What is WHOIS and why your details might be public

WHOIS is the public directory of domain names: for any domain, it tells anyone who asks which company it is registered with, when it was created, when it expires, and sometimes who owns it. Today most registrars hide the owner's personal details by default, but not always, and not for every domain ending. You can look up your own domain in a minute and see exactly what strangers can see.

What WHOIS is, in plain words

Every domain is registered through a registrar, a company like GoDaddy, Namecheap or Network Solutions. When you register, you give your name, address, email and phone. The registry that runs each ending (.com, .org, .us and so on) keeps a record of the domain, and part of that record has always been public, so that people could contact a domain's owner about technical problems or abuse.

That public record used to be called WHOIS, after the old tool used to query it. For the common endings it has now been replaced by a newer system called RDAP (Registration Data Access Protocol), which returns the same kind of information in a tidier format. Most people still say "WHOIS lookup", and the result is much the same.

What a lookup shows

Go to ICANN's lookup tool, type your domain, and you will typically see:

The registrar: which company your domain is with. Useful when you have forgotten. How to find where your domain is registered has more on this.
Created and expiry dates. The expiry date is the one to watch; if it is soon and auto-renew is off, fix that now.
Status codes, such as "client transfer prohibited". That one is good news: it means the domain is locked against unauthorized transfers.
Nameservers: which company answers for your domain's DNS, the settings that send visitors to your website and mail to your inbox.
Registrant details, either your real contact information, the words "REDACTED FOR PRIVACY", or the name of a privacy service.

Why your details might be public

Several situations leave a name, address or phone visible:

An older registration at a registrar that only hides details if you buy a privacy add-on, and nobody bought it.
Privacy that was switched off, for example during a transfer, and never switched back on.
A .us domain. The rules for .us do not allow privacy services, so the registrant's details are shown. If you own a .us, assume your registration details are public and use a business address and phone.
Some country endings with their own rules.
The organization field. Some registrars still show the business name and state even when the personal name is hidden. For a business that is usually harmless.

Even where details are hidden now, old records from years ago may have been copied into history archives that some services sell. There is nothing to be done about those, but they are a good reason to use business contact details from now on.

Why it matters to a small business

Public registration details are mostly an annoyance rather than a danger, but they do invite trouble:

Spam and scam mail. The address and email on a domain record attract fake renewal notices and "listing" invoices. Domain renewal scam letters and emails shows the usual ones.
Your home address. Many owners run their business from home. If you registered with your home address, it can be one search away.
Phone calls from web design and marketing sellers who watch new registrations.

How to hide or change your details

At your registrar, find the domain's settings and look for Privacy, Domain Privacy, Contact Information or Registrant:

Turn on privacy if it is offered. Many registrars include it free; some charge a small yearly fee.
Update the contact details if privacy is not possible, using a business address (or a PO box if your registrar accepts one) and a business phone.
Keep the email address real. The registrar sends important messages, including the contact verification email that must be answered when you register or change details. If that email bounces or goes unanswered, the domain can be suspended.

Changing the registrant's name or organization can trigger a 60-day lock on transferring the domain to another registrar. If you are not planning a transfer, that does not matter. Domain privacy: should you hide your details? weighs the trade-offs if you are undecided.

Hidden does not mean anonymous

Privacy hides your details from the public, not from everyone. Your registrar still holds them and must keep them accurate. Law enforcement and people with a legitimate legal claim, such as a trademark dispute, can ask the registrar for them. Giving false details to stay hidden is against your registrar's terms and can cost you the domain. Accurate details behind a privacy screen are the safe combination.

Using WHOIS for other jobs

The same lookup helps with everyday questions:

"Who is our domain with?" The registrar line answers it.
"Is this renewal email real?" If the email says your domain expires tomorrow and the lookup says next August, it is a scam.
"Is the name I want really taken?" A lookup shows whether a domain is registered and when it expires, though not whether the owner will sell. What if the domain name I want is taken covers the options.
"Did the web designer register it in our name?" If privacy is off you will see it; if it is on, log in to the account to check.

Five minutes, once a year

Look up each domain you own at the ICANN tool.
Note the registrar and the expiry date in your records.
Confirm the status shows the transfer lock.
Check whether personal details are visible, and turn on privacy or switch to business details.
Make sure the contact email on the account is one you read.

When the domain side is tidy, the website is often next on the list. If yours could do with it, you can see your site rebuilt first on the domain you already own.