WHOIS hides the owner's name, but not the domain's age, status or name servers. Here's what GDPR changed and how to read the fields that still tell you something.

You look up a domain expecting a name, an email, and an address. What you get is this:

Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Email: Please query the RDDS service of the Registrar of Record

Nothing is broken. This is what nearly every WHOIS record looks like now, and it has been that way since 2018.

The useful part is that the fields which were hidden were rarely the ones worth reading. What remains tells you more about a domain than the owner’s name ever did.

What Changed in 2018

WHOIS was built in an era when publishing the contact details of everyone who registered a domain seemed reasonable. Those records were fully public — name, postal address, phone number, email — and anyone could query them.

When the General Data Protection Regulation took effect in May 2018, that stopped being legal for anyone handling data belonging to people in the EU. Rather than maintain two systems, most registrars redacted personal data for everyone, regardless of where the registrant lived.

ICANN formalised this through what was initially called the Temporary Specification, and the redaction became the default across the industry.

What you’ll see in place of the data

Different registrars word it differently, which is why the same lookup can look inconsistent across domains:

• REDACTED FOR PRIVACY
• Data Protected
• Not Disclosed
• GDPR Masked
• Statutory Masking Enabled
• Please query the RDDS service of the Registrar of Record

These all mean the same thing. None of them indicates a problem with the domain.

Privacy services are a separate thing

Redaction is automatic. Privacy services are a product the registrant pays for — or gets bundled free — and they replace the owner’s details with the service’s own:

• Domains By Proxy, LLC
• Withheld for Privacy ehf
• Privacy Protect, LLC
• Contact Privacy Inc.

The difference matters when you’re assessing a domain. Redaction applies to everyone. A privacy service was a deliberate choice — though an extremely common one, and not suspicious on its own. Plenty of ordinary businesses use them to avoid spam.

What Is Still Public — and Why It’s the Useful Part

None of the following is redacted on any gTLD:

• Creation date — when the domain was first registered
• Expiry date — when the current registration ends
• Updated date — when the record last changed
• Registrar — the company the domain is registered through
• Name servers — where the DNS is hosted
• Domain status codes — the domain’s current state
• DNSSEC — whether it is signed

Creation date is the single most useful field

For judging whether a domain is trustworthy, the registration date beats everything the redaction removed.

An invoice arriving from a company founded in 2003, sent from a domain registered eleven days ago, is answered. A “bank security alert” from a domain created last month is answered. You did not need the registrant’s name to know that.

Phishing and fraud domains are overwhelmingly new, because they get taken down and replaced constantly. A domain registered six years ago with a consistent history is a fundamentally different proposition from one registered last Tuesday, whoever owns either of them.

Name servers tell you who actually runs it

The name servers show which DNS provider — and often which host — the domain uses. A domain claiming to be a large institution while running on free DNS from a bulk provider is telling you something.

To see what those name servers are actually returning, a DNS lookup gives you the records themselves rather than just the delegation.

Updated date is quietly informative

A domain whose record changed yesterday may have just moved registrar, changed name servers, or been renewed. In combination with a recent creation date, a very recently updated record is worth noticing.

Reading Domain Status Codes

These are EPP status codes, and they are the most misread part of a WHOIS record. They describe the domain’s state, not its reputation.

Normal, healthy states:

• ok or active — nothing unusual
• clientTransferProhibited — a transfer lock set by the registrar. This is the default on most domains and is a good sign, not a bad one. It prevents unauthorised transfers
• clientUpdateProhibited, clientDeleteProhibited — similar protective locks

States that mean something is wrong:

• clientHold or serverHold — the domain has been removed from the zone. It will not resolve at all. Usually non-payment, sometimes an abuse complaint
• redemptionPeriod — the domain expired and was deleted, but the former owner can still restore it, typically for 30 days at a steep fee
• pendingDelete — the redemption window closed. The domain will be released and become available to anyone, usually within five days
• serverTransferProhibited — a lock set by the registry rather than the registrar, often during a dispute

If a site has stopped resolving and the WHOIS shows clientHold, you have found your answer and no amount of DNS troubleshooting will help. Confirm with a DNS lookup — a domain on hold returns NXDOMAIN, which looks identical to a domain that never existed.

When You Genuinely Need to Reach the Owner

Redaction removed the shortcut, not the route.

The registrar’s contact form. Most registrars forward messages to the registrant without disclosing the address. The registrar name is still in the WHOIS record, so you can always find out where to ask.

The website itself. Many domains publish contact details on the site, in a privacy policy, or in a terms page. For a business, this is often legally required.

RDAP. The Registration Data Access Protocol is WHOIS’s structured replacement. It returns JSON instead of free text and supports tiered access — meaning accredited parties with a legitimate purpose can obtain data that an anonymous query cannot. RDAP is gradually becoming the standard and WHOIS the legacy interface.

Formal processes. Trademark disputes go through UDRP. Law enforcement and courts have their own routes. Abuse reports go to the registrar’s abuse contact, which is still published.

Country Domains Follow Their Own Rules

ccTLDs are run by national registries and were never bound by the same specification, so they vary widely:

• .pk — managed by PKNIC, with its own policies and its own WHOIS server
• .uk — Nominet hides individual registrants’ addresses but publishes those of businesses
• .de — DENIC publishes almost nothing through WHOIS
• .ca — CIRA redacts individuals, publishes organisations
• .eu — minimal data, by design

If a lookup returns almost nothing for a ccTLD, that is usually the registry’s policy rather than a fault.

When a Lookup Returns Nothing at All

Distinguish these three outcomes, because they mean different things:

• No match for domain — the domain is not registered. It is available, or you have a typo
• Redacted fields but a complete record — the domain exists and is registered; only personal data is hidden
• No response or a timeout — the registry’s WHOIS server did not answer. Try again; this says nothing about the domain

A WHOIS lookup returns the raw record along with the parsed fields, which makes the difference between these three obvious at a glance.

Frequently Asked Questions

Why does WHOIS say REDACTED FOR PRIVACY?

Because of GDPR. Since 2018, registrars have hidden registrant contact details by default. It applies to nearly every domain and indicates nothing about the domain itself.

Can I find out who owns a domain?

Not from a public lookup, in most cases. You can contact the owner through the registrar, check the website for published contact details, or use a formal process such as UDRP or a law enforcement request where one applies.

Is a domain with privacy protection suspicious?

No. Privacy services are standard and widely used by ordinary businesses to avoid spam and unsolicited offers. Judge the domain by its age, its status codes, and its name servers instead.

What does clientTransferProhibited mean?

It is a transfer lock, and it is the normal state for most domains. It prevents the domain from being moved to another registrar without authorisation. Its presence is reassuring, not concerning.

My domain expired — can I still get it back?

If the status shows redemptionPeriod, usually yes, through your registrar, at a restoration fee considerably higher than a renewal. Once it shows pendingDelete, the window has closed, and the domain will be released publicly.

Is WHOIS being replaced?

Yes, by RDAP, which returns structured data and supports differentiated access levels. WHOIS still works and will for some time, but RDAP is where registries are heading.

The Short Version

The fields redaction removed were rarely the useful ones. Creation date tells you whether a domain is eleven days or eleven years old, which answers most trust questions on its own; status codes tell you whether it is locked, on hold, or about to be deleted; name servers tell you who actually runs it. If you need the owner, the registrar still forwards mail — you just no longer get the address for free.