How to Find Who Owns a Domain Name in 2026, Even Behind WHOIS Privacy

You can find who owns a domain by running a free RDAP lookup and checking the registrant — the person or company that legally holds the name. RDAP — the Registration Data Access Protocol, successor to the older WHOIS text service — became the definitive source for .com and other generic domains on 28 January 2025. If the registrant field says REDACTED FOR PRIVACY, a generic domain's record still lists a contact form or relay email, and the website, its certificate and a formal disclosure request can fill the gaps.

Big brands hide too. On 31 October 2026 we pulled the records that registrars — the companies that sell and manage domain names — publish for 20 big-brand domains, and google.com listed its registrant organization as "REDACTED FOR PRIVACY". Apple, Netflix, OpenAI and Wikipedia hid theirs as well, and only 6 of the 19 records that loaded named the company.

Hidden does not mean unreachable. Every one of those 19 records offered a route to the holder. The sections below take each method in the order that works best, from reading the record to filing a legal disclosure request. Later sections cover .uk, .de and .eu names and buying a taken domain.

Author: Sarah Thompson Network Intelligence Analyst

When our team compared the registrar RDAP records of 20 well-known companies on 31 October 2026, one result stood out: the same registrar, MarkMonitor, published "Microsoft Corporation" for microsoft.com yet returned "REDACTED FOR PRIVACY" for google.com. Under ICANN's Registration Data Policy, registrars must publish the organization when the registrant agrees and may redact it otherwise. A hidden name therefore reflects a setting, not the size or honesty of the company.

Here is the limit: no free lookup tool can unmask a hidden domain registrant, and paid history services mostly show what records displayed before the May 2018 privacy changes. Only a formal request, such as a disclosure request through ICANN's free Registration Data Request Service (RDRS), a UDRP complaint or a court order, can make a registrar reveal one. So the first thing to check on any record is its contact link, which all 19 records we could read carried.

What Does a Domain Lookup Show in 2026?

A domain lookup in 2026 still shows the registrar managing the name, plus the creation and expiry dates, status codes, nameservers and an abuse contact. What it usually hides is the person: name, street, phone and email. For generic domains, the registrant organization appears when the holder agreed to publish it, the country always appears, and the state or province appears whenever the registrar collected it.

Those rules come from ICANN's Registration Data Policy, which took effect on 21 August 2025 and replaced the interim rules ICANN wrote after GDPR. Where redaction applies, it tells registrars to remove a registrant's name, street, postal code and phone, and it lets them drop the city too. Registrars must still publish an email address or a web form for reaching the holder.

Two fields deserve a second look before you go further. First, the creation date: a month-old domain that claims to be your bank is one of the clearest warnings you will get when you try to spot a fake website. Second, the nameservers often reveal the hosting or security company the owner pays, and custom ones such as ns1.parentcompany.com can name a parent business outright.

With those fields in mind, the routine below takes a few minutes on any domain, and three real lookups show what it returns.

How Do You Find Who Owns a Domain, Step by Step?

Run the lookup, read who holds the domain, then follow the contact link the record gives you. In practice, that means entering the name in ICANN Lookup or a WHOIS tool, checking the registrant organization and country, and opening the registrar's contact form when the record hides the details. If the record names nobody, move on to the website itself, its certificate and DNS, and finally a written disclosure request.

Follow the same steps if you just want to know how to do a WHOIS lookup in 2026. ICANN Lookup has used RDAP as its primary protocol since July 2019, even though most people still call any registration search a WHOIS lookup.

One trap before you try to find who owns a domain: if the address looks like shop.wixsite.com or login-page.netlify.app, the domain belongs to the platform, not to the person behind the page. Report the page or ask your question through that platform instead.

Here is what steps 1 to 3 returned on 31 October 2026 for three domains: a redacted record, a public one and one that sits behind a privacy service, the three results you will meet most.

Same registrar, opposite answers: microsoft.com shows its owner and google.com does not. Section 3 explains why that split should change how you read a hidden record.

