Stedra
Sign inCheck my business
BlogBASICS5 min read

How to find out who your domain is actually registered to

Steps verified against the official documentation below · last checked 2026-07-18

Ask a room of business owners who their domain is registered to and most will guess. The honest answers are often unsettling: a web agency from two rebrands ago, a co-founder who left, an employee's personal Gmail, or "whoever set up the website."

Checking takes two minutes and requires no account. Here's how to do it — and how to read what you find, because the tooling changed recently and most guides online still describe the old one.

WHOIS is gone. Meet RDAP.

For decades the answer was "do a WHOIS lookup." That era formally ended on 28 January 2025, when ICANN stopped requiring registries and registrars of generic top-level domains to run WHOIS at all. Its successor is RDAP — the Registration Data Access Protocol — which serves the same registration data in a structured, standardised form.

You don't need to know the protocol. ICANN runs a free lookup at lookup.icann.org that queries RDAP for you.

Run the lookup and read the result

  1. 1
    Go to lookup.icann.org and enter your domain
    No login needed.
  2. 2
    Note the registrar
    This tells you which company's account controls the domain — and therefore where the login you need lives (GoDaddy, Namecheap, Cloudflare, …).
  3. 3
    Check the important dates
    Registration date and, crucially, the expiry date. If expiry is close and you don't know whose card renews it, that's urgent.
  4. 4
    Read the status codes
    clientTransferProhibited means a transfer lock is on (good, if you control the account). serverHold or redemptionPeriod mean something is already wrong.
  5. 5
    Look at the registrant
    Name, organisation, email — this is who the domain legally belongs to. If it says an agency's name, or a person who left, you've found an ownership problem.

What "REDACTED FOR PRIVACY" means

Since GDPR, most personal registrant data is hidden from public queries — you'll frequently see "REDACTED FOR PRIVACY" or a privacy/proxy service listed instead of a name. That's normal and doesn't mean anything is wrong. (For legitimate needs — legal disputes, law enforcement — ICANN operates a formal request process for non-public data, the Registration Data Request Service.)

Redaction changes what the lookup can prove: it may not show you *who* owns the domain, but it always shows you *where* it's registered. The practical ownership test is simple: can someone at your company sign in to that registrar account today? If nobody can, the redacted name doesn't matter — you don't control the domain.

The four things to check while you're there

  • Expiry date — is it more than a few months out, and does auto-renew have a working card behind it?
  • Registrar account — does the business control the login, with at least two people able to reach it?
  • Transfer lock — is clientTransferProhibited set, so nobody can move the domain without you?
  • Registrant details — is the organisation your business, on a company mailbox rather than a personal one?
A lookup can't see the last two from outside — who holds the login is exactly what public data can't tell you. That's what Stedra's guided interview asks, after the scan maps everything else.
SOURCES & OFFICIAL DOCUMENTATION
ICANN — Registration data lookup toolICANN — Registration Data Request Service (non-public data)
This is one asset. How many others does your business not control?

The free scan maps your domain, email, cloud, social and tools from public records — and shows what you'd lose access to tomorrow. No login, nothing to install.

Check my business
KEEP READING
Your web agency owns your domain. Here's how to get it back.
7 min read
Your only Google Workspace admin left. Here's how to recover control.
6 min read