What is WHOIS, and what does it show?

WHOIS is a public directory of domain registrations. Every registry keeps one, and anyone can query it for any domain.

A record typically shows who registered the name, when, which registrar handled it, when it expires, which nameservers it uses and its current status. Historically it also showed the registrant’s name, postal address, phone number and email.

Much less than it used to be. Data protection law — GDPR in Europe, and similar rules elsewhere — pushed registries to redact personal details by default, and most now show the registrar, the dates, the nameservers and the status while hiding the person.

It varies by extension, though. Some country registries still publish more than others, and organisational registrations are often shown in full because a company is not a person.

If it matters to you, check what your specific extension publishes before you register.

Privacy protection replaces your contact details with a forwarding service in the public record. Email sent to the published address is relayed to you.

What it protects you from: spam harvesters, cold callers, and anyone casually looking up who owns a name.

What it does not protect you from: the registry and registrar still hold your real details, and will disclose them under legal process. It is not anonymity, and anyone who sells it as anonymity is overselling it. Some extensions, particularly in restricted namespaces, do not permit it at all.

Two practical reasons, and both bite at the worst moment.

Transfers. Approval emails go to the registrant address in the record. If that is an old address nobody reads, you cannot move the domain.

Renewals and verification. Expiry notices go there too, and some registries will suspend a domain whose contact email fails verification.

Check the address on your domains once a year. It takes two minutes and it is the difference between a routine transfer and a month of arguing.