Why Does Even Google's Record Say "REDACTED FOR PRIVACY"?

Most likely because Google never opted in to publication. Since ICANN's Registration Data Policy took effect on 21 August 2025, a registrar must publish the registrant organization when the holder agrees and may hide it otherwise. It must also redact personal data where the law requires it, and it may do so for any commercially reasonable purpose. Because it can apply those defaults to every customer, a missing name says nothing about whether a business is real.

To measure how common that is, on 31 October 2026 we queried the registry and registrar RDAP servers for 20 large company domains. GoDaddy's registrar server returned an error for godaddy.com, which left 19 readable records.

Registrars also mark redaction differently, so learn the three looks. MarkMonitor writes "REDACTED FOR PRIVACY", Cloudflare writes "DATA REDACTED", and Com Laude simply leaves the organization out, as it did for apple.com and adobe.com. An absent organization field means the registrar hid it, not that no company exists.

Not every hidden record works the same way, either. A privacy service — the add-on registrars often sell as WHOIS privacy — publishes substitute contact details while you remain the legal holder. A proxy service goes further: the provider itself becomes the registrant and licenses the name to you.

That REDACTED FOR PRIVACY label traces back to GDPR. ICANN's Temporary Specification, effective 25 May 2018, let registrars hide personal data and allowed them to do so worldwide where that was commercially reasonable. Today GoDaddy applies domain privacy automatically to eligible domains, and Cloudflare Registrar redacts personal data wherever the registry permits; neither help page limits that to European customers.

You can still find who owns a domain with a blank organization field, because the contact link survives redaction. That link is where the next section starts.

How Can You Contact a Domain Owner When WHOIS Is Private?

Use the contact route that the record itself lists. For generic domains, ICANN requires every registrar to publish an email address or a web form for redacted registrants, and that route must not reveal the real address. Look for a contact link in the registrant section, or a Registrant Email line holding a form link or relay address. Write once, briefly, and state your reason; the holder has no duty to reply.

Those routes look different from registrar to registrar. Here is what each one looked like in our 31 October 2026 lookups, plus GoDaddy's format from its own help page.

What to put in the message

• → Who you are, with a real name and a working email address
• → Your reason in one sentence: buying the name, a business inquiry, a legal notice or a security issue
• → A concrete figure if you want to buy, because a number shows you are serious
• → One follow-up at most after a week or two, with no pressure or threats

Why you want to find who owns a domain also decides who you should contact first. Owners can sell or explain, but only hosts and registrars can take a harmful site down.

Sometimes nobody answers the form for weeks. Before you escalate, the website, its certificate and its records can often name the business without anyone replying.

What Can the Website, Its Certificate and DNS Reveal?

Quite a lot, when the business follows the rules. A legal notice or privacy policy often names the operator and its address, an OV or EV certificate carries a verified organization name, and DNS records show which email and business services the domain uses. None of these proves who holds the registration, because an agency or developer may hold it, but together they usually point to the business behind the site.

Legal notices and privacy policies

Start with the footer. In Germany, § 5 of the Digitale-Dienste-Gesetz requires commercial online services to keep their name, address and email easy to find, which is why German sites carry an Impressum page. Across the EU, GDPR Article 13 obliges a privacy notice to give the identity and contact details of the data controller, so even small shops tend to name a company there.

Company registers, trademarks and a plain web search

When a business runs the site, company registers are often the fastest way to find who owns a domain. Search the domain in quotes, then look up the footer's company name in an official register: Companies House in the UK, a Secretary of State site in the US, or OpenCorporates across many countries. Check the brand in a trademark database such as USPTO, EUIPO or WIPO's Global Brand Database. A company or trademark owner with the same name is strong evidence of who runs the site, and LinkedIn usually shows who works there.

What the certificate says

Next, check the certificate. Under the CA/Browser Forum's Baseline Requirements, an Organization Validated (OV) certificate must carry the subject's name, and under its EV Guidelines an Extended Validation (EV) certificate must carry the full legal name. A Domain Validated (DV) certificate cannot carry an organization name at all. Let's Encrypt issues only DV certificates, and its FAQ, last updated in April 2025, says it has no plans for OV or EV, so a Let's Encrypt certificate tells you nothing about the organization.

