Who owns a domain: domain owner lookup, domain ownership check, and how to buy the name from whoever holds it

You query the registration record, and then you accept that the record will probably not name a person. The authoritative lookup for a gTLD such as .com, .net or .org is RDAP, the Registration Data Access Protocol, and ICANN runs a free public one at lookup.icann.org. Type the domain, read the result, and you will get the registrar, the creation and expiry dates, the name servers, the domain status codes, and a small amount of location data. What you will usually not get is a name.

That is the whole shape of the exercise in 2026. The lookup is still worth running, because those remaining fields answer the questions that actually change your next move: is the name registered at all, when does it expire, is it locked, is it parked, and is it already listed for sale. Those five facts decide whether you should be making an offer, waiting, or simply going and registering something else.

If you want the answer for a name you are considering buying, run the lookup first and put an appraisal estimate next to it before you contact anyone. Walking into a domain negotiation without a number in your head is how people end up paying five figures for a name worth several hundred dollars.

Because ICANN policy now requires it by default. The Registration Data Policy came into force on August 21, 2025 and set a minimum data set that registrars publish, with everything outside it replaced by the literal string REDACTED in the response. In practice the fields that survive publication are registrant organization, state or province and country. Name, email, phone and street address are withheld unless the registrant has actively asked for them to be published.

The policy also killed three contact types outright. Administrative, technical and billing contacts are no longer part of the required data set for roughly 97.5 percent of gTLDs, and registrars have been deleting that data along with the registrant fax number. If you learned this subject before 2018 and remember pulling a technical contact's direct email off a WHOIS record, that route is gone at the level of policy, not just at the level of one registrar being cautious.

There is a quiet upside worth knowing. Because the organization field is now what determines the legal holder, a record that does show an organization is telling you something reliable: that a company, not an individual, holds the name, and that a change to that field counts as a change of ownership rather than a routine contact edit. When you are trying to work out whether you are negotiating with a hobbyist or a corporate legal department, that single field carries most of the signal.

WHOIS was sunset. On January 28, 2025, RDAP became the definitive source for gTLD registration data and ICANN's contractual requirement for registries and registrars to serve that data over the old WHOIS protocol ended. By September 2025 more than 370 gTLDs had switched their WHOIS service off. Plenty of sites still call their tool a WHOIS lookup, and plenty of them are quietly running RDAP underneath, which is fine. The label is a habit; the protocol changed.

The practical differences matter more than the name. RDAP returns structured JSON instead of free text, which is why modern tools can parse it reliably where WHOIS output had to be scraped per registrar. It supports internationalized data properly. And it supports tiered access, meaning a registrar can serve a redacted record to the public and a fuller one to an authenticated party with a legitimate reason. That last capability is the entire design intent behind the redaction you see.

One consequence that catches people out: country code domains are not covered by any of this. ICANN policy binds gTLDs. A .de, .co.uk, .fr or .eu name follows whatever its own registry decided, and those rules vary enormously. Nominet publishes far more about UK registrants than DENIC does about German ones. If your lookup on a ccTLD returns something unexpected, the explanation is almost always that you are outside ICANN's remit entirely.

Two routes exist and they suit completely different situations. The first is the registrar's own contact channel. Registrars are required to provide a way for a third party to reach the registrant, normally an anonymized forwarding address or a web form linked from the record. It is free, it takes a minute, and it is the correct first move for anyone who simply wants to buy a name. The trade-off is that you have no idea whether the message was read, and a large share of these go unanswered.

The second is ICANN's Registration Data Request Service, the RDRS, which routes a formal request for nonpublic data to the sponsoring registrar. Before you consider it, look at what it actually delivers. ICANN's two-year pilot summary, published on February 27, 2026 and covering November 28, 2023 to November 30, 2025, reported over 3,700 disclosure requests, of which 26 percent were approved, 55 percent were denied, and the remaining 19 percent were partially approved or turned out to be for data that was already public. Intellectual property claims made up 32 percent of requests and law enforcement 16 percent.

Read those numbers as what they are. RDRS is built for trademark counsel and investigators with a documented legal basis, and even they get refused most of the time. A buyer who wants to make an offer has no standing there and should not waste the effort. Coverage is partial too: the service launched with 56 participating registrars covering 51 percent of domains under management, peaked at 95 registrars and 60 percent in February 2025, and finished the pilot with 80 registrars covering 46 percent. ICANN's board has directed that it keep running for up to two more years.

