---
title: How to find out who owns a domain and when it expires (WHOIS, RDAP and scam checks)
description: Look up a domain's registrar, registration date, expiry date and status with RDAP, the successor to WHOIS; why the owner's details are usually hidden, how to request them, and how to use domain data to spot a suspicious site.
updated: 2026-10-27
---

# How to find out who owns a domain and when it expires

A domain's public record now comes from RDAP, the successor to WHOIS: enter a domain and you see its registrar, when it was registered, when it expires and whether it's locked. The owner's name and contact details are usually hidden for privacy; with a legitimate reason you can request them through ICANN's request service or ask the registrar to pass on a message.

## Three ways to look it up

**1. ICANN Lookup (web)**
Enter the domain at https://lookup.icann.org to see the registrar, registration and expiry dates, status and nameservers.

**2. .tw domains: TWNIC WHOIS**
Look up .tw and .台灣 domains at https://whois.twnic.tw.

**3. API or command line (for scripts and AI agents)**

```bash
curl "https://nymwell.com/api/v1/domains/info?domain=example.com"
npx nymwell info example.com
```

No account or key. The answer includes the registry record, DNS and the website's status. For example.com:

```json
{
  "domain": "example.com",
  "status": "registered",
  "registry": {
    "registrar": "RESERVED-Internet Assigned Numbers Authority",
    "registered_at": "1995-08-14T04:00:00Z",
    "expires_at": "2027-08-13T04:00:00Z",
    "transfer_locked": true
  },
  "dns": {"nameservers": ["elliott.ns.cloudflare.com", "hera.ns.cloudflare.com"]},
  "website": {"https": true, "status": 200}
}
```

AI agents can call the `domain_info` tool on Nymwell's MCP server, also with no sign-in.

## What you can and can't see

| Usually visible | Usually hidden |
| --- | --- |
| Registrar, registration date, expiry date, last update | Owner's name, address, phone, email |
| Status (for example transfer or delete locks) | Proof of the owner's identity |
| Nameservers and whether DNSSEC is on | |

**Why is the owner hidden?** Since 2018, to comply with the EU's GDPR, ICANN has required registrars and registries to redact personal data from public records; the formal Registration Data Policy took effect on 2025-08-21. For .tw, contact details are hidden by default since 2023-06-01: domains held by a company still show the company name, country and email, while those held by individuals don't.

**Does WHOIS still work?** Since 2025-01-28 RDAP is the definitive source for generic domains, and registries and registrars no longer have to run WHOIS (except for .com, .name and .post).

## Contacting the owner

- **Generic domains (.com and others):** anyone with a legitimate interest can request non-public data from participating registrars through ICANN's Registration Data Request Service (https://rdrs.icann.org).
- **.tw domains:** TWNIC has a form that passes a message to the registrant; it can't promise a reply.
- **Want to buy someone else's domain:** check whether the website shows it for sale, or ask through the registrar or a domain marketplace.

## Using domain data to spot a suspicious site

Domain data alone can't prove a site is a scam, but it gives clues:

1. **A very recent registration date.** Phishing sites that imitate a known brand are often only days or weeks old.
2. **A name that's almost right.** An extra letter, an l swapped for a 1, an added -login or -secure, or a different ending.
3. **A different registrar and nameservers from the brand's real domain.** Compare the two records side by side.
4. **Report it.** ICANN suggests reporting abuse to the domain's registrar first; its name is in the lookup result.

## Questions

**Can I find out who bought a domain?**
Usually not. Personal details are redacted from public lookups. Company-held .tw domains are an exception and show the company name.

**How do I find out when a domain expires?**
It's the expires_at date in the lookup result. An expired generic domain isn't released at once: it goes through a 30-day redemption period and a 5-day pending-delete period first.

**Will the owner know I looked up their domain?**
Generally no. RDAP and DNS lookups read public data, and the owner isn't notified because you looked.

**If a lookup finds no record, can I register the domain?**
Not necessarily. It may be reserved or covered by a registry rule. To be sure, check it with [domain search](https://nymwell.com/en/domain-search/), which asks the registrar live.

## Sources

- RDAP (RFC 7480): https://www.rfc-editor.org/rfc/rfc7480
- ICANN on RDAP replacing WHOIS (2025-01-27): https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en
- ICANN Registration Data Policy: https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy
- ICANN RDRS: https://www.icann.org/rdrs-en
- TWNIC on hiding contact details by default: https://www.twnic.tw/dnservice/policy/contents.php?id=20&lang=zh-tw
- ICANN guide to reporting DNS abuse (2025-11-17): https://www.icann.org/en/system/files/files/submitting-dns-abuse-complaints-icann-guide-17nov25-en.pdf

## Related

- [What happens when a domain expires?](https://nymwell.com/en/guides/what-happens-when-a-domain-expires/)
- [How domain availability actually works](https://nymwell.com/en/guides/how-domain-availability-works/)
- [How to transfer a domain](https://nymwell.com/en/guides/domain-transfer/)