To see older certificates, search the domain on crt.sh — Sectigo's free search engine for Certificate Transparency, the public logs where certificate authorities record the certificates they issue. An OV certificate from three years ago can name a company that has since switched to a free DV one. A certificate that covers several unrelated domains can also point to one owner, unless a CDN obtained it for many of its customers.

DNS records and shared tracking IDs

Then run a DNS lookup on the domain. An MX record — the entry that tells mail servers where to deliver a domain's email — reveals whether the owner uses Google Workspace, Microsoft 365 or its own server. TXT records often hold verification tokens such as google-site-verification, MS= or facebook-domain-verification, which show the services where the owner has proved control of the domain.

Two pivots go further. A reverse WHOIS search — a lookup of every domain whose record lists the same organization or email — works best on older or unredacted records, and commercial tools such as DomainTools offer it. The page source may also carry a Google Tag Manager (GTM-), Google Analytics (G-) or AdSense (pub-) ID. Services such as BuiltWith can list other sites that share it, but agencies reuse IDs too, so treat a match as a lead.

Nameservers and the server's IP address lead to the DNS and hosting companies, and each runs its own abuse desk even when the owner stays silent. If the chain from nameserver to IP address is new to you, start with how DNS resolves a domain.

All of these clues describe the present. If the owner went private recently, the past may still hold their name, which is where the next method comes in.

Can You Find Out Who Owned a Domain Before It Went Private?

Often, yes, if the domain existed before May 2018. Historical WHOIS services such as DomainTools archived records from the years when registrant names and emails were public, so an older snapshot may show a past owner. When we checked Bellingcat's toolkit for OSINT — open-source intelligence — on 31 October 2026, it still listed DomainTools as partially free, with history behind a paid subscription.

For a free alternative, open the Internet Archive's Wayback Machine. Old snapshots of a site's contact, about or imprint pages often name the business that ran it years ago, and comparing their dates can show when that name disappeared.

An old name is a lead, not proof. When you find out who registered a domain years ago, that match does not prove the same person still holds it. A sale often leaves no public trace, and the creation date stays the same after one. When neither history nor outreach helps you find who owns a domain and you have a real legal reason, the formal channels take over.

How Do You Request Hidden Owner Data the Legal Way?

Send a disclosure request to the registrar, with your identity, the domain, the data you need and your lawful reason. For generic domains, ICANN's Registration Data Policy makes registrars link to their request process from their homepage, acknowledge a request within two business days and respond within 30 calendar days of that acknowledgement, barring exceptional circumstances. ICANN's free RDRS can route the same request, and trademark owners can file a cybersquatting complaint.

ICANN launched RDRS on 28 November 2023 and has extended it until late 2027. It gives you one form instead of a hunt for each registrar's page. Participation is voluntary, though: ICANN's RDRS usage report for July to September 2026 counts 79 registrars managing about 34% of gTLD domains under management. Of 4,036 closed requests since launch, registrars approved 1,076 in full and 61 in part, denied 2,573, and found the data already public in 326 cases.

That report also shows why requests fail. The most common denial reason since launch was an incomplete request (948 of 3,027 reasons given), just ahead of "cannot disclose the data due to applicable law" (908). Intellectual property holders filed about a third of all requests. Approvals came fast, with a median of 2 days, while denials took a median of 5 days, and one in ten took 114 days or longer.

Trademark disputes have their own track. A UDRP complaint — a case under the Uniform Domain-Name Dispute-Resolution Policy, the standard process for cybersquatting — can start against a "John Doe" registrant. WIPO then asks the registrar to confirm the real contact details, and the complainant can use them to amend the filing. WIPO handled 6,282 domain name cases in 2025, a record year, counting country-code disputes too, and its statistics page listed 5,726 for 2026 when we checked on 31 October.

