Jump to content

User:Tcbin192

From Wikipedia, the free encyclopedia

Domain privacy (often called Whois privacy) is a service that hides a domain registrant's personal contact information and is offered by multiple domain name registrars[1]. Usually, when creating a domain, the registrant must provide personal contact information. This information includes name, email address, physical address, and phone number.[2] By utilizing domain privacy, a user who registers a domain buys privacy from the company, who in turn replaces the user's information in the WHOIS and Registration Data Access Protocol (RDAP) with the information of a forwarding service (for email and sometimes postal mail, it is done by a proxy server).[2] This helps keep their personal information protected instead of being easily accessible.[2]

History

[edit]

The Whois started in the 1980s as a directory for users of ARPANET. The purpose of it was for looking up the registrars, domain names and other information. [3] In March 1982 it was formally introduced as the Nicname/Whois server by the Network Information Center at SRI International.[4] The information registrants provided included full name, mailing address, telephone and network mailbox. [4]

In 1998, The Internet Corporation for Assigned Names and Numbers (ICANN) was created in the state of California as a non profit corporation in order to manage the Domain Name System. [5] This means ICANN was now in charge of the WHOIS system.[5]

With the growing popularity of the internet, WHOIS became more commonly utilized such as by companies, law enforcement, and individuals. [3] However, this presented problems because the personal details of the domain registrants could be accessed through WHOIS, which can leave people vulnerable to spam and crime. [6]

In response to these concerns, many domain registrars started offering domain privacy and proxy services. [7]Privacy services involve allowing a domain registrant, that is the holder of the domain, to be listed as the domain owner but with valid contact details in place of the registrant's home address. This can include a mail forwarding service address.[7] Proxy services, on the other hand, involve a proxy service being the registered holder of the domain with the proxy's information shown as the registrant in the Whois database. This keeps identity and contact details of the true owner private.[7]

It was not until the 2013 ICANN Registrar Accreditation Agreement that Domain Privacy and Proxy Services were formally recognized by ICANN.[8] Acknowledging these privacy and proxy services, ICANN set out requirements for them including disclosing service terms and pricing online, being contactable in cases of infringement or abuse, disclosing business contact info, and following their own service terms. [8][9]

In 2018, the General Data Protection Regulation (GDPR) came into effect in the European Union. [10] This changed Domain Privacy at a fundamental level because it required redaction of personal data from the WHOIS database by default for domain registrants. [11][12] In response to this, ICANN adopted the Temporary Specification for gTLD Registration Data on May 17, 2018.[13][14] To comply with the GDPR, ICANN required Domain Registers to redact all personal information of their registrants from the WHOIS database. This means requiring domain privacy is now required by default by ICANN.[14] Access to registrant information is still possible for a “legitimate and proportionate purpose,” via a formal request system through ICANN. [14]

On January 28, 2025, ICANN officially replaced the WHOIS domain registration database with the Registration Data Access Protocol (RDAP) as the definitive source of registrant information for ICANN registered domains. [15] The new system allows access to nonpublic registration data via the Registration Data Request Service. This service is intended only for those with a legitimate interest which includes law enforcement, government, intellectual property professionals and consumer protection advocates. [15]

How Domain Privacy Works

[edit]

When registering for a domain, the registered domain holder (an individual or organization) must provide the domain registrar with reliable contact details. As listed by the 2013 ICANN RAA, details include: "the full name, postal address, e-mail address, voice telephone number, and fax number if available of the Registered Name Holder; name of authorized person for contact purposes in the case of an Registered Name Holder that is an organization, association, or corporation". [8] According to this contract, registrars are required to collected and maintain this registrant information as long as the domain remains active. [8]

This personal contact information is usually public and listed in the WHOIS database and the Registration Data Access Protocol (RDAP). Domain privacy allows a domain registrant to prevent this information from in these public directory. Instead of the registrant's own personal details, including real name, address, email, and phone number, the domain privacy provider instead substitutes its own alternative contact details. [2]

ICANN defines two different types of services: privacy services and proxy services. Privacy services mean the actual registrant is still the registered owner of the domain, but the contact information in the WHOIS / RDAP databases is replaced with the alternate contact information of privacy provider.[8] Proxy services mean the actual domain owner is listed as the proxy provider, and the person who wants protection gets a license to use the domain name. [8]

