicious e-mails are a phishing signal.
  • Expiry date — monitor your own domains so they never lapse.
  • Status codes — clientTransferProhibited protects against hijacking; clientHold explains a domain that suddenly stopped resolving.
  • Name servers — show which DNS provider hosts the domain; check the records with the DNS lookup.

Frequently asked questions

Is WHOIS dead?

For gTLDs, registries are no longer required to run WHOIS; RDAP is the authoritative source. Many country-code registries still run WHOIS.

Can I see who owned a domain in the past?

Only through commercial historical WHOIS databases; registries show current data.

Is it legal to look up a domain?

Yes. Registry terms typically forbid using the data for marketing or bulk collection.

Sources