{"id":4271,"date":"2026-11-06T12:52:00","date_gmt":"2026-11-06T12:52:00","guid":{"rendered":"https:\/\/www.ucartz.com\/blog\/find-domain-name-owner\/"},"modified":"2026-11-09T22:05:14","modified_gmt":"2026-11-09T22:05:14","slug":"find-domain-name-owner","status":"publish","type":"post","link":"https:\/\/www.ucartz.com\/blog\/find-domain-name-owner\/","title":{"rendered":"Who Owns a Domain Name? How to Find the Domain Owner"},"content":{"rendered":"\n

Look the domain up in a registration data service such as ICANN Lookup (lookup.icann.org<\/code>). For most domains you will see the registrar, the registration and expiry dates, the status and the country of the owner, but not the owner’s name, address or email. Those are usually hidden for privacy. To reach the owner, use the contact form or relay email address that the registrar publishes in the same lookup. Organisations often leave their company name visible, so you may still see who owns it.<\/p>\n\n\n\n

\"Terminal
A whois lookup shows the registrar and the creation and expiry dates of a domain<\/figcaption><\/figure>\n\n\n\n

What a domain lookup shows today<\/h2>\n\n\n\n

For years the tool for this job was WHOIS. For generic domains such as .com, .org and .net, ICANN has replaced WHOIS with the Registration Data Access Protocol (RDAP). ICANN calls RDAP the definitive source<\/a> of registration data for these domains and points people to its RDAP-based ICANN Lookup website or its open-source command-line client. Some registries still answer old WHOIS queries, but RDAP is the one to rely on.<\/p>\n\n\n\n

What you see is set by ICANN’s Registration Data Policy<\/a>. It says every lookup must show the domain name, registrar, registrar abuse contact, creation and expiry dates and status. The registrant’s country must always be shown, and the state or province if the registrar collected it. The registrant’s name, street, city, phone and email are also published unless the registrar redacts them, which it must do where the law requires, and may do for other reasonable purposes. In practice you will usually see them marked as redacted, as in the examples below.<\/p>\n\n\n\n

Usually visible<\/th>Usually hidden<\/th><\/tr><\/thead>
Registrar and its abuse contact<\/td>Registrant name<\/td><\/tr>
Creation, expiry and last-changed dates<\/td>Street address and city<\/td><\/tr>
Domain status (locks, pending delete)<\/td>Phone and fax<\/td><\/tr>
Name servers and DNSSEC<\/td>Real email address (replaced by a form or relay address)<\/td><\/tr>
Registrant country, often state, often organisation<\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

How to find the owner of a domain, step by step<\/h2>\n\n\n\n
    \n
  1. Run a lookup.<\/strong> Open ICANN Lookup, type the domain and search. You can also use your registrar’s lookup tool or the command line (below).<\/li>\n\n\n\n
  2. Read the registrant section.<\/strong> If a person or company name is shown, you have your answer. If it says “REDACTED FOR PRIVACY”, look for an organisation and country; a company name is often still there.<\/li>\n\n\n\n
  3. Find the contact route.<\/strong> When the email is redacted, the policy requires the registrar to publish either an email address or a link to a web form that reaches the owner without revealing them. Look for a contact URL or relay address in the registrant section.<\/li>\n\n\n\n
  4. Check the website itself.<\/strong> A contact page, legal notice or privacy policy often names the company behind the site. The SSL certificate can help too: organisation-validated (OV and EV) certificates carry the company name, while domain-validated ones show only the domain. Let’s Encrypt<\/a>, for example, issues domain-validated certificates only. The command after this list shows the certificate subject.<\/li>\n\n\n\n
  5. Write a short, clear message<\/strong> through the form: who you are, why you are writing and how to reach you. Some forms only offer a list of preset reasons. ICANN’s advisory on these web forms<\/a> notes that the owner then has the option to reply if they wish, so an answer is not guaranteed.<\/li>\n<\/ol>\n\n\n\n

