WHOIS lookup: how to find who owns a domain, read RDAP results and contact a hidden .ca or .com owner

To find out who owns a domain, run a WHOIS or RDAP lookup on the name. You will always see the registrar, the creation and expiry dates, the status and the nameservers. The holder's name and contacts are often hidden: personal details of individual .ca holders are private by default, and most .com records are redacted. In that case you contact the holder through the registry's or registrar's message form.

Disclosure: some links in this guide are partner links. If you buy through them, MMIX may earn a commission; your price stays the same.

WHOIS, RDAP and what changed

WHOIS is the old system for publishing domain registration data. RDAP (Registration Data Access Protocol) is its replacement, with structured results and better access control. For generic domains such as .com, ICANN ended the registry and registrar WHOIS obligations on January 28, 2025, and RDAP became the official source. Many tools still call themselves "WHOIS lookup" and query RDAP behind the scenes.

Privacy changed the content too. Since 2018 most registrars redact personal data in generic-domain records. For .ca, CIRA has hidden the personal information of individual registrants by default for years, while organizations' names can be shown.

How to find who owns a domain in 7 steps

Step 1. Run the lookup in a reliable tool

Use the registry or a registrar's tool. For generic domains, ICANN Lookup queries RDAP directly. For .ca, CIRA's own WHOIS shows the registry record. A registrar tool such as Namecheap WHOIS lookup works for most endings in one place. Avoid sites that ask you to install anything or sign up to see basic records.

Step 2. Read the key fields

• Registrar: the company through which the domain is registered. This is where renewals, transfers and abuse reports go.
• Creation and expiry dates: how old the domain is and when it must be renewed.
• Updated date: the last change to the record, such as a renewal or a contact update.
• Nameservers: which DNS provider serves the domain, which often hints at the host.
• Registrant organization: shown for many company-held domains, hidden for individuals.

Step 3. Understand the status codes

Status codes come from the EPP standard. "clientTransferProhibited" means the registrar lock is on, which is normal and protects the domain. "serverHold" or "clientHold" means the domain is registered but switched off in DNS. "redemptionPeriod" and "pendingDelete" mean the domain expired and may soon be released; our article on expired domains explains the timeline. "OK" or "active" means there are no restrictions.

Step 4. If the owner is hidden, use the message form

For .ca domains with hidden registrant details, CIRA offers a form for sending a message to the registrant without revealing their address. For generic domains, the record usually shows a registrar contact, a privacy service email or a web form that forwards your message. Write briefly, explain who you are and why you are contacting them, and do not expect a reply.

Step 5. Look for other public clues

The website itself often names the business in its footer, contact page or privacy policy. Company registries (federal and provincial), the business's social profiles and archived copies of the site on the Internet Archive can also help. Keep this to public sources and respect people's privacy.

Step 6. Decide what to do with what you found

If you want to buy the name, make a polite offer or use a broker. If the domain is for sale, it may be listed on a marketplace such as Namecheap Marketplace. If the domain copies your trademark and is used in bad faith, a dispute is possible: the UDRP for generic domains and CIRA's CDRP for .ca, usually with a lawyer's help. For phishing or malware on a domain, report it to the registrar's abuse contact shown in the record.

Step 7. Check your own domain's record

Run the same lookup on your own domains. The registrant should be your business, the expiry date should be well ahead, the lock should be on and the nameservers should be the ones you expect. If the registrant is a former designer or employee, fix it now. Our .ca registration guide explains how the registrant fields should look.

What to check: common mistakes

• Treating the registrar as the owner. The registrar only manages the registration. The registrant is the holder.
• Reading the hosting company from the WHOIS record. Nameservers point to the DNS provider, which is not always the host.
• Trusting old records on third-party sites. Cached copies on aggregator sites can be years old. Check the live registry or RDAP record.
• Sending aggressive messages. Threats rarely help in a purchase and can hurt you in a dispute.
• Ignoring the expiry date of your own domains. A lookup takes a minute and can prevent an outage.

.ca and .com lookups side by side

Law enforcement, lawyers and rights holders can ask a registry or registrar for hidden data through a formal request process. For everyone else, the relay forms are the intended route.

FAQ