WHOIS Goes Quiet on Friday

A public phone book for domains

Every domain name has a public record called WHOIS. For years, anyone could look up a domain and see who registered it: a name, a mailing address, an email address and a phone number.

From Friday, for most domains ending in .com, .net, .org and the other generic endings, those personal details will be hidden from public view.

The record itself does not disappear. The parts that identify a person do.

Why it is changing now

Europe's GDPR applies from Friday, and publishing domain owners' home addresses and phone numbers to anyone who asks does not sit well with it.

On May 17, ICANN, the organisation that sets the rules for generic domain endings, adopted a temporary specification that takes effect on May 25.

It requires registrars to hide personal details where European rules apply, and allows them to go further. Many are expected to hide them for every customer, wherever they live, rather than sort customers by country.

Domains ending in .ca follow the Canadian registry's own rules, which have kept individual owners' personal details out of public view for about a decade. Friday changes little for them.

What a public record will still show

• The registrar the domain is registered with.
• The dates it was created and when it expires.
• The name servers that point it at your hosting.
• The province and country of the owner.
• A relay address or web form in place of the owner's email.

The last is the one that matters to anyone trying to reach an owner. Messages still get through, but through the registrar, without the sender ever seeing where they went.

Less spam, eventually

Public WHOIS has long served as a mailing list for anybody selling to domain owners. Search engine submission offers, web design pitches and official-looking renewal notices from companies you have never dealt with all drew on it.

Hiding the details should reduce new harvesting. It will not empty the lists already compiled, so the letters and calls will fade slowly rather than stop on Friday.

Whatever arrives, renew only through your own registrar account. An invoice for your domain from a company you do not recognise is a sales pitch at best.

Buying a domain someone else owns

Looking up an owner to ask whether a domain is for sale becomes harder.

Instead of an email address, you will usually find a relay address or a contact form run by the registrar.

Messages sent that way are forwarded to the owner, but if the owner's email on file is out of date, they never arrive.

Patience helps, and so can a domain broker. Whatever the route, pay only through an escrow service or a proper registrar transfer, never directly to somebody who simply claims to own the name.

Proving the domain is yours

The public record has quietly served as proof of ownership: a printout showing the business's name was often enough to settle a question.

From Friday, the proof is the registrar account. Whoever controls the login controls the domain, and the registrant named inside the account is who the registrar treats as the owner.

Transfers to a new registrar will lean more heavily on the transfer authorisation code, since the new registrar can no longer read the owner's email from the public record. Treat that code like a password.

Services that confirm control of a domain by emailing the address in the public record, certificate issuers among them, will rely more on other checks, such as a DNS record or a file placed on the site.

A worked example

A home inspection company with two inspectors had its .com domain registered in 2011 by the web designer who built its first site.

The public record showed the designer as the owner. Nobody at the company had looked, because renewals were handled: the designer renewed it each year and added the cost to an annual invoice that was paid without much reading.

When the company planned a new site with a new host, it needed the transfer code, and the code sat in an account the company had no access to.

The designer was cooperative, and the move took a week. The domain now sits in an account in the company's name, with a shared office address as the contact.

Auto-renew is on with a current card, and the login is recorded where two people can find it.

After Friday, the same problem is harder to spot from outside, since nobody but the registrar can see whose name is on the record.

Why to look before Friday

For a domain you are unsure about, today's public record still answers two questions at once: which registrar holds it, and whose name and email are on it.

After Friday, the registrar's name will still be there, but the owner's will not. Working out whose account holds an old domain gets slower, and depends on the registrar's help.

A screenshot or printout of each record, taken this week, is a useful reference whatever you find.

Your own details still need to be right

Hidden is not the same as unimportant. Registrars still require accurate contact details, and they use them for renewal notices, transfer approvals and verification emails that have to be answered.

Use a shared address, such as an office@ address, rather than one person's inbox, so the messages survive staff changes. Keep the card on file current, and turn on auto-renew for every domain the business depends on.

A paid privacy add-on may no longer be needed where the registrar now hides details anyway. Ask before the next renewal.

The counter-case

For many businesses, Friday changes very little.

A business whose domains are all .ca follows the Canadian registry's rules, which Friday leaves alone. One whose registrar account is already in the business's name, with a working shared email and a current card, has nothing to fix.

But from Friday nobody can confirm that from outside, including you. Sign in to each registrar account the business holds, and check that the registrant, the email and the card are all yours and all current.

This week

1. List every domain the business uses.
2. Look up each public record before Friday.
3. Log in to each registrar account.
4. Check the registrant is the business.
5. Use a shared office email as the contact.
6. Turn on auto-renew with a current card.
7. Record the logins where two people can find them.

Step four is the one that settles ownership. A domain registered in a former designer's or employee's name belongs, for practical purposes, to whoever holds that account, and fixing it is far easier before it is needed.

Deciding which of those domains the business actually needs is covered in a separate domain for every service.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.