So for the ordinary case, the answer is unglamorous. Use the registrar's forwarding address, keep the message short, name a real number, and expect silence more often than not. The alternative that works better is to stop treating the owner as someone you have to find, and start treating the name as something with a market price, which is what the rest of this page is about.

The table below is the field-by-field answer, and it is worth reading before you spend an afternoon trying to unmask a registrant who is not going to be unmasked. Roughly a third of the record survived the policy change, and that third is entirely made up of operational data rather than identity data.

Notice which side the useful fields fall on. Expiry date, status codes, registrar and name servers are all public, and between them they tell you when a name might become obtainable, whether it is locked, who you would have to deal with, and whether anyone is really using it. Identity is the part you lose, and identity is the part that mattered least to a buyer in the first place.

Look at the registrant organization field in the record, not at whose credit card pays the renewal. Under the current policy, whatever sits in that field is the legal holder. If it names your company, your company holds the name. If it names the agency that built your website, the agency holds the name, and the fact that you paid the invoice does not change that. If the field is empty, the individual named as registrant is the holder.

This is the single most common ownership shock in small business, and it usually surfaces at the worst moment, during a rebrand or a falling out with a supplier. The fix while relations are good is straightforward: get the record corrected, get the account credentials in your own name, and transfer it to a registrar you control so nobody else can move it. We wrote a longer walkthrough on recovering a name you used to control, which covers what to do when the relationship has already broken down.

Be aware of one timing trap. A change of registrant currently triggers a 60 day lock on inter-registrar transfers, so correcting the ownership record and moving the name to a new registrar cannot happen in the same week. Do the transfer first if the name is already in the right hands, or accept the wait if the record itself is wrong. ICANN has approved a shorter 30 day replacement lock, but as of July 2026 it is not yet in force.

Run the same lookup on your own name. The registrar of record is one of the fields that is still public, and it appears on every RDAP response for every gTLD, so a query at lookup.icann.org will name your provider in seconds even if you have no idea which login to use. This is the fastest way out of the situation where a business knows it has a website, cannot remember who set it up, and has three plausible invoices in the accounting system.

Two wrinkles are worth anticipating. If you bought through a reseller or a website builder, the record will name the wholesale registrar rather than the company you actually pay, so you may see a name you have never heard of. And if the record names a privacy service, that service is the registrar's proxy and the underlying account is still yours; contacting the registrar with proof of payment normally sorts it out. Once you have found it, it is worth a separate decision about which registrar you keep it at, because renewal pricing between providers varies by a factor of three or more on the same .com.

Start by checking whether the question of ownership even needs answering. A large share of good names are already listed for sale, in which case there is a price, a checkout and an escrow process, and hunting for the registrant is wasted effort. Search the name and see what comes back before you do anything else.

If it is genuinely held and not listed, you have four honest routes and they are not interchangeable. Making a direct offer through the registrar's contact channel is right when the name is in active use with years left on the clock. Bidding is right when the name has already gone to an expiry auction and the outcome is a matter of price rather than persuasion. Placing a backorder is right in one narrow case: the name is inside its expiry cycle, the owner looks genuinely gone, and no auction has been scheduled. And if the search comes back available, register it yourself and stop reading.

The mistake that costs the most is treating an unresponsive owner as a closed door. Names change hands constantly, and the reason so many people give up is that they measured their chances against a silent contact form rather than against the calendar. Watching names inside their expiry cycle costs nothing and turns up more acquirable inventory than any amount of emailing. Our guide to how long after a domain expires you can buy it lays out the timeline the registry actually follows.

There is no list price, and anyone quoting you a single figure is guessing. Aftermarket sales cluster heavily in the low four figures for a decent two word .com, run into five and six figures for a short dictionary word, and can be a few hundred dollars for a name whose owner had forgotten they had it. What determines the number is not the name's quality in the abstract, it is how badly the current holder wants to keep it and whether they know anyone is interested.

That second factor is why the approach matters as much as the budget. An unsolicited offer from a personal email address is treated very differently from one arriving through a marketplace with an escrow process attached, and an offer that opens by explaining exactly why you need this name for your funded startup will get priced accordingly. Anchor low, be brief, and be ready to walk.

Before any of that, get a number. An appraisal estimate is decision support, not a valuation you can take to a bank, but having one stops the negotiation from being anchored entirely by whatever the seller says first. The same discipline applies whether you end up buying a name outright, bidding for it, or waiting for it to drop. Our walkthrough on how to buy a domain name that is already taken covers how these conversations usually run and where they stall.