    To read a certificate’s subject from a terminal, run:<\/p>\n\n\n\n

    echo | openssl s_client -connect www.microsoft.com:443 -servername www.microsoft.com 2>\/dev\/null | openssl x509 -noout -subject\nsubject=C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=www.microsoft.com<\/code><\/pre>\n\n\n\n
    With OpenSSL 3.6.3 that returned the company name in O=<\/code>. The same command against letsencrypt.org<\/code> returned only subject=CN=letsencrypt.org<\/code>.<\/p>\n\n\n\n
    Looking up a domain from the command line<\/h2>\n\n\n\n
    RDAP answers in JSON over HTTPS, so curl<\/code> is enough. For generic domains the lookup has two steps. The registry (for .org, the .org registry) knows the registrar and the dates; the registrar holds the contact details. We ran this for wikipedia.org<\/code> with curl 8.7.1:<\/p>\n\n\n\n
    curl -s https:\/\/rdap.publicinterestregistry.org\/rdap\/domain\/wikipedia.org<\/code><\/pre>\n\n\n\n
    The registry’s answer listed the registrar, the registration date (2001-01-13), the expiry date, three “client … prohibited” lock statuses and the name servers, plus a related<\/code> link to the registrar’s own RDAP server. Following that link returned the registrant object. The part that matters looked like this (trimmed):<\/p>\n\n\n\n
    \"roles\": [\"registrant\"],\n[\"contact-uri\", {}, \"uri\", \"https:\/\/domains.markmonitor.com\/whois\/contact\/wikipedia.org\"],\n[\"fn\", {}, \"text\", \"REDACTED REGISTRANT\"],\n[\"org\", {\"type\": \"work\"}, \"text\", \"Wikimedia Foundation, Inc.\"],\n[\"adr\", {\"cc\": \"US\"}, \"text\", [\"\", \"\", \"REDACTED FOR PRIVACY\", \"REDACTED FOR PRIVACY\", \"\", \"REDACTED FOR PRIVACY\", \"\"]],\n[\"email\", {}, \"text\", \"REDACTED FOR PRIVACY\"]<\/code><\/pre>\n\n\n\n
    That is a typical result. The person’s name, address and email are hidden, the organisation and country (cc<\/code>) are shown, and contact-uri<\/code> is the web form that reaches the owner. To find the right RDAP server for any extension, IANA publishes a bootstrap list; ICANN Lookup does this step for you.<\/p>\n\n\n\n
    Country code domains follow their own registry’s rules. A lookup of nixi.in<\/code> at the .IN registry’s RDAP server showed the organisation (NIXI) and the state (Delhi), with the name, street, city and email redacted, and a note to ask the registrar how to contact the owner.<\/p>\n\n\n\n
    The classic whois<\/code> command still works for many extensions and gives a quick text summary. Our guide to the WHOIS command on Linux<\/a> shows how to install and use it.<\/p>\n\n\n\n
    No result at all? The domain may be free<\/h2>\n\n\n\n
    If a registry has no record of a name, RDAP says so with an HTTP 404. We asked the .com registry about a name nobody had registered:<\/p>\n\n\n\n
    curl -s -o \/dev\/null -w '%{http_code}\\n' https:\/\/rdap.verisign.com\/com\/v1\/domain\/this-name-should-not-exist-b05-test.com\n404<\/code><\/pre>\n\n\n\n
    A 404 means “not registered at the registry”, not a guarantee you can buy it: some names are reserved or sold at premium prices. A domain search<\/a> at a registrar gives the final answer. If the lookup shows a status such as redemption period<\/code> or pending delete<\/code>, the name has expired and may become available; this article explains the stages after expiry<\/a>.<\/p>\n\n\n\n
    When you need the hidden details<\/h2>\n\n\n\n
    Some people have a real need for the full record: law enforcement, lawyers acting on trademark or fraud cases, security researchers. For generic domains ICANN runs the Registration Data Request Service (RDRS)<\/a>. You sign in with an ICANN account, explain your legitimate interest, attach documents and the request goes to the registrar. It only reaches registrars that take part in the service. For other registrars, ICANN says to contact the registrar directly to find out its disclosure process.<\/p>\n\n\n\n
    Common reasons people look up a domain owner<\/h2>\n\n\n\n