Level of anonymity

[edit]

Registrars typically collect personal information to provide the service. Some registrars take little persuasion to release the so-called 'private' information to the world, requiring only a phone request or a cease and desist letter.[16][17][18] Others, however, handle privacy with more precaution, using measures including hosting domain names offshore and accepting cryptocurrencies for payment so that the registrar has no knowledge of the domain name owner's personal information (which would otherwise be transmitted with credit card transactions). It is debatable whether or not this practice is at odds with the domain registration requirement of the Internet Corporation for Assigned Names and Numbers (ICANN).

Privacy by default

[edit]

Following ICANN's 2018 adoption of Temporary Specification for gTLD Registration Data, all general top level domains (gTLDs) are required to redact all personal information of domain registrants from the public Whois and RDAP databases by default, no matter the country of the registrant. This includes the name, address, email, and number of the registrant. [14]

General Top-Level Domain Names (gTLDs)

[edit]

Some well known gTLDs which have redacted personal information by default since 2018 include[19]:

Country-Code Top-Level Domains (ccTLDs)

[edit]

Numerous ccTLDs have their own privacy rules outside of ICANN. These include:

  • .al: No information about the owner is disclosed.
  • .at, .co.at, .or.at: Since May 21, 2010, contact data (defined as phone number, fax number, e-mail address) is hidden by the registrar and must be explicitly made public.[20]
  • .ca: Since June 10, 2008, the Canadian Internet Registration Authority no longer posts registration details of individuals associated with .ca domains.
  • .ch and .li : Since 1st January 2021 Whois information is private by default and can be obtained only in limited cases[21]
  • .de: Since May 25, 2018, the German Internet Registration Authority denic put extensive changes into force for the Whois Lookup Service. With a few exceptions, third parties can no longer access domain ownership data.[22]
  • .eu: If the registrant is a natural person, only the e-mail address is shown in the public Whois records unless specified otherwise.[23]
  • .fi: Individual persons' data is not published (changed in 2019), but for companies, associations, etc., data is published.
  • .fr: By default, individual domain name holders benefit from the restricted publishing of their personal data in the AFNIC public Whois.[24]
  • .it: Contact data of individuals is not published unless consent is given explicitly. For companies, data is always published. Proxy services are not allowed.[25]
  • .gr: No information about the owner is disclosed.
  • .is: May hide address and phone number.
  • .nl: Since January 12, 2010, registrant postal addresses are no longer publicly available.[26][27]
  • .ovh: Contact data is hidden by the registrar and must be explicitly made public.
  • .uk: Nominet, the guardian of UK domain namespace, provide domain privacy tools on their extensions (.co.uk, .me.uk etc.), providing that the registrant is not trading from the domain name.[28] While the home address of the registrant can be hidden, the full name cannot.

Privacy forbidden

[edit]
  • .br: As of April 2022, the domain registration contract[29] requires the publication of name, email, country, and CPF number for all domains. Additionally, if the domain owned by a company, the company's phone number, address, and CNPJ number must also be public. Access to some of these details requires passing a CAPTCHA at whois.registro.br.
  • .us: In March 2005, the National Telecommunications and Information Administration (NTIA) said that owners of .us domains will not have the option of keeping their information private, and that it must be made public.[citation needed]
  • .in: Registrants for Indian domain names may not use any proxy or privacy services provided by registrars.[30]
  • .au: Any Australian domain names ends with .au is forbidden from privacy due to the law. While most of the information are public, some of the information such as the street address, telephone and fax numbers of registrant is hidden.[31]

Implications

[edit]

The Internet Corporation for Assigned Names and Numbers (ICANN) broadly requires the mailing address, phone number, and e-mail address of those owning or administrating a domain name to be made publicly available through the WHOIS and Registration Data Directory Services (RDDS) for RDAP. However, that policy enables spammers, direct marketers, identity thieves, or other attackers to use the directory to acquire personal information about those people. Although ICANN has been working to change WHOIS to enable greater privacy, there is a lack of consensus among major stakeholders as to what type of change should be made.[32] However, with the offer of private registration from many registrars, some of the risk has been mitigated. In addition, successor RDAP moved most contact information of domain name towards RDDS.

