Registering a domain requires contact details: name, address, email and phone. For years these appeared in public WHOIS lookups, and spammers harvested them. Anyone could look up a small business and find the owner's home address, personal mobile number and the exact day the name was due to expire.
Since privacy rules tightened, most registrars redact personal data for individuals by default. The record you see today is thinner than the one you would have seen a decade ago, but it is not empty, and what remains still tells a patient reader quite a lot.
What a lookup shows now
Run whois example.com and read it from the top. For most domains owned by individuals you will see the registrar, the creation, update and expiry dates, status codes such as clientTransferProhibited, and the nameservers. The registrant fields typically read "Redacted for privacy" or point to a contact form.
The nameservers alone say something. A name that uses a well-known hosting company's nameservers is probably hosted there, and an attacker choosing whom to impersonate in a phishing email appreciates that.
The registrar still holds the real details
Redaction hides data from the public. It does not delete it. Your registrar holds the true details, can pass them to a court, a law-enforcement body or a trademark owner with a legitimate claim, and uses them to contact you. The address must be valid, because verification emails go there.
False details are a bad idea. The registration agreement obliges you to give accurate information, and a domain with invented contact data can be suspended if someone complains. Worse, if the false address is the only way your registrar can reach you, you will miss the renewal notice and the transfer authorisation.
Verification: the email you must not ignore
After you register, or after you change the registrant email, the registrar sends a message with a link. Registrars must verify the registrant's email, and if it is not confirmed within about 15 days, the domain can be suspended and the website goes with it. That message gets filtered into junk more often than you would think.
Individuals, businesses and the visible address
Redaction is a default for individuals, not a guarantee for everyone. Some registries and registrars treat a registrant who is a company differently, and may show the organisation name and sometimes more. If you trade from home, a company address on the record can be your home address.
If you want to keep your home address out of public records, check what your registrar shows, and use a business address or privacy service where appropriate. A registered office at a formation agent, a serviced address or a post-office box can serve, provided post sent there actually reaches you. Use a role mailbox such as [email protected] that several people can read, rather than one person's inbox that disappears with them. Do not host that mailbox on the domain itself if you can avoid it, because if the domain lapses you lose the email that would let you recover it.
Who asks for the hidden data, and when
Redaction is not a wall. A registrar can release registrant details to someone with a legitimate reason, such as a trademark holder with a documented complaint, a court or a police force. Each registrar publishes how to ask. The usual route is a form that explains who you are, which name you mean and why you need the data, and the registrar decides case by case. It can take days.
For you as an owner, the practical point is the reverse: expect to be contacted through the anonymised address or form. Check that it forwards to a mailbox you read, and send yourself a test through it.
Look at your own configuration
- Run
whois yourdomainfrom a terminal and read every field, including the status lines. - Look at your registrar's account page for the contact details it holds. They may differ from what the public sees.
- Search your inbox, including junk, for the original verification email and confirm the address is valid.
- Check the privacy or redaction setting for each domain, as it can be per name rather than per account.