Beyond that, a court order, or a police demand that rests on legal process, can compel disclosure where the registrar operates. On 12 May 2026, ICANN added a 24-hour deadline for urgent requests from authenticated law enforcement or other competent authorities about imminent threats to life, serious bodily injury, critical infrastructure or child exploitation. Extensions cannot go past 72 hours, and the rule applies only once a separate ICANN policy for authenticating those requesters is in place.

Trying to find who owns a domain that ends in .uk, .de or .eu? There the registry, not ICANN, sets the rules, and the next section shows how much they differ.

Do .uk, .de and .eu Domains Follow Different Rules?

Yes. A ccTLD — a country-code top-level domain such as .uk, .de or .eu — follows its own registry's policy and national law, not ICANN's rules for generic domains. In 2026 that often makes company data easier to see. Germany's NIS2 law took effect on 6 December 2025, and since late January 2026 DENIC's lookup has shown legal-entity holders' names, addresses, emails and phone numbers, but not private individuals' details.

The common thread is the EU's NIS2 Directive. Article 28 of NIS2 requires registries and registrars to keep accurate registration data, publish the data that is not personal, and answer lawful, substantiated access requests within 72 hours. Member states had to apply it from 18 October 2024. EURid, for example, commits to disclosing .eu data within 72 hours of a justified request, or within 24 hours in urgent cases.

One catch with .uk: Nominet's release process tells the registrant who asked, so assume the holder will see your name. If what you really want is the domain itself, the next section covers how to buy one.

What If You Want to Buy a Domain Someone Already Owns?

First check whether it is already for sale. A parking page that says the domain may be for sale, or shows a buy-now price, often comes from a marketplace such as Afternic or Sedo, which handles the deal without revealing the owner. If nobody lists it, contact the holder through the record's form or relay email with a specific offer, or hire a broker to negotiate for you while you stay anonymous.

Look up comparable sales on NameBio before you name a price. As of 31 October 2026, GoDaddy's Domain Broker Service charges $99.99 plus a 20% commission, works for up to 30 days and does not guarantee a sale.

Expiry follows a standard countdown for .com. The registry allows an auto-renew grace period of up to 45 days. A 30-day redemption period follows — the window in which only the previous holder can restore the name, usually for a fee — and then 5 days of pendingDelete before release. If the registrar waits until the grace period ends to delete the name, it drops about 80 days after expiry, and many registrars delete earlier.

Valuable names often never get that far. GoDaddy, for example, lists expired domains on GoDaddy Auctions 26 days after they expire, and when its auctions end on day 43 a winning bidder becomes the registrant. Watch those auctions, or place a backorder — a standing request to register the name the moment it drops — with a drop-catch service rather than waiting.

In the lookup, a status of redemptionPeriod or pendingDelete means that countdown has started. A clientTransferProhibited status, by contrast, is a routine lock that says nothing about whether the owner would sell.

Whichever route you take, the order below keeps the search fast and fair.

Which Method Should You Try First?

Start with the record itself. A free RDAP lookup shows the registrar, the domain's age, its status and, when the holder agreed, the company name. When it shows REDACTED FOR PRIVACY instead, the contact form or relay email in that same record is your first real lead. In our 31 October 2026 check, every readable record offered one, even for Google and Apple.

If the form goes quiet, let the website speak. Legal notices, privacy policies, company registers, OV or EV certificates and DNS records often name the business, and you can find the website's server IP to see who hosts it. History tools and the Wayback Machine add older names, but treat them as leads.

To find who owns a domain when you hold a genuine legal claim, put the request in writing. Registrars for generic domains must respond within 30 days of acknowledging it, ICANN's RDRS forwards requests to the registrars that take part, and EU registries owe a reply within 72 hours.

If you plan to buy the name instead, run a domain blacklist check before you pay so you do not inherit a spam listing. Either way, keep a dated screenshot of every record you rely on, because registration data changes.

Your next step takes a minute: run an RDAP lookup on the domain you are checking, then use the free DNS lookup below to see which email and hosting services its owner pays for.