Researchers in the industry have worked on improving the design of the domain name system, in order to reduce the likelihood of attackers compromising the infrastructure. They have done so by allowing for varying options and adjusting the guidelines of how they operate.[33]

Litigation

[edit]

With the help of "private registration", the service can be the legal owner of the domain. This has occasionally resulted in legal problems. Ownership of a domain name is given by the organization name of the owner contact in the domain's WHOIS record. There are typically four contact positions in a domain's WHOIS record: owner, administrator, billing, and technical. Some registrars will not shield the owner organization name in order to protect the ownership of the domain name.[34]

There has been at least one lawsuit against Namecheap, Inc. for its role as owner/registrant;[35] Namecheap lost its motion to dismiss. Silverstein v. Alivemax, et al. Los Angeles Superior Court Case Number BC480994 was dismissed in May 2014.[36] Silverstein is well known for his anti-spam and email privacy campaigns, most notably in the case of William Silverstein v Keynetics, Inc., No. 17-15176 (9th Cir. 2018), but this was decided for Keynetics in March 2018.[37]

Ownership of domains held by a privacy service was also an issue in the RegisterFly case, in which a registrar effectively ceased operations and then went bankrupt. Customers encountered serious difficulties in regaining control of the domains involved.[38] ICANN has since remedied that situation by requiring all accredited registrars to maintain their customers' contact data in escrow. In the event a registrar loses its accreditation, gTLD domains, along with the escrowed contact data, will be transferred to another accredited registrar.[citation needed][39]

See also

[edit]

