How to find out who registered a domain: WHOIS, RDAP and more

How do I find out who registered a domain?

WHOIS is a public database of registered domains and the service used to search it. RDAP (Registration Data Access Protocol) is its successor: it returns the same kinds of data in a standard JSON format. ICANN, which coordinates generic domains, has not required generic registries and registrars to run WHOIS since 28 January 2025 (the exceptions are .com, .name and .post). All of them must offer RDAP, and it is now the main source.

Steps:

1. Check the domain ending. For .pl, query the NASK registry; for .com, .net, .shop and other generic domains, use ICANN Lookup.

2. Enter only the domain, without "https://" or a path, for example example.pl.

3. Read the registration date, last change and renewal dates, the registrar (the company the domain was bought through), name servers and status.

4. Check whether a registrant (domain holder) name is shown. For private individuals it will not be.

WHOIS for .pl domains: what does NASK show?

The .pl registry is run by NASK. Its WHOIS search is on dns.pl, with data delayed by no more than 15 minutes. You can send the same query via RDAP at rdap.dns.pl/domain/ followed by the domain name. A classic whois query in a terminal (whois example.pl) returns the registrant type (person or organisation), dates, name servers, DNSSEC status and registrar details.

According to the .pl registry's privacy policy, identifying data of a registrant who marked themselves as a natural person is not published in WHOIS. So you will not see the name or home address of a private .pl domain holder. In our own check in October 2026, the RDAP response from rdap.dns.pl for a company domain included the organisation's name, while classic whois showed only the registrant type.

The registry can disclose hidden personal data, but not to everyone. The NASK privacy policy names courts and authorised bodies, and a person who claims the registrant violated their rights and provides information about pursuing that claim. NASK weighs that interest against the registrant's rights each time.

You can report a .pl domain used for phishing or malware to the registry at info@dns.pl. Under its abuse policy (as amended from 22 January 2025), NASK may then, among other things, remove the domain from DNS or terminate the registrant's contract.

WHOIS for .com and other domains: RDAP and ICANN Lookup

For generic domains the data comes from the registry and registrar, and ICANN Lookup collects it in one place. Since 21 August 2025, ICANN's Registration Data Policy has applied. It allows registrars to redact the registrant's name, address, phone and email, among other fields, where the law requires it (such as the GDPR) or where they have a commercially reasonable purpose. They then publish a contact form or relay address instead of an email address.

If you have a legitimate reason to see redacted data, the registrar must explain how to submit a disclosure request. It must answer a standard request without undue delay and within 30 calendar days of acknowledging it, absent exceptional circumstances. Domains are also often registered through a privacy service, in which case the lookup shows only the intermediary.

Other countries' domains (such as .de, .uk or .co) have their own registries and rules. ICANN Lookup shows data only where the registry offers RDAP.

What WHOIS will not tell you

1. Who runs the website. The domain holder, the hosting company and the seller in a shop can be three different parties.

2. Who a private individual is. Their data is hidden in .pl and usually in generic domains too.

3. Whether a site is honest. An old domain can be hijacked or bought, and a new one can belong to a reputable company.

WHOIS is one clue. Base your decision on several sources at once.

How to find the owner of a website

In Poland, a shop or service selling to consumers at a distance must give its identifying details. The Consumer Rights Act (Article 12) lists, among others, the business name, the authority that registered it, its registration number, address, email and phone. You will usually find them in the terms, on the contact page or in the footer.

Check these details in official registers:

1. Sole traders: the CEIDG business search on biznes.gov.pl, by tax number (NIP), REGON or name.

2. Companies: the National Court Register (KRS) search, by KRS number or name. It also shows the board and address.

3. Bank account for a transfer: the Ministry of Finance VAT taxpayer register (white list). If the company is on the VAT register, it shows whether the account is assigned to it.

4. Compare the company name with the registrant in RDAP. A match is a good sign. A mismatch or missing details on the site is a reason for caution, not proof of fraud.

On Facebook, business and public figure Pages have a page transparency section that Meta describes in its Help Center. It does not replace checking the company in a register. We describe the full process for shops in how to check if an online shop is legitimate.

How to check a domain's age, and why it matters

You can read a domain's age from the registration date in WHOIS or RDAP (the "created" field or the "registration" event). A domain registered a few days ago that imitates a well-known bank, shop or courier is a classic phishing setup. The date alone proves nothing, but combined with a name resembling a known brand and time pressure it is a strong signal.

Check the sender's domain the same way for an email with new bank details or an "urgent invoice". Next steps are in how to check if an email is genuine.

In arLET'S you can check a domain or email address for free, without an account. You will see the domain's age and status in the registry, whether it is on the CERT Polska warning list, similarity to known brands and email protection (SPF and DMARC). The result says what is known and what is not. It is not a certificate of honesty.

IP WHOIS and the whois command: who owns an IP address?

In Europe, IP addresses are allocated by RIPE NCC, and an IP whois searches its database, for example via the RIPE database search. The result shows which network the address belongs to: an operator, a hosting company or a large organisation. It will not show the person using the address at a given moment. Operators release that only to authorised bodies.

The whois command works in a terminal on macOS and Linux (for example whois example.pl or whois 192.0.2.1) and picks the right registry itself. On Windows you need to install it or use web search tools.