References

[edit]
  1. ^ Elliott, Kathryn (January 2009). "The who, what, where, when, and why of WHOIS: Privacy and accuracy concerns of the WHOIS database". SMU Science and Technology Law Review. 12 (2).
  2. ^ a b c d "What is domain privacy protection?". IONOS Digital Guide. 2023-10-26. Retrieved 2025-11-03.
  3. ^ a b "Whois". icannwiki. Retrieved 2025-11-13.
  4. ^ a b NICNAME/WHOIS (Report). Internet Engineering Task Force. 1 March 1982.
  5. ^ a b "ARTICLES OF INCORPORATION OF INTERNET CORPORATION FOR ASSIGNED NAMES AND NUMBERS". ICANN. 21 November 1998.
  6. ^ "WHOIS and Data Protection". gac.icann.org. Retrieved 2025-11-13.
  7. ^ a b c "About Privacy/Proxy Registration Service". ICANN.
  8. ^ a b c d e f "2013 Registrar Accreditation Agreement". ICANN.
  9. ^ "Information for Privacy and Proxy Service Providers, Customers and Third-Party Requesters". ICANN.
  10. ^ "General Data Protection Regulation (GDPR) – Legal Text". General Data Protection Regulation (GDPR). Retrieved 2025-11-24.
  11. ^ "GDPR and WHOIS Privacy". blog.dnsimple.com. 2019-04-03. Retrieved 2025-11-24.
  12. ^ "The GDPR and WHOIS privacy". FIRST — Forum of Incident Response and Security Teams. Retrieved 2025-11-24.
  13. ^ "ICANN and the European Union General Data Protection Regulation". ICANN.
  14. ^ a b c d "Temporary Specification for gTLD Registration Data" (PDF). ICANN.
  15. ^ a b "ICANN Update: Launching RDAP; Sunsetting WHOIS". ICANN.
  16. ^ "Private domains not so private?". CNET News.com. 2005-08-15. Retrieved 2016-02-03.
  17. ^ Thomas Roessler (2003-04-15). "More on Domains By Proxy". Archived from the original on 2005-12-25. Retrieved 2006-03-13.
  18. ^ Wendy Seltzer (2003-04-11). "proxy fight [Domains-by-proxy update]". Archived from the original on 2008-06-05. Retrieved 2008-06-16.
  19. ^ "Root Zone Database". www.iana.org. Retrieved 2025-11-24.
  20. ^ nic.at GmbH (2010-05-21). "Change of nic.at Whois policy". Archived from the original on 2014-06-06. Retrieved 2014-05-05.
  21. ^ "Information service - Lookup - Internet Domains". www.nic.ch. Archived from the original on 2023-03-07. Retrieved 2021-01-30.
  22. ^ "DENIC Putting Extensive Changes into Force for .DE Whois Lookup Service by 25 May 2018". Archived from the original on 7 March 2023. Retrieved 28 May 2018.
  23. ^ EURid. ".eu domain name WHOIS policy". Retrieved 2016-04-29.
  24. ^ AFNIC. "AFNIC Data publication and access policy". Retrieved 2017-06-26.
  25. ^ "La politica del Registro .it sul Database dei Nomi Assegnati (DBNA) e sul servizio WHOIS" (PDF). NIC.it. 2022-05-30.
  26. ^ Van Miltenburg, Olaf (12 January 2010). "SIDN anonimiseert whois-gegevens" [SIDN anonymizes whois data]. Tweakers (in Dutch). Archived from the original on 4 September 2014. Retrieved 4 September 2014.
  27. ^ "SIDN implements Whois changes from 12 January 2010". SIDN. 1 January 2010. Archived from the original on 29 January 2010. Retrieved 4 September 2014.
  28. ^ Nominet. "Nominet WHOIS Opt Out".
  29. ^ NIC.BR, Núcleo de Informação e Coordenação do Ponto BR (April 25, 2022). "Contrato para registro de nome de domínio sob o ".br"" [Contract for registration of domain name under ".br"]. registro.br (in Portuguese). Archived from the original on April 27, 2023. Retrieved April 27, 2023. III. estar ciente de que parte dos dados informados pelo REQUERENTE no momento de requisição de registro de nome de domínio ficarão disponíveis à consulta pública por meio do serviço de diretório do REGISTRO.br. Esses dados são publicados para permitir a identificação dos responsáveis pelos domínios registrados sob o ".br", de forma a garantir a transparência na atividade de registro e a responsabilização daqueles que utilizarem esse recurso de forma abusiva, tornando a Internet mais segura e a sua governança mais transparente a toda sociedade. a) Para domínios de titularidade de pessoa jurídica serão publicados o nome empresarial, número do CNPJ, país, nome do responsável, endereço, telefone, dados do contato titular e do contato técnico. b) Para domínios de titularidade de pessoa física, serão publicados o nome, CPF, país, dados do contato titular e do contato técnico.
  30. ^ Registry.in. "Terms and Conditions for registrants" (PDF). Archived (PDF) from the original on 2018-07-25. Retrieved 2017-08-04.
  31. ^ "Domain Privacy and Australian Domain Names | Domain Registration AU". Archived from the original on 2023-03-07. Retrieved 2020-11-15.
  32. ^ "The Privacy Conundrum in Domain Registration". Act Now Domains. Archived from the original on 7 March 2023. Retrieved 26 March 2013.
  33. ^ Khormali, Aminollah; Park, Jeman; Alasmary, Hisham; Anwar, Afsah; Saad, Muhammad; Mohaisen, David (2021-02-11). "Domain name system security and privacy: A contemporary survey". Computer Networks. 185 107699. arXiv:2006.15277. doi:10.1016/j.comnet.2020.107699. ISSN 1389-1286.
  34. ^ "1 Introduction & Background to Whois | Generic Names Supporting Organization". gnso.icann.org. Archived from the original on 2023-04-01. Retrieved 2021-04-20.
  35. ^ "SolidHost v Namecheap" (PDF). Archived (PDF) from the original on 2023-03-29. Retrieved 2013-09-06.
  36. ^ "Case Summary - Online Services - LA Court". www.lacourt.org. Archived from the original on 2023-04-01. Retrieved 2018-08-13.
  37. ^ "Silverstein v Keynetics, Inc". Archived from the original on 2023-04-01. Retrieved 2018-08-13.
  38. ^ "Anger and fear as domain firm slowly implodes". Computer Business Review. February 21, 2007. Archived from the original on December 16, 2013. Retrieved December 11, 2013.
  39. ^ Elliott, Kathryn (2009). "The Who, What, Where, When, and Why of WHOIS: Privacy and Accuracy Concerns of the WHOIS Database" (PDF). Science and Technology Law Review. 12. Archived from the original (PDF) on 2023-03-29. Retrieved 2020-10-30.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=User:Tcbin192&oldid=1323961491"